Workspace One Boxer Admin Guide

Workspace ONE Boxer Admin Guide
30 June 2024
Contents
VMware Workspace ONE Boxer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Boxer Deployment Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Workspace ONE Boxer Deployment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Supported Capabilities for Workspace ONE Boxer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Application Configurations for Workspace ONE Boxer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
DISA Purebred Support for Workspace ONE Boxer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Calendar and Mailbox Delegation in Workspace ONE Boxer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Secure your Emails and Documents with Azure Information Protection (AIP) Sensitivity labels in
Workspace ONE Boxer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Device Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Workspace ONE Boxer Comparison Matrix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Frequently Asked Questions for Workspace ONE Boxer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Copyright ©2005-2024 Broadcom. All Rights Reserved. 2

VMware Workspace ONE Boxer
Workspace ONE Boxer

Workspace ONE Boxer is an enterprise email client that provides access to enterprise email, calendar, and
contacts across corporate-owned devices and bring your own devices (BYOD. Boxer offers a consumer-
centric focus on mobile productivity with enterprise-grade security in the form of AES 256-bit encryption. This
application separates business data from personal data.
Benefits of Using Workspace ONE Boxer

With Workspace ONE Boxer, users can customize the app with features such as custom swipe gestures,
contact avatars, custom smart folders, and account color preferences. This single app provides an intuitive
user experience on iOS and Android devices following native design patterns.
Audience of this Guide

This guide is intended for administrators looking to configure Workspace ONE Boxer as part of their
deployment. Setting up Workspace ONE Boxer involves configuring the various email settings and options you
want to be available to your end users.
Requirements to Deploy Workspace ONE Boxer

To deploy and use the Workspace ONE Boxer application, you must meet the prerequisites related to
Workspace ONE UEM console, operating system, and email servers.
Console Requirements
Workspace ONE UEM console 2001 and later.
Anchor Apps
Android iOS
VMware Workspace ONE Intelligent Hub 19.04 and VMware Workspace ONE Intelligent Hub 19.04 and
later. later.
Supported Devices
Android iOS
Android 8.0 and later iOS 12 and later
Supported File Types
File Types
iOS
DOC JPEG JPG MOV

Workspace ONE Boxer
File Types
PDF VCF DOCX XML
PPT EXCEL MP3 SLX
TXT HTML MP4 EML
BMP PNG GIF
Android
DOC TXT CSV BMP
DOCX ASC PPT DIB
DOT JPG PPS WBMP
XLS JPEG PPSX TIF
XLSX GIF POTX EMF
XLTX TIFF PDF PCX
MP3 HTP PNG
Supported Email Infrastructure

• Supports the following email infrastructures for the Boxer integration:
◦ iOS – G Suite, 2010, 2013, 2016, Office 365, and IBM Notes Traveler version 9.0.1.
◦ Android – G Suite, 2010, 2013, 2016, Office 365, and IBM Notes Traveler version 9.0.1.
• Requires a Public trusted SSL certificate such as Symantec, GoDaddy, and Verisign.
Components to Use with Workspace ONE Boxer

Integrate Workspace ONE Boxer with other components in your Workspace ONE UEM deployment for more
control of your enterprise email system.
Email Notification Service

The Email Notification Service (ENS) adds Apple Push Notification support to Exchange. On iOS, a third-party
app can receive notifications using Apple’s background app refresh or Apple Push Notification Service (APNs)
technologies. Background app refresh is used by default, as each app can provide irregular notifications using
this method. However, iOS attempts to balance the needs of all apps and the system itself.
To provide notifications quickly and consistently, Apple also provides APNs. APNs allows a remote server to
send notifications to the user for that application, however Exchange does not natively support these APNs.
ENS adds APNs support to your deployment to allow quick and consistent notifications about the new items in
your end users email inbox.
Deploy the Email Notification Service (ENS2) to provide real-time email notifications. Email Notification Service
2 (ENS2) is an initial rewrite of the solution for new email notifications for VMware Workspace ONE Boxer on
both iOS and Android. The service works by monitoring the Exchange or Office365 back end for email events
and sending updates to the end user devices through Apple or Google’s push notification services. The service
works by monitoring the Exchange or Office365 back end for email events and sending updates to the end

Workspace ONE Boxer
user devices through Apple or Google’s push notification services. The updates come through as new email
banners and on iOS through the app’s badge counter. This provides a more robust security model, high
availability, and a cloud deployment option.
To change the badge count, Android users must clear the Boxer notification, as Android does not support the
badge count.
For more information on deploying Email Notification Service, see the Workspace ONE UEM Online Help
topic, Introduction to Email Notification Service 2.
Note: Boxer creates and triggers calendar event alerts locally and does not depend on ENS.
Workspace ONE UEM Mobile Email Management Models (Optional)

Configure one of the Workspace ONE UEM email deployment models, either Secure Email Gateway (SEG) or
PowerShell. For more information on choosing a MEM deployment model, see the Workspace ONE UEM
Online Help topic Protect Email Infrastructure.
Note: In Boxer, you are unable to view emails inviting you to join Office 365’s shared groups. This is because
Microsoft Exchange does not deliver join-request emails to Boxer using the Exchange ActiveSync Protocol
(EAS) protocol. The Microsoft EAS protocol does not allow to return the user’s response (approval or deny) to
server and therefore the exchange does not deliver such emails to Boxer.
The Join-request emails are visible in email clients using the EWS protocol, which means that you only receive
push notifications for these emails but cannot access emails directly.

Boxer Deployment Considerations

Review the following considerations before you configure and deploy Workspace ONE Boxer.
Enrollment
You can use Workspace ONE Boxer on iOS and Android devices enrolled and managed in Workspace ONE
UEM or using standalone enrollment.
Typical enrollment uses the Workspace ONE Intelligent Hub to enroll the device into Workspace ONE UEM.
You can also enroll devices through Workspace ONE step-up enrollment.
Standalone enrollment is unique to Workspace ONE Boxer. This enrollment method allows end users to
download the Workspace ONE Boxer app from the App Store or the Google Play Store without enrolling first.
When the end user configures Workspace ONE Boxer, they must provide their login credentials such as their
user name, password, server URL, and group ID.
Standalone Enrollment supports (optional) Workspace ONE UEM Autodiscovery that can be configured on the
UEM console. Autodiscovery system allows end users to enroll devices to environments and organization
groups (OG) using their email addresses. The server URL and user group ID are pre-populated on the end-
user devices from the Autodiscovery Service during standalone enrollment.
Workspace ONE UEM does not support Boxer web-enrollment and only publishing Boxer as a managed
application.
Starting Workspace ONE Boxer 22.02, Workspace ONE Boxer supports SAML authentication for standalone
enrollments. SAML authentication allows faster authentication process and less expectation from a user to
remember multiple login credentials. To configure the SDK passcode, see the Security Policies Profiles for the
SDK section in the SDK and Managing Applications documentation at VMware Docs.
For more information on the Autodiscovery setup and configuration, see the VMware Workspace ONE UEM
Mobile Device Management Documentation.
S/MIME
As an admin, you can upload S/MIME certificates from the UEM console (v9.0+). End users can upload the
certificates to the Self Service Portal (SSP) or can send the certificates as email attachments for the
installation on their device. To allow users to decrypt and view emails that are encrypted using expired S/MIME
encrypted emails, upload the expired certificate at Accounts > User > Edit > Advanced > Certificates > Old
Encryption Certificate. Once uploaded, the device users can view the expired certificate. Navigate to Boxer
> Settings > Account > SMIME > Sign and/or Settings > Account > SMIME > Encrypt..
Note: An email user can have an S/MIME certificate that has multiple email addresses. You can scan such
certificate that has multiple identities through a list of addresses for signing and encryption.
If you want to avoid transition of S/MIME certificates and certificate passwords through the VMware cloud, you
can always sideload S/MIME certificate for Boxer using the Workspace ONE Web. For information about how
to sideload S/MIME certificate, see Sideload S/MIME Certificates from Workspace ONE Web to Boxer.
Historical S/MIME Certificates

You can decrypt and read old S/MIME emails that have been encrypted with older certificates of encryption.
You can parse old certificates from different sources, store those certificates, and ensure that these certificates
are processed properly so that old emails can be successfully read.
Common Criteria Certification

Workspace ONE Boxer version 5.4 is declared as a National Information Assurance Partnership (NIAP)
Common Criteria evaluated product. It has been certified in compliance with the international security standard
for the application software, defined under the Common Criteria Recognition Arrangement (CCRA). Boxer is
the first email client to receive the international Common Criteria security certification.
For more information about setting up Workspace ONE Boxer in complete NIAP certified mode, see NIAP.
Enterprise Content Support for Boxer

Enterprise Content integrates a part of the VMware Workspace ONE Content application with Boxer to browse
online repositories. Users can view email attachments, attach files to emails from online repositories, and save
attachments from emails to online repositories. To access online repositories, you must configure the
supported repositories in the UEM console. For information about the configuration of the enterprise content,
see Enterprise Content section in Application Configuration for Workspace ONE Boxer.
Supported features of Enterprise Content:
• Enterprise Content supports the following online repositories:
◦ SharePoint
◦ Network File System
◦ SharePoint in Office 365.
◦ OneDrive for Business.
◦ Managed Content from the UEM console added by the administrator.
◦ User added repositories.
Note: To support on-premises SharePoint, access to SharePoint and the device must be in the
same network domain.
• Save email attachments to repositories.
• Compose a new email with an attachment from an online repository.

• Compose an email and attach one or more files from the Boxer Files.
• Reply to an email with one or more attachments from an online repository.
• Sort saved files by size, alphabets, and date modified.
• View a repository’s information from the Boxer Settings.
The following list describes the limitations of Enterprise Content
• Users cannot edit documents present in the repositories as this functionality is available only in the
Workspace ONE Content application.
• User added repositories are supported only on iOS devices.
• Enterprise Content does not support the local storage of the Content application.
• The Exchange server sets the email size limit.
• Search option is applicable for iOS devices only and is limited to the folders that users have traversed.

Workspace ONE Boxer Deployment

Deploy Workspace ONE Boxer with the Workspace ONE UEM console.
Configuring the Workspace ONE Boxer application involves adding it as a public application and assigning it
with set email configurations to end users.
Smart Group Based Assignments

Create single or multiple smart group based assignments and deploy different Workspace ONE Boxer email
settings specific to a set of users in your organization. An assignment group is a representation of single or
multiple smart groups that are assigned with same email configuration.
The deployment of Workspace ONE Boxer to iOS and Android devices is configured in two parts. You must
perform both procedures.
1. Add Workspace ONE Boxer as a public application.

2. Assign Workspace ONE Boxer to smart groups.
For in-depth instructions on deploying public applications, see the Workspace ONE UEM Online Help topic
Public Application Overview.
Note: When you deploy Workspace ONE Boxer as a public app in a PowerShell deployment, you must
configure a device access rule on Exchange to allow Workspace ONE Boxer users to access emails. For more
information about configuring the device access rule, see Workaround for Workspace ONE Boxer Flexible
Deployment section of the Mobile Email Management (MEM) guide.
Add Workspace ONE Boxer to Public Applications

Add Workspace ONE Boxer as a public application to the UEM console.
Adding applications through an app store enables Workspace ONE UEM to manage applications by your
settings in the console.
1. Navigate to Resources > Apps > Native > List View > Public.
2. Select Add Application.
3. Configure the text boxes that display and select Next.
Option Description
View the organization group where the application

Managed By
is uploaded.
Choose the appropriate platform. Only iOS and

Platform
Android devices are supported currently.
Select to search for the application in the app

Source
store or play store.

Option Description
Name Enter “Workspace ONE Boxer”.
4. Locate and select the Workspace ONE Boxer app in the Search results screen.
5. Review the information that automatically populates in the Details tab.
6. Assign Terms of Use, which displays when users first access the application from the App Catalog.
7. Select Save and Assign.
You can add an assignment now or you can come back and add assignments later.
• Add assignments now - Select Add Assignment and follow the steps outlined in Assign Workspace
ONE Boxer with Email Settings.
• Add assignments later - Select View Device Assignment. The console prompts for confirmation that
you are not assigning the application. Workspace ONE Boxer displays in the List View and you can edit
it later to assign it to devices as outlined in Assign Workspace ONE Boxer with Email Settings.
Assign and Configure Workspace ONE Boxer Using the App Assignment
Page
Configure Workspace ONE Boxer using App Policies and Application Configuration (custom KVPs)
provided in the Assignment page.
Upload Boxer as a public or an internal application to the Workspace ONE UEM console.
Note: With console 2004 or higher, most of the application configuration values that you previously added
manually can now be configured using the settings available in the Email Settings and App Policies
assignment pages. You can use the following steps to assign Boxer 5.17 or later using the Workspace ONE
UEM console version 2004 or higher. If you are using a console version less than 2004 to assign older
versions of Boxer, see Application Configurations for Workspace ONE Boxer.


2. Select Assign under the Install Status column for Boxer. Alternatively, you can also select the edit icon
and then select Save & Assign.
3. Select Add Assignment in the Assignment window.
a. In the Distribution tab, enter the following information:
Settings Description
Name Enter the name of the assignment.
Description Enter the description for the assignment.
Enter smart groups to receive the Workspace

ONE Boxer flexible deployment assignment. As
you enter the smart group name, options are
Assignment Groups
displayed and you can select the appropriate
smart group from the list. If necessary, you can
add more assignment groups.
On Demand – Deploys Boxer to the deployment

agent. The device user can decide if and when to
install the application. Automatic – Deploys Boxer
App Delivery Method
to a deployment Hub on a device when
enrollment. After the device enrolls, the system
prompts users to install Boxer on their devices.
b. In the Restrictions tab, enter the following information:
Enable adaptive management to set Workspace

ONE UEM to manage the device so that the
device can access the application. Only the
EMM Managed Access
devices that are enrolled in EMM can install the
app and receive app policies when you enable this
setting..
When enabled, it removes the application from a

device when the device unenrolls using
Workspace ONE UEM. Workspace ONE UEM
enables this setting by default. If you enable this
setting, supervised devices are restricted from a
silent app installation. This is because the device
is locked and the provisioning profile installation is
Remove on Unenroll
in the command queue which requires a device to
be unlocked to complete the installation.If you
deactivate this setting, provisioning profiles are
not pushed with the installed application. That is, if
the provisioning profile is updated, the new
provisioning profile is not automatically deployed
to devices. In such cases, a new version of the

application with the new provisioning profile is

required.
When enabled, the user is not allowed to uninstall

Prevent Removal
the app. This requires for iOS 14 and later.
Enable this setting to prevent backing up the

Prevent Application Backup
application data to iCloud.
Assume management of applications previously

installed by users on their devices, whether
applications are supervised or
unsupervised.Enable this feature so that users do
not have to delete the application version installed
Make App MDM Managed if User Installed on the device. Workspace ONE UEM manages
the application without having to install the
Workspace ONE Hub version on the device.This
setting is not effective if the privacy settings of the
console are set to prevent the collection of
personal application data.
c. In the Tunnel & Other Attributes tab, enter the following information:
Select the Per-App VPN Profile to configure a

Per App VPN Profile
VPN at the application level.
App attributes provide device-specific details for

Other Attributes
Boxer to use.
You can upload an XML file that contains the key

Upload XML value pairs supported by the application for the
app configuration.
d. In the Application Configuration tab, enter the following information:
When enabled, it configures Boxer using the

Send Configuration
settings provided by the app developer.
You can upload an XML file that contains the key

UPLOAD XML
value pairs supported by Boxer.
You can also manually add the configuration keys,

ADD
value types, and the look up values.
e. In the Email Settings, enter the following information:
Note: To set up Multiple Managed Accounts (MMA), Single Sign-On (SSO) must be configured in the
SDK settings.

Enter the Exchange account name. Note: If an

end user has changed this setting in the
Account Name Workspace ONE Boxer application, then this
setting cannot be modified later by the
administrator.
Enter the EAS server URL. For SEG deployments,

Exchange ActiveSync Host
enter the SEG URL.
EWS URL Enter the address of the EWS or SEG endpoint
If you want to associate a Mobile Email

Email Management Management with the Boxer configuration,you
must enter at least one MEM configuration.
Enter the domain name, user name, user display

name and email address. By default, the login
information includes {EmailDomain},
{EmailUserName}, {FirstName}{LastName} and
{EmailAddress} that are defined as lookup values
Domain, User, User Display Name, and Email
in your directory service. To override these values,
Address
use custom lookup values. Note: If an end user
has changed the User Display Name in the
Workspace ONE Boxer application, then this
administrator.
Enter the password. Note: Password field only

Password supports lookup values, not the actual password
value.
Enter the email signature. Note: If an end user

has changed this setting in the Workspace ONE
Email Signature
Boxer application, then this setting cannot be
modified later by the administrator.
Authentication
Modern Authentication is an OAuth based token

authentication method for Office 365. When
Modern Authentication
enabled, you are redirected to the login page for
authentication.
Select one of the following authentication types for

end users to authenticate with Exchange Server
using the credentials used to log in Workspace
ONE. Basic – Authenticates using a user name
and a password. Certificate – Authenticates using
Authentication Type
a certificate. Select the desired Certificate
Authority and Certificate Template. Both –
Authenticates using a certificate to authenticate
with a network appliance and a password to
authenticate with Exchange. Certificate-Based

Authentication with Modern Authentication

(CBA with Modern Authentication) - Workspace
ONE Boxer supports certificate-based
authentication with Modern Authentication. Boxer
support SCEP. To view the supported certificates,
see section Supported Certificate Authorities.
Consider a scenario where you have set the
certificate as an authentication type without
enabling the SSO passcode, and the user delete
and reinstall the Boxer application. At the time of
reinstallation, user gets authenticate automatically
as you have configured CBA as an authentication
type. Such a scenario can create an attack vector
for intruders who have a physical access to the
device. Without an added authentication
challenge, an intruder can gain access to email
resources by deleting and reinstalling the Boxer
application. To avoid such intruders, Boxer must
authenticate users using the Workspace ONE
credentials before allowing them to access emails.
An alternative solution to requiring Workspace
ONE credentials is to enable SSO workflows that
restrict intruders to reset a standalone
passcode.Specifies number of authentication
retries - Specify the number of authentication
retries upon failure.
Maximum Allowed Email Sync Period and

Maximum Allowed Calendar Sync Period
settings allow administrators to configure how far
back (frequency of time) end users can select to
sync their email messages and calendar events.
Default Email Sync Period and Default
Calendar Sync Period settings allow
administrators to configure the default sync
periods when Workspace ONE Boxer is deployed
Sync
on the end user devices. Note: Regardless of the
sync period the maximum number of emails which
can be shown in the Inbox at a time is 1500.
Maximum attachment size limits the file size end
users can attach to outgoing emails. Note: If an
end user has changed this setting in the
administrator.
Configure Email Notification Service (ENS) and its

behaviour to provide real-time notification. Note: If
Notifications
an end user has changed this setting in the


administrator.
Configure the actions to be taken on email

Spam & Phishing Reporting
identified as spam or phishing attack.
S/MIME Configure S/MIME status.
Activates or deactivates the email classification

option.AIP Sensitivity Labels - If activated, users
Email Classification
can interact with AIP labels.Email Classification -
Activate or deactivate classification markings.
Add the key value pairs to apply any account level

Custom Account Configuration
configurations
f. In the App Policies, enter the following information:
You can set a passcode in the SDK passcode

settings. For more information about configuring
the SDK passcode, see the Security Policies
Profiles for the SDK section in the SDK and
Managing Applications documentation at VMware
App Passcode Docs. Select the type of passcode for user
authentication. Numeric - User is persented with
a numeric keyboard. Alphanumeric - User is
presented with an alphanumeric keyboard. None -
Boxer applies the Exchange passcode policies if
present.
Data Loss Prevention
If restricted: End users cannot copy and paste

content from Workspace ONE Boxer to other
applications.If personal accounts are enabled, end
users can copy and paste between personal and
work accounts. Therefore, consider deactivating
personal accounts to restrict the copy and paste
functionality completely.Share and define options
are made unavailable in the application when
Copy Paste
selecting text.Note: In Workspace ONE Boxer for
iOS, the Copy Paste setting can be applied only
through the Workspace ONE SDK setting. For
more information about this Data Loss Prevention
(DLP) SDK setting, see the Security Policies
Profiles for the SDK section in the SDK and
Managing Applications documentation at VMware
Docs

Set to true to enable local calendars in Workspace

Local Calendars
ONE Boxer.
If the option is restricted, end users can access

contacts only from the email accounts in the app.
Personal Contacts
If unrestricted, end users can access contacts
from other apps on the device.
Activates or deactivates printing of emails and

[iOS] Allows printing
attachments.
Activates or deactivates the use of third-party

[iOS] Allow Custom Keyboards
keyboard.
Restricts loading content from unsecured (HTTP)

[iOS] Restrict unsecured HTTP connections
connection.
These settings determine whether users can open

emails or their attachments in other application.
Based on your requirements, you can specify the
allowed application using the Allow List option or
allow sharing in any application. NOTE: A similar
Allow List option is also available as an SDK
Admin setting in the Workspace ONE UEM
Sharing console. If the option is selected in both
Workspace ONE Boxer for iOS and SDK Admin
settings and applications are entered in both the
lists, then the lists are merged together. For more
information about the Allow List feature, see the
Security Policies Profiles for the SDK section in
the SDK and Managing Applications
documentation at VMware Docs.
Activate or deactivate attaching of files from other

Control Open In apps using the open-in or share into Workspace
ONE Boxer.
Activates or deactivates attachments from

Control Attachments from external providers external providers (Example- iCloud, Dropbox,
Google Drive) using Workspace ONE Boxer.
Watermark Text Defines the watermark text.
Defines the opacity of the text. You can set any

Watermark Opacity
number from 0 through 100.
Defines the color of the watermark text in

Watermark Color
hexadecimal format. The default color is blue.
If restricted, end users can no longer add any

additional accounts to the application. If end users
Personal Accounts
already have Workspace ONE Boxer on their
device with personal accounts configured, then

they are prompted whether they want to remove

their existing personal accounts now or later. End
users do not receive work email through
Workspace ONE Boxer until they remove all
personal accounts.
Internal Domains List Define the domains that are internal or permitted.
Enables the warning when the user enters

recipients from external domains. If the domains
are configured and the External Recipient Warning
is enabled , the ‘Confirm before sending’ setting is
External Recipient Warning
unavailable to the users. When the warning is
displayed, the user can either accept and return to
the Compose email menu or ignore and continue
sending the email to external recipients.
Hyperlinks When restricted, all hyperlinks are

Browser
open only in Workspace ONE Web.
If hyperlinks are restricted in the Console, you can

Browser Exceptions add a list of exceptions for domain or sites to open
always in the default browser.
Usability
Enable this option to skip the in app tutorial

Skip in app tutorial
appears on the first launch of the application.
Enable to provide Caller ID functionality for all

Workspace ONE Boxer contacts.By enabling this
Caller ID feature, Workspace ONE Boxer exports names
and phone numbers only to the native contacts
app.
Enable the exporting of contacts, names, and

Default Caller ID phone numbers by default. This option requires
the Caller ID option to be set as unrestricted.
Enable Avatars Activate or deactivate Avatars.
Archive Action Allows or block the ability to archive emails.
Enables the conversation view to group emails by

Conversation Grouping
conversation.
Enterprise Content Configure Enterprise Content in Boxer.
An iOS setting that requires user interaction to

Show CallKit Option
enable CallKit caller ID.
Left Short Swipe default, Left Long Swipe Define the default swipe actions. Users can
default, Right Short Swipe Default, and Right customize swipe actions using the options
Long Swipe Default provided in the Workspace ONE Boxer app.

Support
Allows Logging Allows users to send logs.
Enter address to be specified when sending logs

Support Email Address
through the support menu.
By default, Boxer is allowed to report crashes

Allow Crash Reporting
anonymously.
Advanced
Forward/Add Attachments Allows the users to add or forward attachments.
Activates or deactivates downloading and

Attachment Download
forwarding of attachments.
Activates or deactivates attaching of images and

Attach Photos
media files from the photo gallery and camera.
Activates or deactivates the plain text mode of

Boxer. If activated, Boxer retrieves only plain text
from HTML mails when syncing. Workspace ONE
Plain Text Mode Boxer sends only plain text regardless of the email
message format. The formatting controls in the
compose view is deactivated and only text can be
copied and pasted from rich or HTML content.
For emails (fetched using HTML) that contain non-

standard URL schemes, pointing to non-server
domains, Exchange replaces the URL with two
Refetch Empty Links using Mime empty spaces. Activate or deactivate this option
for Boxer to detect this occurrence and
redownload the affected body using MIME, which
is not subject to the URL replacement error.
Deactivate the escrowing key on to the server. If

Disable Key Escrow (Forgot Passcode) this feature is deactivated, the forgot password
feature is also deactivated.
Activate this option to allow collection of

anonymous usage data to improve user’s
Workspace ONE Boxer experience. When
activated, a Data Sharing notice is displayed to
Anonymous Metrics
user when Workspace ONE Boxer is launched.
The device user can activate or deactivate data
sharing by navigating to Settings > Privacy >
Data Sharing.
This activates the QuickJoin button found in

QuickJoin custom URLs
calendar invites.
Application update source Select the source to download Boxer.

Enable this option to take full advantage of key

Swift SDK Key Wrapping Only Mode
wrapping security features.
Set the expiration time in hours when Workspace

ONE Boxer does not receive FastSync key.
FastSync Expiry
FastSync settings are applied when Email
Notification Service is enabled and configured.
FastSync improves the background syncing and

speed of subsequent syncs. FastSync settings are
Enable FastSync
applied when Email Notification Service is enabled
and configured.
4. Select Create.
Flexible Deployment Assignments and Workspace ONE Boxer

Assignment by flexible deployment enables mapping of your email settings to smart groups.
An assignment can contain single or multiple smart groups belonging to an Organization Group. Assignments
with same email settings are grouped together. You can choose existing smart groups or create new smart
groups from the Assigned Smart Groups field as per your requirement.
If you have multiple email settings that are assigned to different assignment groups, then the most recently
created settings gets priority. If a device exists in multiple assignment groups that have been configured with
different email settings, the device will receive the email settings from the assignment group with the highest
priority.
Assign Workspace ONE Boxer with Email Settings

Assign Workspace ONE Boxer to devices with the assignment feature known as flexible deployment.
Configure the security and email management features within the assignment procedure so that they meet
your organization’s needs.
Important: If the passcode is set to None, then the Workspace ONE Boxer app is not encrypted. If you do not
enforce an app-level passcode, then consider enforcing a device-level passcode using a device profile, which
encrypts the iOS device.
• All attachment security, Data Loss Prevention (DLP), and encryption are handled from within the
Workspace ONE Boxer app itself.
• Enabling DLP > Caller ID settings cause an error if end users have deleted their local address book. For
more information, see the Workaround for Third-Party Address Book – iOS section in the Device
Management topic.
• For information on optional application configurations, see [Application Configurations for Workspace
ONE Boxer] (ApplicationConfigurations.md).
1. Navigate with one of the following paths.
◦ Select Add Assignment in the Assignment window.

This navigation reflects adding an assignment immediately after adding the application to the public
tab of the console.
◦ Go to Resources > Apps > Native > List View > Public and select Assign link under the Install
Status column for the Boxer application.
This navigation reflects adding an assignment later after adding the application to the public tab of
the console.
2. Complete the settings on the Email Settings page.
Enter smart groups to receive the Workspace

Assigned Smart Groups
ONE Boxer flexible deployment assignment.
Enable to assign the application to those devices

Is App Restricted to Silent Install (Android) that support the silent install or the silent uninstall
capability only.
Account Name Enter a description of the mail account.
Enter your EAS server URL. For SEG

deployments, enter the SEG URL instead.
Enter the login information, including Domain

name, user name, and Email Address. By default,
the login information includes {EmailDomain},
Domain, User, Email Address {EmailUserName} and {EmailAddress} that are
defined as lookup values in your directory service.
If you need to override these values, you can use
custom lookup values.
Enter the password to the email account or input

Password (Android Only) the lookup value for pulling the password from the
user account.
Specify an email signature to be used in emails

Email Signature
that are sent using Workspace ONE Boxer.
Choose one of the following authentication types

for end users to authenticate with Exchange:
Basic – Authenticates using a user name and a
password. Certificate – Authenticates using a
certificate. Select the desired Certificate Authority
and Certificate Template. Both – Authenticates
using a certificate to authenticate with network
Authentication Type
appliance and a password to authenticate with
Exchange. Modern Authentication - OAuth
based token authentication method for Office 365.
To setup, see the Modern Authentication section.
Certificate-Based Authentication with Modern
Authentication (CBA with Modern Auth) -
Workspace ONE Boxer supports certificate-based

authentication with Modern Authentication. Boxer

support SCEP. To view the supported certificates,
see Supported certificate Authorities section in the
On-Premises Certificate Authority admin guide.

Sync
users can attach to outgoing emails.
Determine how your end users can access emails,

Data Loss Prevention email attachments, and hyperlinks by configuring
the following settings.
If restricted:End users cannot copy and paste

applications.If personal accounts are enabled, end
users can copy and paste between personal and
work accounts. Therefore, consider deactivating
personal accounts to restrict copy and paste
functionality completely.Share and define options
are made unavailable in the application when
selecting text.Workspace ONE apps shares the
same clipboard if the SDK settings applied to
Copy Paste
these apps are similar irrespective of it being
applied as a default profile for one app and
custom profile for the other.Note: In Workspace
ONE Boxer for iOS, the Copy Paste setting can be
applied only through the Workspace ONE SDK
setting. For more information about this Data Loss
Prevention (DLP) SDK setting, see the Security
Policies Profiles for the SDK section in the SDK
and Managing Applications documentation at
VMware Docs
If restricted, Android end users cannot take

Screenshots (Android Only) screenshots of the Workspace ONE Boxer
application.

If taking screenshots is deactivated and the user

Screenshots (iOS only) captures a screenshot, a blocker screen is
presented to the user.
If enabled, Android end users can add the

Allow Email Widget (Android Only) Workspace ONE Boxer Email widget to their
home screens.
If enabled, Workspace ONE Boxer end users can

Allow Calendar Widget add the Workspace ONE Boxer Calendar widget
to their home screens.
If restricted, end users can only open hyperlinks in

Hyperlinks
Workspace ONE Web.
Choose one of the following restrictions based

whether the end user can open emails and their
attachments in other applications: Preview Only -
Set this restriction for end users to preview emails
and attachments within Workspace ONE Boxer
application only. End users cannot open
attachments into any other applications. Allow
List - Set this restriction and specify bundle IDs of
the applications for emails and their attachments
to open in those specified applications. The
bundle IDs for Content Locker and Evernote are
Sharing prepopulated. Unrestricted - Set this restriction
for end users to open emails and attachments in
any applications. NOTE: A similar Allow List
option is also available as an SDK Admin setting
in the Workspace ONE UEM console. If the option
is selected in both Workspace ONE Boxer for iOS
and SDK Admin settings and applications are
entered in both the lists, then the lists are merged
together. For more information about the Allow
List feature, see the Security Policies Profiles for
the SDK section in the SDK and Managing
Applications documentation at VMware Docs.

Workspace ONE Boxer contacts. By enabling this
app.
You can allow end users to add multiple personal

Personal and Work Separation accounts and use local contacts by configuring the
following settings on the UEM console.

Personal Accounts additional accounts to the application. If end users


they are prompted whether they want to remove
personal accounts.
If restricted, end users can access contacts only

from the email accounts in the app. If unrestricted,
Personal Contacts
end users can access contacts from other apps on
the device.
You can configure settings for your Workspace

ONE Boxer deployment using the Configuration
Application Configuration
Key and Configuration Value pairs.Application
configurations are optional.
3. Select Save.
4. If you want to restrict copying and pasting of data from and to the Workspace ONE Boxer and other
supported apps, configure these settings at Apps > Settings and Policies > Security Policies > Data
Loss Prevention.
Authentication Type and Single Sign-On must be enabled for these settings to be applied on the end
user devices. These restrictions are applied across all supported VMware applications.
(iOS only) When deactivated, end users cannot

copy and paste content from Workspace
Enable Copy and Paste Out
ONE Boxer to other applications except
Workspace ONE productivity apps.
When deactivated, end users cannot copy and

paste content from applications other than
Enable Copy and Paste Into
Workspace ONE productivity apps into Workspace
ONE Boxer.
End users can copy or paste content between the Workspace ONE applications which share the SDK
settings. These SDK settings can be applied as a default profile for one application and custom profile for
the other.
Note:
• On iOS, the default signature links to the page Workspace ONE® User Zone that provides more
information on Workspace ONE Boxer.
• Boxer does not support SDK’s Integrated Authentication functionality.
Multiple Managed Accounts in Workspace ONE Boxer

Add and configure Multiple Managed Accounts (MMA) to your Workspace ONE Boxer.

A user can have multiple email accounts in different domains based on their business requirements. For
example, an employee might have an email account in a parent company and an email account in a
subsidiary. These accounts might have different policies and restrictions that are compatible with their
respective organizations. Workspace ONE Boxer provides you the ability to manage two additional email
accounts with different settings in the same UEM console.
Requirements for Multiple Managed Accounts

• MMA is only available in Workspace ONE Boxer 5.21 or later versions.
• To enable MMA in Boxer, you must use Workspace ONE UEM console 2008 or later versions.
• You must enable and configure Single Sign-On (SSO) on your SDK profile and, in Boxer’s App Policies.
After you have activated SSO, changing this setting might sometimes cause issues. For example: If the
user is already enrolled in Workspace ONE Boxer, the SSO change is not taken into account. To know
how to set up SSO for the SDK profile, see Enforcing Application-Level Single Sign On Passcodes topic
in the Android (Legacy) Platform guide.
Multiple Managed Accounts supports the following features in Workspace ONE Boxer.
• All the functions of Mails, Calendar, and Contacts.

• S/MIME, Azure Information Protection (AIP), Certificate-based authentication (CBA), Spam, and
Phishing reporting.
• When ENS2 is configured, MMA supports secondary and tertiary account notifications.
• Email signature and synchronization period.
• Health Check shows the combined status of all accounts on iOS, whereas on Android it only shows the
status of the primary account .
• S/MIME certificates to sign and encrypt emails when the source is Escrow Gateway.
General Information
• In addition to your primary email account, you can add two additional managed accounts.
• Derived Credentials supports only the primary account. Workspace ONE Boxer does not support derived
credentials as a source of certificates for the secondary and tertiary accounts.
• Ensure to add and configure the PolicyDerivedCredentials key to use PIV-D in Boxer versions older than
5.21.
• If you have selected the Escrow Gateway for S/MIME certificates in UEM and also added the
PolicyDerivedCredentialsSMIME key with a value of 1 or 2, the derived credentials appear after the
migration of S/MIME certificate source.
• Two CBA configured accounts belonging to the same domain cannot have the same or different
templates that generate certificates with the same UPN (User Principal Name) details.
• If you use the same S/MIME certificate for multiple accounts, those accounts must have the same
revocation policy.
• In iOS Boxer:
◦ MMA support is not available for standalone enrollments.
◦ If there are conflicts with account-specific keys, such as PolicySMIMETrustStore and
PolicySMIMERevocationCheckUrl, Boxer uses the value of the primary email account.
Configure Multiple Managed Accounts in Workspace ONE Boxer Using

Workspace ONE UEM
Configure Workspace ONE Boxer to support up to two additional managed accounts. With console 2004 or
higher, the previously combined email and app settings have now been separated and placed into the Email
Settings and App Policies pages, allowing you to easily configure settings specific to each account using the

Email Settings page and settings specific to the entire app using the App Policies page. Note: Before you
begin configuring the managed accounts, you must upload Workspace ONE Boxer version 5.21 or later as a
public application using Workspace ONE UEM console version 2008 or later.
2. Select the Assign link under the Install Status column for the Boxer application. Alternatively, you can
also select the edit icon and then select Save & Assign.
3. On the Assignment screen, select Add Assignment and enter the required information.
a. In the Distribution tab, enter the following information:
Name Enter the assignment name.
Description Enter the description for the assignment.
Enter the smart group name to which you want to

assign the application. As you enter the smart
Assignment Groups group name, options are displayed and you can
select the appropriate smart group from the list. If
necessary, you can add more assignment groups.
On Demand – Deploys application to the

deployment agent. The device user can decide if
and when to install the application. Auto –
App Delivery Method Deploys applications to a deployment Hub on a
device upon enrollment. After the device enrolls,
the system prompts users to install the Boxer
application on their devices.
b. In the Restrictions tab, enter the following information:
Enable this option to manage access. Only

EMM Managed Access devices enrolled in EMM can install the app and
receive policies set by the admin.
c. In the Tunnel tab, enter the following information:
Select a VPN profile that you want to use for the

application. Users access the application using a
Android or iOS Legacy
VPN, which helps ensure that application access
and use is trusted and secure.
d. In the Application Configuration tab, enter the following information:

You can also manually add the configuration keys,

ADD
value types, and the look up value.
Note: These KVPs are app level settings and applies across the application. If you want to apply any
configuration to a specific email account, then you must add keys to Custom Account Configuration in
Emails Settings to avoid any disruption.
e. To add more configurations to your application, select Add.
Note: Ensure that this KVP applies across the entire app. Any configurations that apply only to a specific
email account must be moved to Custom Account Configuration in Emails Settings to avoid any
disruption.
f. In the Email Settings, tap + Add, to add additional accounts. If you do not have the + Add option, make
sure you are on the Workspace ONE UEM console 2008 or later versions. Boxer supports custom
attributes in an enrolled user’s advanced tab. It maps these custom attributes for their secondary
account. You must configure in Active Directory to avoid manually inserting inputs by users.
Enter the following information per account level:
Account Name Enter the Exchange account name.
Enter your EAS server URL. For SEG

deployments, enter the SEG URL.
EWS URL Enter the address of the EWS or SEG endpoint.
If you want to associate a Mobile Email

Email Management Management with this Boxer configuration, enter
at least one MEM configuration.
Enter the domain name, user name, and email

address. By default, the login information includes
{EmailDomain}, {EmailUserName} and
Domain, User, and Email Address
{EmailAddress} that are defined as lookup values
in your directory service. To override these values,
use custom lookup values.
Enter the password. Note: Password field only

Password supports lookup values, not the actual password
value.
Email Signature Enter the email signature.
Select one of the following authentication types for

end users to authenticate with Exchange using the
Workspace ONE credentials: Basic –
Authentication
Authenticates using a user name and a password.
Certificate – Authenticates using a certificate.
Select the desired Certificate Authority and

Certificate Template.Both – Authenticates using a

certificate with a network appliance and a
password to authenticate with Exchange. Modern
Authentication - OAuth based token
authentication method for Office 365. To set up,
see the Modern Authentication section.
Certificate-Based Authentication with Modern
Authentication (CBA with Modern
Authentication) - Workspace ONE Boxer
supports certificate-based authentication with
Modern Authentication. Boxer support SCEP. To
view the supported certificates, see section
Supported Certificate Authorities. Note: Consider
a scenario where you have set the certificate as
an authentication type without enabling the SSO
passcode, and the user delete and reinstall the
Boxer application. At the time of reinstallation,
user gets authenticate automatically as you have
configured CBA as an authentication type. Such a
scenario can create an attack vector for intruders
who have a physical access to the device. Without
an added authentication challenge, an intruder
can gain access to email resources by deleting
and reinstalling the Boxer application. To avoid
such intruders, Boxer must authenticate users
using the Workspace ONE credentials before
allowing them to access emails. An alternative
solution to requiring Workspace ONE credentials
is to enable SSO workflows that restrict intruders
to rest a standalone passcode. Specifies number
of authentication retries - specify the number of
authentication retries upon failure.

Sync
users can attach to outgoing emails.
Enable and configure the Email Notification

Notifications Service (ENS) to provide a real-time
notification.ENS2 - Activate or deactivate

ENS2.Notification Content - Configure what

information is disclosed in each incoming email
notification alert.
Activates or deactivates the actions to be taken on

Spam & Phishing Reporting
email identified as spam or phishing attack.
S/MIME Activates or deactivates the S/MIME status.
Activates or deactivates the email classification

option.AIP Sensitivity Labels - If activated, users
Email Classification
can interact with AIP labels.Email Classification -
Activate or deactivate classification markings.
g. To apply any account level configurations, add the key value pairs in Custom Account
Configuration.
h. Activate or deactivate the following App policies:
If restricted: End users cannot copy and paste

applications. If personal accounts are enabled,
end users can copy and paste between personal
and work accounts. Therefore, consider
deactivating personal accounts to restrict the copy
and paste functionality completely. Share and
define options are made unavailable in the
Copy Paste
application when selecting text.Note: In
Workspace ONE Boxer for iOS, the Copy Paste
setting can be applied only through the
Workspace ONE SDK setting. For more
information about this Data Loss Prevention (DLP)
SDK setting, see the Security Policies Profiles for
the SDK section in the SDK and Managing
Applications documentation at VMware Docs
(Android only) Prevent users from taking

Screenshots
screenshots from the app.
If the option is restricted, end users can access

contacts only from the email accounts in the app.
Personal Contacts
If unrestricted, end users can access contacts
from other apps on the device.
Control whether users can add a Boxer calendar

Allow calendar and email widget
or email widget to their home screen.

These settings determine whether users can open

emails or their attachments in other application.
Based on your requirements, you can specify the
allowed application using the Allow List option or
allow sharing in any application.NOTE: A similar
Allow List option is also available as an SDK
Admin setting in the Workspace ONE UEM
Sharing console. If the option is selected in both
Workspace ONE Boxer for iOS and SDK Admin
settings and applications are entered in both the
lists, then the lists are merged together. For more
information about the Allow List feature, see the
Security Policies Profiles for the SDK section in
the SDK and Managing Applications
documentation at VMware Docs.
Activates or deactivates attaching of files from

Control Open In other apps using open-in or share into Workspace
ONE Boxer.
Activates or deactivates attachments from

Control Attachments from external providers
external providers.
Watermark Text, Opacity, color Defines the watermark text.
Internal Domains List Defines the domain that is internal and permitted
Notifies the user while sending a message to an

External Recipient Warning
external user.
Activates or deactivates users to download

Attachment Download
attachments.

additional accounts to the application. If end users
Personal Accounts they are prompted whether they want to remove
personal accounts.
Browser
When restricted, all hyperlinks open in Workspace

Hyperlinks
ONE Web.
Usability
Enable this option to skip the in app tutorial

Skip in app tutorial
appears on the first launch of the application.


Workspace ONE Boxer contacts. By enabling this
app.
Enable the exporting of contacts, names, and

Default Caller ID phone numbers by default. This option requires
the Caller ID option to be set unrestricted.
Activate or deactivate avatars for the Exchange

Avatars
contacts.
Allow Archiving Emails This allow or block the ability to archive emails.
Conversation Threading Activate or deactivate the conversation threading.
Enterprise Content Activate or deactivate Enterprise Content
Allow End-user to Report Spam Allow users to enable the spam option.
Support
Logging Allows users to send logs.
Enter address to be specified when sending logs

Support Email Address
through the support menu.
Activate or deactivate reporting of crashes. By

Crash Reporting
default, Boxer can report.
Advanced
Forward/Add Attachments Allows the users to add or forward attachments.
Activate or deactivate downloading and forwarding

Attachment Download
of attachments.
Activate or deactivate attaching of images and

Attach Photos
media files from the photo gallery and camera.
Activate or deactivate Workspace ONE Boxer

plain text mode. When set, Workspace ONE
Boxer retrieves only plain text from HTML mails
when syncing. Workspace ONE Boxer sends only
Plain Text Mode
plain text regardless of the email message format.
The formatting controls in the compose view is
deactivate and only text can be copied and pasted
from rich or HTML content.
For emails (fetched using HTML) that contain non-

standard URL schemes, pointing to non-server
Refetch Empty Links using Mime domains, Exchange replaces the URL with two
empty spaces. Activate or deactivate this policy to
detect the occurrence and redownload the

affected body using MIME, which is not subject to

the URL replacement error.
Deactivate the escrowing key on to the server. If

Disable Key Escrow (Forgot Passcode) this feature is deactivated, the forgot password
feature is also deactivated.
Enable this option to allow collection of

anonymous usage data to improve user’s
Workspace ONE Boxer experience. When
enabled, a Data Sharing notice is displayed to
Anonymous Metrics
user when Workspace ONE Boxer is launched.
The device user can activate or deactivate data
sharing by navigating to Settings > Privacy >
Data Sharing.
Activates or deactivates QuickJoin buttons found

QuickJoin custom URLs in calendar invites that have online meeting
invites.
Application update source Select the source to download Boxer.
Enable this option to take full advantage of key

Swift SDK Key Wrapping Only Mode
wrapping security features.
Set the expiration time in hours when Workspace

ONE Boxer does not receive FastSync key.
FastSync Expiry
FastSync settings are applied when Email
Notification Service is enabled and configured.
FastSync improves the background syncing and

speed of subsequent syncs. FastSync settings are
Enable FastSync
applied when Email Notification Service is enabled
and configured.
4. Select Create.
Configure Fingerprint Authentication

Workspace ONE Boxer for Android and iOS supports fingerprint authentication. Configure the authentication
method as part of your normal deploy and assign process.
• Workspace ONE Boxer v4.5 for Android and Workspace ONE Boxer 4.2 for iOS
• Workspace ONE UEM console v9.0.5+
1. Navigate to Groups & Settings > All Settings > Apps > Settings & Policies > Security Policies.
2. Select Override to override any inherited settings.
3. Set the Authentication Type to Passcode or user name and Password.
Passcode and Biometrics must be enabled for using the Fingerprint functionality with Workspace ONE Boxer.

4. Expand the Authentication Type settings.
5. Enter a value greater than 0 for Authentication timeout.
6. Set Biometric Mode to Enabled.
7. Select Save at the bottom of the screen.
Configure Custom SDK Profiles

Configure the custom SDK profiles every time customers deploy their own Certificate Authority (CA) and use
the Workspace ONE Boxer with Certificate-Based Authentication.
1. Configure the custom SDK Profiles.
a. Navigate to Groups & Settings > All Settings > Apps > Settings and Policies > Profiles select
Add Profiles.
b. Select SDK Profile.
c. Select the platform.
d. Configure the General Settings.
e. Configure the Credentials.
f. Select a Certificate Authority.
g. Save the profile.
2. Assign Workspace ONE Boxer with Certificate Based Authentication.
a. Navigate to Apps & Books > Public.
b. On the List View page, select iOS Workspace ONE Boxer from the list of public apps.
c. Select Edit.
d. Navigate to the SDK tab.
e. Select the custom SDK profile.
f. Select Save and Assign.
Configure Workspace ONE Boxer with Derived Credentials (PIV-D)

Create and configure an SDK profile with Derived Credential and assign the profile to Boxer. The SDK profile
enables Boxer to fetch the Derived Credential certificates from the VMware PIV-D Manager application so that
the device can use the certificates to access resources securely.
A Derived Credential is a client certificate that is generated (or issued) on a mobile device after end users
prove their identity using their existing smart card (CAC or PIV) during the enrollment process.

When you set the Credential Source as Derived Credential on the Credential payload, Boxer imports the
authentication, signing, and encryption certificates from the PIV-D application. The PIV-D certificate is then
used to authenticate users against the Exchange Server or to fetch the SMIME certificates for signing and
encryption of emails. PIV-D allows certificate authentication even when modern authentication is configured.
1. Configure the SDK Profile.
a. Navigate to Groups & Settings > All Settings > Apps > Settings and Policies > Profiles select
Add Profiles.
b. Select SDK Profile.
c. Select the desired Platform.
d. Configure the profile’s General Settings.
e. Select the Credentials payload and select Configure.
f. Set the Credential Source to Derived Credentials.
g. Select the Key Usage based on how the certificate is used. Select Authentication, Signing, or
Encryption. To add additional certificates, use the plus sign at the bottom of the profile window.
h. Select Save and Publish.
2. Assign the SDK Profile to Boxer.
a. Navigate to Apps & Books > Native > Public > Add Application and add Boxer. If the Boxer
application has already been added, you can skip the preceding step.
b. Select Edit.
c. Navigate to the SDK tab and set the SDK profile to the one configured with the derived credential
source and key usage.
d. Select Save and Assign.
e. Create a smart group if you do not have one and modify your assignment.
f. Under More Email Settings, set the authentication type to Certificate or Both. If you are configuring
iOS Boxer with modern authentication using the AccountUseOauth key, then you must ensure that the
authentication type is set to Basic instead of Certificate or Both. You must also configure a device profile
with a Credential payload where the Credential Source is set to Derived Credential and Key Usage type
to Authentication. If you have not configured modern authentication on iOS, then you can skip to the next
step.
g. Add a dummy Certificate Authorities.
h. Under the Application Configuration, add the AppForceActivateSSO and the PolicyDerivedCredentials
keys. NOTE: AppForceActivateSSO is supported in Workspace ONE Boxer for Android only. For more
information about these configuration keys, see Application Configurations for Workspace ONE Boxer.
i. Select Add.

Configure Support for Azure Conditional Access Policies in Workspace

ONE Boxer
To add support for Azure Conditional Access Policies in Workspace ONE Boxer, Microsoft Azure and
Workspace ONE UEM console must be integrated. This integration allows Workspace ONE UEM and
Workspace ONE Boxer to read and set the status of the device based on the policies (such as mark the device
as compliant or not) and provide end user access to resources such as Office 365 Online Exchange Server.
Configure Microsoft Azure

Microsoft Azure must be configured to allow Workspace ONE UEM console to communicate with the Azure
Active Directory services to read and write the end user’s device compliance status. Azure is also configured
with the Conditional Access Policies which are applied to Workspace ONE Boxer.
Pre-requisites
Ensure that you have created an Azure tenant with the necessary licenses and applied these licenses to the
relevant users of your organization.
Procedure
1. In the Microsoft Endpoint Manager admin center, navigate to Tenant Administration>Connectors and
tokens>Partner compliance management.
2. Click Add Compliance Partner.
3. On the Create Compliance Partner page, select VMware Workspace ONE mobile compliance as the
compliance partner in the drop-down list.
Note: If you have the requirement of both Android and iOS platforms, you must create a compliance
partner connection for each of the platforms.
4. Set up the policy for iOS and Android and modern authentication apps to only allow compliant devices.
5. Click Next.
6. On the Assignments tab, assign the required users to the VMware Workspace ONE mobile compliance
partner.
7. Complete the next set of steps as per the screen prompts.
8. For Android, perform the following steps:
a. Navigate to Azure Active Directory>Mobility (MDM and MAM).
b. Click Add Application.
c. Select Airwatch by VMware.
d. Review the Required Permissions for Microsoft Graph and Windows Azure Active Directory.
e. To accept the permissions for the Airwatch by VMware application, click Add.

This step ensures that the “Airwatch by VMware” application is added as a mo

bility MDM application to the Azure tenant.
9. On the Azure home page, locate the Azure AD Conditional Access service and navigate to the
Conditional Access page.
10. Click Policies.
11. Click New Policy.
12. Enter the following on this page:
a. Enter the name of the policy.
b. Apply the policy to the required users or group.
c. Select the Office 365 Exchange Online Server application and apply the policy to this application.
d. Set up the following conditions:
i) Depending on your requirement, select the device platform as Android or

iOS.
ii) For Client apps > Modern authentication clients, depending on the platfo
rm selected in the previous steps, select the following:
|Platform|Modern authentication clients|

|--------|------------------------------|
|Android|Mobile apps and desktop clients|
|iOS|Browser|
e. In Access controls, as per your requirement, select the desired Grant access.
Configure Workspace ONE UEM Console

To activate the Azure Conditional Access policies support in Workspace ONE Boxer, some specific settings
are required on the Workspace ONE UEM console when performing the standard configurations. This
procedure focuses only on those specific options necessary for this support.
Pre-requisites
If you are using the Android platform, then ensure that you follow these pre-requisites:
• If you want to activate any newly added application (to the Workspace ONE UEM console) in the Work
Profile play store and activate the automatic installation (of the application) on the end user device after
the device has successfully enrolled with Workspace ONE Hub, you must resgister Workspace ONE
UEM as your Enterprise Mobility Management (EMM) provider with Google.

To register, navigate to Groups & Settings > All Settings > Devices & Users > Android > Android EMM
Registration.
• Ensure that you have added the Workspace ONE Boxer application as a public application to Workspace
ONE UEM console.
Procedure
1. To configure the Azure AD connection on the UEM console, navigate to Groups and Settings>All
Settings>System>Enterprise Integration>Directory services.
a. Enable Azure AD Integration.
b. Enable Use Azure AD for Identity Services.
c. In the Azure Active Directory section, follow the instructions as displayed on the UEM console and configure
the fields wherever required.
Make note of the following:
• Ensure that you paste the MDM discovery URL and MDM Terms of Use URL in the Azure portal
(navigate to Azure Active Directory services -> Mobility (MDM and MAM)). You can find instructions on
the Workspace ONE UEM console to perform this configuration.
• Enable Use compliance data in Azure conditional access policies.
• Enable Use compliance data in Azure conditional access policies for iOS, Android, and macOS.
For more information about Azure Active Directory configuration options, see the Directory Services
Integration documentation at Omnissa Product Documentation.
2. For Android, when creating the assignment for Workspace ONE Boxer application, add
ConditionalAccessEnabled KVP in the Email Settings.
This KVP is an account-level KVP.
a. To enable the KVP, set the KVP value to true.
By default, the value of this KVP is false.
b. Complete the rest of the assignment based on your requirements.
For more information about the KVP, see the Conditional Access Policies section Application Configurations
for Workspace ONE Boxer
For more information about assigning and configuring Workspace ONE Boxer using the App Assignment Page
and Assign Workspace ONE Boxer with Email Settings, see Boxer Deployment section in the Workspace ONE
Boxer Admin Guide.
3. For Android, add the Microsoft Authenticator as a public application to the Workspace ONE UEM
console.

For more information about adding an application to the Workspace ONE UEM console, see Deploy Public
Applications on your Devices section in the Application Lifecycle Management documentation.
4. If you want the conditional access policies supported on the iOS platform, you must create an SSO
extension.
a. Navigate to Devices>Profiles and Resources>Profiles.
b. Click Add>Add Profile
c. Select Apple iOS>Device Profile
d. Configure Profile General settings.
e. Select SSO Extension payload.
f. Configure the profile settings.
|Platform|Modern authentication clients|Recommended Settings|

|--------|------------------------------|--------------------|
|Extension Type|Select the type of SSO extension for the application. I
f Generic is selected, provide the Bundle ID of the application extension that
performs SSO for the specified URLs in the Extension Identifier field. I
f Kerberos is selected, provide the Active Directory Realm and Domains.|Generi
c SSO extension type settings.|
|Extension Identifier|Enter the Team Identifier of the application extension
that performs SSO for the specified URLs.|As a best practice, you can enter c
om.microsoft.azureauthenticator.ssoextension.|
|Type|Select either Credential or Redirect as extension type. Credential
s extension is used for the challenge/response authentication. Redirect ex
tension can use OpenID Connect, OAuth, and SAML authentication.|It is a best p
ractice to select Redirect as the extension type.|
|URLs|Enter one or more URL prefixes of identity providers where the applica
tion extension performs SSO.|As a best practice, you can enter the following: [https://login.microsoftonline.com](https://login.microsoftonline.com) [https://login.windows.net](https://login.windows.net) [https://sts.windo
ws.net](https://sts.windows.net) [https://login.microsoft.com](https://log
in.microsoft.com) |
|Additional Settings|Enter one or more URL prefixes of identity providers wh
ere the application extension performs SSO.|As a best practice, you can enter
the following : <dict> <key>TeamIdentifier</key> <string>SGGM6D27TK</string> <
/dict>|
NOTE: SGGM6D27TK is the identifier for Office apps.
g. Select Save and Publish.
h. In the Microsoft Authenticator application, ensure that the sharedDeviceMode configuration key value is
false.

i) Navigate to **APPS & BOOKS**>**Applications**>**Native**>**Public or Pur

chased** and select the iOS Microsoft Authenticator application.
ii) Navigate to the Application Configuration page of the application.
iii) If the sharedDeviceMode configuration key value is true, set the value t
o false.
After configuring Microsoft Azure and Workspace ONE UEM console, Conditional Access Policies are now
supported for Workspace ONE Boxer.
Activation steps for end users

For this feature to get activated using Android, the end users must perform the following:
• Before enrolling with Workspace ONE Boxer, the end user must manually authenticate with their
Microsoft credentials in the Microsoft Authenticator application.
• For every Exchange password change, the end user must manually authenticate in the Microsoft
Authenticator application.
• To ensure that the Microsoft Authenticator application works correctly, the user must turn off battery
optimization for the application from their device settings.
Configuring Privacy Settings for Workspace ONE Boxer

Use the configuration keys in the UEM console to perform additional privacy disclosure and data collection
practices. When Workspace ONE Boxer is launched, a privacy notice is displayed to the end users who are
upgrading to or using the latest Workspace ONE Boxer version.
The privacy dialog screen lets the user know the following information:
• Data collected by the app – Provides a summary of data that is collected and processed by the
application. Some of this data is visible to the administrators of the Workspace ONE UEM administration
console.
• Device Permissions – Provides a summary of device permissions requested for the app to enable
product features and functionality, such as push notifications to the device.
• Company’s privacy policy – By default, a message is displayed to the user to contact the employer for
more information. You can configure the privacy policy URL in the UEM console. Once configured, the
user can access the employer’s privacy policy from Workspace ONE Boxer.
Configure Privacy Settings Using SDK Default Settings
Use the SDK default settings to configure privacy settings.
1. Navigate to Group & Settings>All Settings.
2. From All Settings, navigate to Apps>Settings & Policies>Settings.
3. Select Enable Custom Settings and paste the configuration keys as per your requirement.
For example, to enable Crash reporting, {“PolicyAllowCrashReporting”: true}.

4. Select Save.
Configure Privacy Settings Using a Custom SDK Profile
Use custom SDK profile to configure privacy settings.
1. Navigate to Group & Settings > All Settings.
2. If you have an existing custom profile, navigate to Apps > Settings & Policies > Profiles > Custom
Profile > Custom Settings.
3. If you want to add a custom profile, navigate to Apps > Settings & Policies > Profiles > Add Profile >
SDK Profile > iOS or Android > Custom Settings.
4. From Custom Settings, select Configure and paste the following configuration keys as per your
requirement.
Configuration Key Value Type Supported Values Description
When set to ‘1’

(activated), Workspace
ONE Boxer displays a
privacy notice to the
0 = deactivated 1 = users about the data
{ “DisplayPrivacyDialog” } Integer
activated (default) that is collected and the
permissions that are
required on the device
for the optimal
functioning of the app.
When set to ‘1’

(activated), Workspace
ONE Boxer displays a
notice to the users
about the option to opt-
in to anonymous feature
usage analytics that
help us improve product
functionality and invent
new product
0 = deactivated 1 = capabilities. When set
{ “PolicyAllowFeatureAnalytics”
Integer}
activated (default) to ‘0’, the data sharing
notice is not displayed
and no data is collected
from the device to
optimize the app
experience. The device
user can activate or
deactivate data sharing
by navigating to
Settings > Privacy >
Data Sharing.

Configuration Key Value Type Supported Values Description
When set to True, app

True = activated False = crashes are reported to
{ “PolicyAllowCrashReporting”
Boolean
}
deactivated the Workspace ONE
Boxer team.
Provide the Policy

URL that you want your
users to visit when Your
{ “PrivacyPolicyLink” } String https://www.acme.com
company’s privacy
policy is selected from
the Privacy notice.
Sample
SDK configuration:
{“PolicyAllowFeatureAnalytics”:1,
“PrivacyPolicyLink”:https://
www.acme.com/
privacypolicy,
“PolicyAllowCrashReporting”:true}
5. Select Save.

Supported Capabilities for Workspace ONE Boxer

Learn about the various features supported by Boxer and understand how best these features meet your
requirements.
• ENS2 VIP Notifications - Workspace ONE Boxer when configured with ENS2 supports VIP notifications.
User can create a list of VIP contacts using VIP notifications. Users can choose only to receive
notifications from those contacts and set a custom notification sound for the list. Configuration of this VIP
list can be found in Boxer Settings > your exchange account > VIP notifications.
• Information Rights Management - Workspace ONE Boxer supports information rights management for
both iOS and Android platforms.
• VPP Application Deployment - You can deploy Workspace ONE Boxer for iOS through Apple’s Volume
Purchase Program (VPP) from the UEM console. This deployment allows end users to download the app
without the need to enter Apple ID. For more information on how to deploy applications through VPP, see
Purchased Applications (Apple VPP) Feature Overview section of the Mobile Application Management
Guide.
• Google G Suite Support - Workspace ONE Boxer supports G Suite for both iOS and Android. For more
information about the limitations of Workspace ONE Boxer when used with G Suite, see Current VMware
Boxer limitations when used with Google G Suite. Note: OAuth and third-party identity providers are not
supported due to limitations of G Suite’s Exchange ActiveSync implementation.
• Apple Wallet Support- Workspace ONE Boxer for iOS has the ability to preview the .pkpass
attachments that the user adds to the Apple Wallet.
• Workspace ONE Boxer supports both IRM and Email Classification when composing a message.
• Phishing Report - Workspace ONE Boxer supports the ability to select and report any emails as
phishing. The reported email is forwarded to the email address specified in the KVP set in the console.
After reporting, the original email reported as phishing is permanently deleted.
• Spam Reporting- Workspace ONE Boxer supports the ability to report any emails as spam. When the
user marks an email as spam, the marked email is forwarded to the KVP specified email address. An
extra KVP can be used to delete the email upon forwarding.
• Block Insecure Attachments (Android Only) - Workspace ONE Boxer for Android restricts opening and
downloading insecure attachment types by default. The device user can allow downloading of an
insecure attachment by navigating to Boxer > Settings > More mail settings and select Allow
insecure attachments. Workspace ONE Boxer restricts the following file types:
Restricted File Types
Common File Formats
ADE ADP BAT CHM
CMD COM CPL DLL
EXE HTA INS ISP
JSE LIB MDE MSC
MSP MST PIF SCR

Restricted File Types
SCT SHB SYS VB
VBE VBS VXD WSC
WSF WSH
Common Container
Formats
TGZ BZ2 XEN APK
ZIP GZ Z TAR
• Health Check of Boxer
Workspace ONE Boxer displays and maintains a Health Check screen, describing the current health
status of the Boxer under the following metrics. - App Version - Checks the current version of Boxer. -
Green- Indicates the current version. - Yellow - Indicates that the version installed is the previous version.
- Red - Indicates that the version installed is an outdated version. - Sync Health - Checks the network
connection and Exchange server’s response. - Green- Indicates that your network connection and
Exchange server’s response are within normal parameters. - Yellow - Indicates that the last 10 sync
average response times are greater than 2 seconds. - Red - Indicates that the last 10 sync average
response times are greater than 5 seconds. - Push Notification Health - Shows if you have the Email
Notification Service (ENS2) set up by the admin or admin is having issues in subscribing to the ENS
service. Users can update Boxer from the App Store or Play Store and can send logs to the admin by
capturing the issue through email. This information is also logged in the Boxer logs for the admin to see
more details.
• QuickJoin for Online Meetings Workspace ONE Boxer allows you to quickly join online meetings such
as Skype for Business, Webex, Microsoft Teams, and Zoom with one tap from the calendar invitation.
Boxer supports meeting links with words such as Lync, Skype, Zoom, or Webex. You can also configure
Boxer to handle meeting links that are vanity URLs specific to a user’s environment. Vanity URLs do not
contain the term Lync, Skype, Webex, or Zoom. To configure Boxer to detect vanity URLs, see the
QuickJoin - Vanity URL Support section on the Application Configurations for Workspace ONE Boxer.
• ICS File Support Workspace ONE Boxer supports viewing and adding ICS files to your calendar. This
file contains event details such as title, date and time of the event, location, attendees, and user
availability. Users can tap on the ICS attachment to add event to their Boxer calendar and preview the
event’s details. Boxer also supports ICS attachments with multiple events. Note: ICS file is a snapshot of
a calendar invite. Users do not get any event updates unless they receive a new ICS file.
• Boxer Siri Shortcuts on iOS Devices You can enable Siri Shortcuts for quicker access to the
information you need. Workspace ONE Boxer provides the following Siri Shortcuts:
◦ View upcoming Boxer meeting

◦ View Boxer agenda for the day
◦ Dial into your next Boxer meeting To enable Siri Shortcuts in Boxer, you can navigate to iOS
Settings > Siri & Search > Boxer > Siri & Suggestions or Boxer Settings > Advanced > Siri
Shortcuts and record their Siri suggestions. You can also combine Boxer with Apple’s Shortcuts
application to create more complex workflows.

• Synchronize Draft Emails Workspace ONE Boxer supports synchronization of draft emails between
Exchange and Boxer. Users can synchronize newly created draft emails and edit existing drafts. This
synchronization requires Office 365, Exchange 2016 and later versions.
• Dark Mode Support for iOS Boxer follows the iOS Dark Mode settings. When in Dark Mode, in the
email detail screen, you can toggle an email’s contents back into light mode with the sun or moon toggle.
Dark Mode requires iOS 13 and higher version.
• Dark Theme Support for Android On Android Boxer, you can view email’s content in dark theme.
When in dark theme, in the email detail screen, you can toggle an email’s content back into light mode
with the sun or moon toggle. How dark theme works in Workspace ONE Boxer depends on the Android
version of your device.
◦ You can always force Boxer to use the light or dark theme from the Select theme option in the
Boxer settings.
◦ Android 10: Boxer uses the settings for dark theme configured at the OS level.
◦ Android 9 (Pie): Boxer follows the system Battery Saver settings to determine if the dark theme is
used. Note: For dark theme on Samsung devices running Android Pie, Boxer always follows the
Battery Saver toggle and not the system’s Night mode toggle.
◦ Android 8 (Oreo) and earlier versions: When Battery Saver is on, Boxer uses the dark theme. If
your device does not have Battery Saver, you can toggle the Dark theme in Boxer Settings.
• Native Share Sheet for Workspace ONE Boxer iOS Native share sheet feature can be used to send
images, videos, links, files, and text directly from any native iOS application to Workspace ONE Boxer.
As an administrator, you can activate this feature by setting the PolicyAllowNativeShare application
configuration key-value pair in the Workspace ONE UEM console to true. Ensure that you are aware of
the following policy dependencies when using the native share sheet feature:
◦ When the PolicyAllowNativeShare KVP is not set with any value, Control Open
In (PolicyAllowOpenIn KVP) policy is used. If the value of PolicyAllowOpenIn is false, native share
sheet feature is deactivated.
◦ If native share sheet is allowed and Forward/Add Attachments (PolicyAllowAttachments KVP) policy
is restricted, the user is informed that they are not allowed to share attachments when starting a
share action for files and images.
◦ If native share sheet is allowed and Prevent Paste In (SDK) policy is restricted, the user is
informed that paste is not allowed, and they cannot share texts and links when starting a share
action for texts and links.
◦ If both Forward/Add Attachments and Prevent Paste in (SDK) are restricted, then native sharing is
completely restricted.
For more information about PolicyAllowNativeShare KVP for Workspace ONE Boxer, see Application
Configurations for Workspace ONE Boxer.
• Email Widget for Workspace ONE Boxer Android The email widget displays emails from specific
folders and accounts chosen by the user. As an administrator, you can activate the email widget for
managed devices by using Allow email widget, an app level setting in the App Policies assignment page
in the Data Loss Prevention section.
• Calendar Widget for Workspace ONE Boxer iOS The calendar widget displays upcoming events of an
end user.
For Workspace ONE Boxer Android, administrators can activate this feature by using Allow calendar
widget, an app level setting in the App Policies assignment page in the Data Loss Prevention section.

For Workspace ONE Boxer iOS, administrators can activate this feature on managed devices by setting
the PolicyAllowCalendarWidget application configuration key-value pair in the Workspace ONE UEM
console to true. For iOS end users, the calendar widget feature is available on versions, iOS 14 and
later. For more information about PolicyAllowCalendarWidget KVP for Workspace ONE Boxer, see
Application Configurations for Workspace ONE Boxer.
• WebDAV repository support (iOS Only)
Workspace ONE Boxer supports WebDAV as a repository. For this support, WebDAV must be configured
as one of the repositories in the Workspace ONE UEM console (CONTENT > Content > Admin
Repositories). After this configuration, WebDAV is listed in the Workspace ONE Boxer application at
Files > Repositories.Note: For Workspace ONE Boxer to support WebdAV, Workspace ONE Content
application must be installed and configured on the end user’s device.
• Azure Conditional Access Policies Support
The Azure Conditional Access Policies allows administrators to apply organisational policies through
Workspace ONE Boxer. With these policies, administrators can restrict the end user access to their
organisation’s Office 365 Exchange Online Server only through Workspace ONE Boxer. This support
adds another level of security for end user access.
To add support for Azure Conditional Access Policies in Workspace ONE Boxer, Microsoft Azure and
Workspace ONE UEM console must be configured and integrated. For information about configuring
Microsoft Azure and Workspace ONE UEM console, see Configure Support for Azure Conditional
Access Policies in Workspace ONE Boxer section in Workspace ONE Boxer Deployment.
For the feature to get activated for Android end users, users must authenticate with their Microsoft
credentials in the Authenticator application.
• Send debug logs when unable to authenticate in Workspace ONE Boxer
Workspace ONE Boxer supports the ability to send debug logs to the Workspace ONE Boxer team for
troubleshooting when a user is unable to proceed from the initial authentication screen.
To send logs, the user must enter ‘debug’ in the email field on the authentication screen, and select ‘Get
started’. As a result, logs are sent as application feedback to the Workspace ONE Boxer.
• (iOS Only) Email Search Modes
Workspace ONE Boxer for iOS supports two search modes: Extensive Search and Quick Search. This
feature requires EAS (Exchange ActiveSync) 16.1 or later. The default mode is Extensive Search. In
earlier versions of EAS, the default search mode is applied.
Administrators can control the search mode configuration using an account-based KVP,
AccountEmailSearchMode. For more information about this KVP, see Application Configurations for
Workspace ONE Boxer.
End users can choose the desired search mode from the Settings menu in the Workspace ONE Boxer
application for each user account.
Interoperability Features of Workspace ONE Boxer

Workspace ONE Boxer supports interoperability with different applications.

Workspace ONE Boxer URL Schemes for iOS
Workspace ONE Boxer app extends the support for inter-app integration using URL schemes. Workspace
ONE UEM provides you with a set of URLs that can be used to access different Workspace ONE Boxer menus
and options from supported third-party applications. The URL schemes can be used with any application that
supports URL formats, for example, browsers, email applications, and notes. You can save the URLs and
open them to directly access a specific Workspace ONE Boxer menu or option. For example, use boxer://
calendar URL scheme to openWorkspace ONE Boxer calendar directly from any supported app.
Supported URL Schemes
URL Scheme Description
boxer://messages Workspace ONE Intelligent Hub v5.2 and higher.
boxer://calendar Opens calendar.
boxer://calendar/ Opens calendar for a specific date or time.
boxer://calendar/create Creates a calendar event.
boxer://calendar/nextEvent Opens the first upcoming event in the calendar.
boxer://contacts Opens contacts.
boxer://contacts/create Creates a contact.
boxer://settings Opens Boxer settings.
Additional URL Scheme Sending Base64 Encoded

strings to Boxer as an attachment. For a sample app
on how to encode attachments, contact the Boxer
team.
Pre-composed Email awemailclient:// Opens a pre-composed email for single or multiple

emailcompose? recipients with a subject and an email body. You can
[email protected], edit and save the URL to create multiple quick
[email protected]&[email protected]&kAWEmailClientEmailSubject=whatever&kA
templates for frequent email interactions.
Using Escrow Gateway to Retrieve S/MIME Certificates

Workspace ONE Boxer supports Credential Escrow Gateway (CEG) for distributing S/MIME certificates to the
managed iOS and Android devices. Using CEG eliminates the need to upload certificates to the Workspace
ONE UEM server. As an admin, you can deploy S/MIME certificates to Escrow Gateway through the
Workspace ONE UEM console version 2007 and later. Workspace ONE Boxer can retrieve these certificates
from Escrow Gateway by providing end-to-end public-key encryption. For more information about this feature,
see Uploading Certificates for Credential Escrow Gateway.
Clear Cached Contacts

Workspace ONE Boxer gives you the ability to clear your contacts cache. Cached contacts appear when
composing an email or searching for contacts. This feature is useful when your contacts have changed their
email address and you do not want to see any suggestions about their old email address when searching. To

clear the cached data of your contacts, navigate to Boxer Settings > Advanced > Clear Contact Cache.
Removing cached contacts in Boxer does not delete emails, contacts, or any other useful information.
Access the User Guide Documentation

Workspace ONE Boxer for Android provides a link to the User Guide documentation to help your users learn
more about the app and become self-reliant. To access this link, you must navigate to Settings > Other >
User Guide. When you access the link, the documentation opens in Workspace ONE Web or any other
browser that you have set as default. By pressing the browser’s back button, you can navigate back to Boxer.
New Email Compose View for iOS

Workspace ONE Boxer introduces a new email compose view for all the iOS device users. By default, this
feature is enabled on Boxer 5.14. The new email composing view includes the following features:
• Move recipients between the To, Cc, and Bcc boxes.

• Automatically perform spell check on the email body.
• Highlights the external recipients in orange with an external recipients icon.
• Automatically collapses the To, Cc, and Bcc boxes to give you more space to write your email.
Mark an Email as High Importance

You can let your email recipients know the email you sent needs urgent attention by marking the email as high
importance. While composing, forwarding, or replying to an email from Boxer, you can set the email as high
importance by tapping the icon on the Subject box. Your recipients can view the high importance indicator in
the email list view and the email’s detailed view.
Note: For iOS and Android Boxer, the mail importance feature is supported with Exchange server On-Premise
or Office 365.
Use Advanced Search Filters to Find Your Emails

Workspace ONE Boxer for iOS introduces advanced search criteria that help you quickly find the email
messages you are looking for. When searching for an email, you can tap a filter above the keyboard or tap All
Filters to apply the following filters.
• Keyword
• From
• To
• Subject
• Has attachment
• Flagged
• Unread
• Time
Boxer searches your mailbox based on your selected filter. For example, if you want to display all emails that
have attachments, you can select Has attachment. To clear all the selected filters, tap Clear all.
Schedule Events with the Visual Scheduler

Finding a suitable time to have all the attendees for a meeting can be a challenge.

To quickly view the availability of attendees and reschedule the meeting if there are meeting conflicts, Boxer
displays a preview of the visual scheduler in the New Event and Edit Event screens.
The pre-requisites to use the visual scheduler features are:
• You must have a managed account on Exchange server On-Premises or Office 365.
• You must enable EWS.
If you do not meet the pre-requisites, you can see the meetings in your calendar but cannot fetch the
availability of the invitees.
The visual scheduler improves the user experience by displaying when the attendees are unavailable and
helps you resolve the conflicts by dragging and dropping the event to a different time slot. In addition, when
you expand the visual scheduler preview, you can select the View suggested time slots option. The
suggested time slots feature automatically provides suggestions about the best available time, according to
the availability of the attendees.
Listed are the limitations of the visual scheduler:
• Distribution lists are not supported.

• Adding more than 30 invitees may result in slow fetching of the invitees availability.
Note: To use the Visual Scheduler feature on the Boxer Android app, the user must enable the listed settings
manually from Settings > Advanced > Enable Features on the app.
• Enable visual scheduler

• Enable scheduler suggested time slots
• Enable New Event Create / Edit redesign
In Workspace ONE Boxer 21.10 and later for iOS and Workspace ONE Boxer 22.01 and later for Android, the
following features are enabled by default. You can access these settings from Settings > Advanced > Enable
Features on the Workspace ONE Boxer for iOS and Android applications respectively.
• Visual Scheduler
• Suggested Time Slots
• New Event Create / Edit
(iOS Only) Propose and Accept New Meeting Time

Workspace ONE Boxer for iOS supports features that enhance the end user experience when proposing a
new meeting time and accepting the proposed time.
An end user can propose a new meeting time to the meeting organizer at the same time as responding to the
meeting invite from within the invite email. Additionally, the user can view the availability of all invitees within
the same organization when proposing the new meeting time. As a result, the user can choose a time slot that
suits the schedule of all other invitees.
NOTE: For end users to use this Workspace ONE Boxer functionality, EAS (Exchange ActiveSync) 16.1 or
later is required.
The meeting organizer can respond to this newly proposed time with just a single tap. When the meeting
organizer accepts the proposed time, the meeting is moved to the proposed slot and a new meeting invite is
automatically sent to the attendees.

For more information about this feature, see the Propose and Accept New Meeting Time section in the
Workspace ONE Boxer for iOS User Guide at VMware Docs.
Categorize your Events

Multiple events can be scheduled in the calendar and tracking numerous such events can be a challenge. You
can categorize the calendar events by assigning colors using the color categories available on your Outlook
desktop application. These color categories help you easily identify and organize your events. iOS Boxer
displays the events with their assigned colors in the Agenda, Day, Week, and Month views.
Note: You must enable EWS for the event color categorization to sync with Boxer.
End Events Early

You can configure Workspace ONE Boxer to end your appointments and meetings a few minutes early. This
feature brings a focused and effective meeting culture to your organization. It helps to reduce fatigue that can
come from back to back online meetings and build in travel time between meetings by ending your meetings 5
minutes early that are less than an hour and 10 minutes early for one hour or longer meetings. You can also
configure a different end early duration for meetings under one hour and meetings over one hour or longer
from the options in Boxer Settings > More (under Calendar) > Less than one hour or One hour or longer.
When creating or editing events, if the End event early option is enabled by default, the setting applies to the
default meeting duration and shortens the duration of the event. The Auto end events early option, found in
Boxer Settings > More (under Calendar), takes the default event length and applies the settings to it while
creating a calendar event.
Handling Multiple Authentication Certificates

Workspace ONE Boxer for iOS introduces a new screen to handle multiple authentication certificates for an
Exchange account. With this new screen, users can view the list of available certificates and select any one
authentication certificate. For example, users using the PIV-D Manager application can use this screen to view
and select any of the derived credential certificates.
Note: Workspace ONE Boxer does not synchronize the following contact information due to limitation of the
Exchange ActiveSync protocol:
• Assistant
• Callback
• Car
• ISDN
• Other Fax
• Primary
• Other
• Radio
• Telex

Sideload S/MIME Certificates from Workspace ONE Web to Workspace

ONE Boxer
You can install S/MIME certificates (used for signing, encrypting or both) from Workspace ONE Web to
Workspace ONE Boxer. This feature allows you to import S/MIME certificates from an internal web portal
without uploading the certificates to the Workspace ONE Console.
Prerequisites
Before installing S/MIME certificate, you must meet the following pre-requisites:
• Create and assign a custom SDK profile to Workspace ONE Web and enable the following configuration
key:
Configuration Key Configuration Value Description
Set this key to true to enable the

ability to sideload certificates
EnableCertificateShare True, False from Workspace ONE Web
application to Workspace ONE
Boxer.
• Enable S/MIME by adding the PolicySMIME key to the application configuration for Boxer. For
information about configuring S/MIME, see the Assign and Configure Workspace ONE Boxer Using the
App Assignment Page section in the Workspace ONE Boxer Deployment.
• This feature requires Workspace ONE Web 7.11 and later versions.
To install the S/MIME certificate in Boxer, perform the following actions in both Web and Boxer:
1. In Workspace ONE Web:
a. Download the S/MIME certificate from a web portal in Workspace ONE Web.
b. Open the Downloads section to view the list of downloaded files.
c. Tap the S/MIME certificate. On iOS, you can open the certificate in Boxer through the Copy to Boxer option
in the share sheet and for Android, open the certificate through the Open with option in the share screen.
2. In Workspace ONE Boxer:
a.Enter the password for the S/MIME certificate and review the certificate details.
b.Tap Install to install the S/MIME certificate. The S/MIME certificate is now installed and ready for use.
Check-In/Check-Out Support for Shared Android Devices

Workspace ONE Boxer supports Check-In/Check-Out (CICO) for shared Android devices. The Check-In/
Check-Out feature allows you to share a device among multiple users. A user can check out a device for use
and can check in the device after use. Boxer streamlines the initial sign-in process for CICO users.

To enable the CICO feature, you must deploy the Workspace ONE Launcher application on the Android
devices through the Workspace ONE UEM Console. For more information about this feature, see Workspace
ONE Launcher admin guide.
For other options to enhance the CICO experience, consider the following adjustments to your application
configuration for Boxer:
• Skipping the Data Privacy screen: For information on skipping the Data Privacy screen, see the
Configuring Privacy Settings for Workspace ONE Boxer section in the Workspace ONE Boxer
Deployment topic.
• Skipping the in-app tutorials: If you want users to skip the in-app tutorials every time they open Boxer,
you can deactivate the AppShowFirstTimeTutorials key in the application configuration of Boxer. For
information on this key, see the Application Configurations for Workspace ONE Boxer section.
• Skipping the Battery Optimization screen: To skip the Battery Optimization screen, deactivate the
AppShowOptOutBatteryOptimizationScreen key. For information on this key, see the Application
Configurations for Workspace ONE Boxer section. Note: You should only skip the Battery Optimization
screen when you have another way of adding Boxer to the battery optimization allowlist. If you do not
add Boxer to the allowlist, syncing and notifications may be delayed.
Create Online Meetings for Microsoft Teams

Team collaborations always enhance work effectiveness and productivity. To achieve effective collaboration,
Boxer now extends the meeting feature to support Microsoft Teams online meeting invites.
To use this feature, you must meet the following requirements:
• Use Office 365 as the email server

• Enable Exchange Web Services (EWS)
• If you use the Secure Email Gateway (SEG), you must enable EWS.
• In Azure, administrators must allow access to the Teams app and provide consent on behalf of users in
the tenant. If you do not do so, each user must manually consent for the first time when a creating a
Teams meeting. This is only for regular meetings that include audio, video and screen sharing for up to
250 people. We do not currently support Teams live events.
• Enable the configuration key, EnableTeamsOnlineMeetings. For more information about enabling this
configuration key, see the Enable Microsoft Teams Meetings section in the Application Configurations for
Workspace ONE Boxer topic.
Once the configuration key is enabled, you can see the toggle button to add Teams Meeting in the New Event
screen when creating a new calendar event or editing an existing event.

Note: You can add details only about the regular meetings that include audio, video, and screen sharing for up
to 250 people, not Teams live events.
Create Online Meetings for Zoom

To use this feature, you must meet the following requirements:
• Enable cloud ENS (Email Notification Service)

• Enable the configuration key, EnableZoomOnlineMeetings.
After the configuration key is enabled, end users can see a toggle button to add a Zoom Meeting when
creating a new calendar event or editing an existing event.
Note: When an end user tries to create a meeting for the first time, the user is prompted to authenticate in
Zoom with their credentials.
For more information about enabling the configuration key, see the Create Online Meetings for Zoom KVP
section in Application Configurations for Workspace ONE Boxer.

Application Configurations for Workspace ONE Boxer
Application Configurations for Workspace ONE

Boxer
Configure Workspace ONE Boxer with application configuration values.
You can configure settings for your Workspace ONE Boxer deployment using the Configuration Key and
Configuration Value pairs provided by Workspace ONE UEM.
Note: If you are using console 2004 or higher, you do not need to manually add all the configuration key-value
pairs. You can configure most of the application configuration values using the settings available in the Email
Settings and App Policies assignment pages. Some new features will require key-value pairs. If you input a
key-value pair that has already been migrated to the new UI, a message is shown stating that a duplicate key
is found. The settings for that feature can be found elsewhere in the UI depending if it is an account or app
specific policy.
To configure these settings, enter the configuration key and the corresponding value into the Application
Configuration setting during the app assignment.
Important: If Workspace ONE Boxer is already installed on end-user device, it might take few minutes for
Workspace ONE Boxer to download the new profile settings.
(iOS only) FastSync - Key Sync Escrow

Add the following key value pairs to improve the background syncing and speed of subsequent syncs.
Configuration Key Value Type Configuration Value Description
0 - deactivated (default)1
ENSEnableKeyEscrow Integer Set to enable FastSync.
- activated
Set the expiration time in

hours when Workspace
ENSKeyEscrowExpiry Integer 48 hours (default)
ONE Boxer no longer
receives this key.
S/MIME
Use these key value pairs to configure S/MIME support.
0 - deactivated (default)1 Changes the status of S/

PolicySMIME Integer
- allowed 2 - required MIME support.
Activate or Deactivate
0 - deactivated (default)1
PolicySMIMEEnableRevocationCheck
Integer Online Certificate Status
- enabled
Protocol (OCSP).

Supported format: http:// Configure the Revocation

PolicySMIMERevocationCheckUrl
String
ocsp.acme.us/ ocsp:88 check URL.
0 - check entire
Configure the revocation
PolicySMIMERevocationCheckType
Integer chain(default)1 - check
check type.
only user certificate
0 - deactivated (don’t use

URL configured inside
certificate for revocation
status, use
only) (default)1 - enabled
(use URL configured
inside certificate for
Define the revocation
PolicySMIMERevocationUseAIA
Integer revocation status check,
usage policy.
fall back to
if it is unavailable)2 -
required (only use URL
configured inside
certificate to check for
revocation status, ignore
PolicySMIMERevocationCheckUrl)
0 - deactivated (enforce
nonce) (default)1 - Define the nonce usage
PolicySMIMERevocationEnforceNonce
Integer
enabled (do not use policy.
nonce)
Define the amount of

PolicySMIMERevocationTTL
Integer 7 - Default value time to retain the
revocation data.
0 - Device Trust Store

PolicySMIMETrustStore Integer (default) 1 - Workspace Define the Trust Store.
ONE Boxer Trust Store
Default S/MIME Signing and Encryption Algorithms

Add the following key value pairs to configure the default encryption algorithms for signing and encrypting S/
MIME emails. When a default S/MIME algorithm is configured, Workspace ONE Boxer sends the outgoing
emails with the default configured algorithm. Workspace ONE Boxer also checks the algorithms for the
incoming emails. If the incoming emails are not configured with the default algorithm, a warning message is
displayed in the conversation view.
Allowed Values: 3DES Specify an encryption

PolicySMIMEDefaultEncryptionAlgorithm
String AES128 AES192 algorithm to use for
AES256 For example, incoming and outgoing

emails. If a valid
PolicySMIMEDefaultEncryptionAlgorithm
algorithm is not provided,
- [“3DES”] the lowest supported
algorithm is used (3DES).
Specify a default S/MIME

signing algorithm to use
Allowed values: SHA1
for incoming and
SHA256 SHA384
outgoing emails. If a valid
PolicySMIMEDefaultSigningAlgorithm
String SHA512 For example,
algorithm is not provided,
PolicySMIMEDefaultSigningAlgorithm
the lowest supported
- [“SHA1”]
algorithm is used
(SHA-1).
Enable S/MIME Signing by default

Add the following key to enable the S/MIME digital signing for all outgoing email messages by default. To
enable this option, you must also ensure that the S/MIME is enabled and configured on the Exchange account.
Use this key to digitally

sign all outgoing emails
by default. When the key
value is set to true, the S/
True - enabled (default)
AccountSMIMESignByDefault
Boolean SMIME signing is always
False - deactivated
enabled in the Boxer
Settings and the users
are not allowed to
change this setting.
If the admin has not configured the AccountSMIMESignByDefault key, users can also set the S/MIME
signing as a default option when S/MIME is enabled for that Exchange account. To do so, user must navigate
to Boxer Settings > Account > S/MIME > On > Sign > On and enable the Sign email by default option.
Note:
• Even if the SMIME signing is enabled by default, users can always opt to deactivate signing when
composing any specific email.
• The user can use S/MIME only for encryption. This allows the user to reply to signed emails even when
the user does not have a signing certificate.
Send S/MIME protected emails to Distribution Lists

Add the following key value pairs to control the maximum number of members of a distribution list allowed to
receive S/MIME protected emails.
As prerequisites, ensure that the S/MIME signing and encryption is enabled on the managed account on
Exchange server on-premises or office 365.

The sender can send encrypted emails only to those members who have S/MIME enabled. If the sender sends
an encrypted email to members without the S/MIME certificates, the sender sees a notification message. The
sender has the option to send an unencrypted email to all the members.
Use this key to set the

maximum number of
PolicySMIMEtoDLMaxSize Integer 50 (default) members in a distribution
list who can receive S/
MIME protected mails.
(Android Only) S/MIME Algorithms Compliance

Add the following key value pairs to configure the list of algorithms that Workspace ONE Boxer checks for
compliance when receiving a signed or encrypted S/MIME email. When set, only the configured algorithms are
recognized by Workspace ONE Boxer. Workspace ONE Boxer displays non-compliance warning when
accessing emails that are encrypted using any other algorithm, both strong or weak, than that are listed using
the key value pairs.
Supported Values: 3DES Set the algorithms that

AES128 AES192 are recognized by
PolicySMIMEConformingEncryptionAlgorithms
String AES256 For example, Workspace ONE Boxer
PolicySMIMEConformingEncryptionAlgorithms
for encrypting S/MIME
= [“AES-128”, “AES-256”] emails.
Supported Values: SHA1

Set the algorithms that
SHA256 SHA384
are recognized by
SHA512 For example,
PolicySMIMEConformingSigningAlgorithms
String Workspace ONE Boxer
PolicySMIMEConformingSigningAlgorithms
for signing S/MIME
= [“SHA-256”,
emails.
“SHA-512”]
ENSv2 Notification Policy

Add the following key value pair to configure the ENS Notification Policy for Workspace ONE Boxer. When
configured, Workspace ONE Boxer immediately re-subscribes to ENSv2 and notification policy is updated as
per the set key value. For more information about configuring ENS2 for Workspace ONE Boxer, see VMware
Email Notification Service v2.0 Installation and Configuration Guide available at docs.vmware.com.
0 - sets notification to
sender, subject and
preview 1 - sets Configure the notification
PolicyLimitNotificationText Integer notification to sender and policy used by
subject(default) 2 - sets Workspace ONE Boxer.
notification to sender 3 -
sets notification to

generic message (new

message) 4 - sets
notification to none (only
the badge is updated)
Plain Text Mode

Add the following key value pair to configure Workspace ONE Boxer plain text mode.
Set to True to enable

Workspace ONE Boxer
plain text mode. When
set, Workspace
ONE Boxer retrieves only
plain text from HTML
mails when syncing.
Workspace ONE Boxer
False - Deactivated
AppPlainTextMode Boolean sends only plain text
(default) True - Activated
regardless of the email
message format. The
formatting controls in
compose view is
deactivated and only text
can be copied and
pasted from rich or HTML
content.
Policy Allow Metrics

Add this key to define the policy for allowing collection of anonymous usage data to improve user’s Workspace
ONE Boxer experience. When enabled, a Data Sharing notice is displayed to user when Workspace
ONE Boxer is launched. The device user can activate or deactivate data sharing by navigating to Settings >
Privacy > Data Sharing.

data collection for
Workspace ONE Boxer
experience
improvement.The value
False - Deactivated
PolicyAllowMetrics Boolean of
PolicyAllowFeatureAnalytics,
when set from
Custom SDK settings
takes precedence over
the value of

PolicyAllowMetrics that is
set from App
Configuration Settings.
Policy Allow Crash Reporting

Add this key to define the policy for reporting crashes to the Workspace ONE Boxer team.
Set to True to report

crashes to the
Workspace ONE Boxer
team. The value of
PolicyAllowCrashReporting,
True - Activated (default)
PolicyAllowCrashReporting Boolean when set from
False - Deactivated
Custom SDK settings
takes precedence over
the value that is set from
App Configuration
Settings.
(iOS only) Allow Print
Set to False to deactivate

PolicyAllowPrint Boolean printing of emails from
False - Deactivated
Note: You can only print the email from a Boxer preview and not the attachments. To print attachments, open it
to some third-party apps, and then print it from there.
(iOS only) Enforce HTTPS

From Workspace ONE Boxer v4.13 for iOS, adding this key value pair blocks email content from unsecured
connections in Workspace ONE Boxer.
When set to True, email

content from unsecured
HTTP connections are
False = Deactivated
PolicyEnforceHTTPS Boolean not loaded. Outgoing
(default) True = Activated
links (hrefs) are not
affected since the
outgoing links can be

controlled using Browser

policy.
Limit Notification
0 - Displays Sender,
Subject, and Body
Preview 1 - Displays
Set configuration value to
Sender and Subject
limit what is displayed in
PolicyLimitNotificationText Integer (Default) 2 - Displays
Workspace ONE Boxer
Sender 3 - Generic
notification.
notification (You’ve got a
new email)4 - No
notification
Mark External Addresses

Add the following keys to configure Workspace ONE Boxer to warn the user when adding external recipients to
emails.
Define the domains that

are internal or permitted.
The user can deactivate
the warning using the
Provide the list of internal
‘Confirm before sending’
domains. For example,
AppDomainsInternal String setting in Workspace
[vmware.com, air-
ONE Boxer when the
watch.com].
internal domains are
defined and
AppDomainsWarning key
is not set.

warning when the user
enters recipients from
external domains. If the
domains are configured
and the
False - Deactivated
AppDomainsWarning Boolean AppDomainsWarning
value is set to True, the
‘Confirm before sending’
setting is unavailable to
the users. When the
warning is displayed, the
user can either Accept

and return to the

Compose email menu or
Ignore and continue
sending the email to
external recipients.
If the AppDomainsInternal key is activated and the AppDomainsWarning key is deactivated, then the ‘Confirm
before sending emails’ setting is deactivated and the device user can toggle the setting in the Workspace
ONE Boxer app as per requirement. If the ‘AppDomainsInternal’ key and ‘AppDomainsWarning’ key are
deactivated, then the ‘Confirm before sending emails’ setting is deactivated and the device user can activate
the setting in the Workspace ONE Boxer app as per requirement. If both the AppDomainsInternal and
AppDomainsWarning is set to true, then the ‘Confirm before sending emails’ setting is activated and is
unavailable to the device user.
Allow Local Calendars

Add this key to define the policy for local calendars in Workspace ONE Boxer.

local calendars in
Workspace ONE Boxer. If
True - Activated (default) deactivated, the Local
PolicyAllowLocalCalendars Boolean
False - Deactivated Contacts option in
Workspace ONE Boxer is
unavailable to the end
users.
Default Swipe Actions

Add this key to define the default swipe actions in Workspace ONE Boxer.
Define the default swipe

1 - actions grid 2 - actions. User can
AppSwipesLeftShortDefault
archive 3 - delete 4 - customize swipe actions
AppSwipesLeftLongDefault
Integer move 5 - flag 6 - quick using the options
AppSwipesRightShortDefault
reply 7 - read or unread 8 provided in the
AppSwipesRightLongDefault
- spam Workspace ONE Boxer
app.
Default Conversation View

Add this key to define the default policy for conversation view in Workspace ONE Boxer.


conversation threading
True - Activated (default) by default. When set to
AppConversationViewDefault
Boolean
False - Deactivated False, the conversation
threading option is
deactivated for the users.
Default Avatar Policy

Add this key to define the default policy for avatars in Workspace ONE Boxer.

avatars for initial
configuration. User can
change the Avatar setting
using the options
provided in the
AppAvatarsDefault Boolean Workspace ONE Boxer
False - Deactivated
app. The KVP and setting
affect only the avatars in
the email list. If the KVP
value is set to false, the
avatars in the email list
are hidden.
(iOS only) Allow Custom Keyboards

Add this key to define the policy for allowing third-party keyboards with Workspace ONE Boxer.
True - activate (default

Set to True to permit
value for unmanaged
users to activate third-
PolicyAllowCustomKeyboards
Boolean device) False - deactivate
party keyboards within
(default value for
managed device)
Export Contacts by Default

Add this key to activate or deactivate exporting of contacts by default.
Set to true to enable the

AppDefaultCallerID Boolean exporting of contacts by
False - Deactivated
default. This setting

requires the Caller ID

option in the Workspace
ONE UEM console to be
set as Unrestricted.
Allow Caller ID (Contact Export for iOS)

Add this key to activate or deactivate Export Contact option in Workspace ONE Boxer for end users.
Set to true to activate the

exporting of contacts by
the end users. This
setting requires the
True - Activated AppDefaultCallerID
PolicyAllowCallerID Boolean (default)False - configuration value set to
Deactivated ‘enabled’. If deactivated,
the Export Contacts
option in Workspace
ONE Boxer is unavailable
for the end users.
Note: Boxer contacts exported to iOS devices are not deleted upon an enterprise wipe and are retained in the
device’s native contact list. To trigger the deletion of the contacts from the iOS devices, the end user has to
relaunch Boxer after the enterprise wipe.
Allow Archive
Add this key to activate or deactivate Archive action in Workspace ONE Boxer for end users.
Set to true to enable

archive action by the end
users. If deactivated, the
True - Activated(default)
PolicyAllowActionArchive Boolean Archive option in
False - Deactivated
unavailable for the end
users.
Phishing Reporting
Add this key to enable phishing reporting action in Workspace ONE Boxer for end users.

The reported email is

Any email address that is sent to the email address
AppPhishEmailAddress string
in valid format. specified by the
configuration value.
Restricting Third-Party Attachments

Add these keys to restrict the device user from attaching files to emails from multiple third-party sources.
Activates or deactivates
attachments from
True - activate
external providers
PolicyAllowDocProviders Boolean (default)False -
(iCloud, Dropbox, Google
deactivate
Drive, etc.) within
attaching of files from
other apps using open-in
or share into Workspace
ONE Boxer. When open-
1 - allowed (default) 0 - in or sharing of
PolicyAllowOpenIn Integer
not allowed attachments are
deactivated, the message
‘Your administrator has
restricted attachments
from external
applications’ is displayed.
(iOS Only) True - activate (default) attaching of images and
Boolean
PolicyAllowPhotoAttachment False - deactivate media files from photo
gallery and camera.
Restricting sharing of UNC/HTTP links

Add this key to restrict the sharing of UNC/HTTP links in an email with long tap menu.
True - activate the sharing of UNC/HTTP
PolicyAllowSharingLinks Boolean (default)False - links in an email. If set to
deactivate False UNC/HTTP links
cannot be shared.

Refetch Empty Links

To configure the refetch policy for non-standard URL schemes, add the following key value pair:
For emails (fetched using

HTML) that contain non-
standard URL schemes,
pointing to non-server
domains, Exchange
True - Activated False -
replaces the URL with
Deactivated Note: The
two empty spaces. You
default value on iOS is
AppRefetchEmptyLinksUsingMime
Boolean can enable the
True, whereas the default
PolicyRefetchEmptyLinksUsingMime
value on Android is
key to detect this
False.
occurrence and
redownload the affected
body using MIME, which
is not subject to the URL
replacement error.
Modern Authentication
To enable modern authentication for Office 365 accounts, add the following key value pair:
modern authentication for
Office 365 accounts.
False - deactivate When enabled, during
AccountUseOauth Boolean
(default)True - deactivate enrollment, users are
redirected to the login
page for entering email
password.
Workspace ONE Boxer also supports Certificate-Based Authentication with Modern Authentication (CBA with
Modern Authentication).
Note:
• Modern authentication is enabled by default for personal (non-managed) Exchange accounts.
You must set the following authentication types in addition to the AccountUseOauth key to support the modern
authentication:
• Set the authentication type to Basic and add the key for Modern Authentication with password.

• Set the authentication type to Certificate and add the modern authentication key with only authentication
certificates or set the authentication type to Both and add the modern authentication key with both
authentication certificate and password.
Note: These types of authentication only work when MDM is deployed on iOS Boxer. Boxer for Android
supports both MDM and MAM.
Certificate-Based Authentication with Modern Authentication

With Certificate-Based Authentication (CBA), users authenticate with the Exchange Server with the configured
certificates eliminating the need to enter a password or a security token.
Note: Certificate-Based Authentication with Modern authentication is not supported for personal (non-
managed) Exchange accounts. Standalone Boxer configurations are supported.
To achieve certificate-based authentication, you must configure either of the following:
• Device Profile
You must configure the authentication certificates and the other certificates for installation on the device when
the end user enrolls the device using Workspace ONE Intelligent Hub. When the device profile installs during
enrollment, the certificates installs in the iOS device certificate store. When Boxer launches Modern
authentication, the installed certificates authenticate the users.
Note: The device profile cannot be installed on the device during Boxer Standalone enrollment and hence is
not supported.
• Boxer Profile
You must configure the authentication certificates for Boxer on the assignment page under Email Settings >
Authentication. Boxer fetches the configured certificates and saves them in the database, and uses them for
authentication. Here, there is no dependency on the iOS device certificate store for authentication certificates.
Thus, all enrollment types, including Boxer Standalone enrollment, are supported.
Note: You must add the configuration key AccountUseWebviewForOauth and set it to True. This key allows
Boxer to use the configured authentication certificate and allow authentication flows using WKWebView
instead of SFSafariViewController. If using PIV-D for certificates, you must configure PIV-D before launching
Boxer.
modern authentication for
AccountUseOauth Boolean Exchange server on-
Deactivated (default)
premises or Office 365
accounts.
When set to True, the

oauth flow is presented
True - Activated False - using a WKWebView
AccountUseWebviewForOauth
Boolean
Deactivated (default) instead of
SFSafariViewController.
Note: The


AccountUseWebviewForOauth
key can be applied for
managed accounts on
Exchange server On-
Premise or Office 365.
When the authentication

type is set to certificate
and if the authentication
certificate is configured
for Exchange Server,
AuthenticationType String Certificate
certificate-based
authentication is
automatically enabled
and authenticates the
user.
OnlineMeetingsCBAEnabled is an account-based KVP used for modern authentication from Workspace ONE
Boxer for Android to Microsoft Teams and Zoom Meetings.
Note: Workspace ONE Boxer for iOS does not require the OnlineMeetingsCBAEnabled KVP when
authenticating to Microsoft Teams and Zoom meetings.
When activated,
certificate-based
authentication is used for
end-user authentication
OnlineMeetingsCBAEnabledBoolean instead of username and
Deactivated
password when the end
user is redirected to
Microsoft Teams and
Zoom Meetings.
To use CBA (Certificate-Based Authentication) instead of username and password for Microsoft OneDrive
authentication, EnterpriseContentCBAEnabled KVP is used.
Note: Workspace ONE Boxer for iOS does not require the EnterpriseContentCBAEnabled KVP when
authenticating to Microsoft OneDrive.
When the feature is

activated, Workspace
ONE Boxer uses
False - Deactivated True
EnterpriseContentCBAEnabled
Boolean Certificate-Based
- Activated (default)
Authentication for the
end user instead of
username and password

when authenticating to
Microsoft OneDrive.
Allow User Agent based Authentication Policy for Boxer Android

In scenarios that involve a third-party identity provider (IdP), Boxer authentication on Android devices can fail if
the IdP does not identify the specific user agent for Boxer. The user during authentication gets redirected to
the sign-in page where the OAuth flow is presented using the native browser’s webview. The user agent
shown to the IdP is of the browser instead of Boxer. As a result, the IdP blocks the authentication.
Add the following key to allow Boxer to use the Boxer-specific WebView UserAgent instead of the browser
user agent.
Set the value to true for

the Boxer app to set and
AppBoxerUserAgentInOauthWebView
Boolean use the Boxer-specific
- Activated
WebView UserAgent
during OAuth.
Note: The AppBoxerUserAgentInOauthWebView key can be applied for managed accounts on Exchange
server On-Premise or Office 365.
Enable Umlaut Characters in Login Password on Android Devices

By default, Workspace ONE Boxer uses UTF-8 decoding while authenticating users. Boxer’s authentication
fails if your Exchange password contains umlaut characters (ä, Ë, ë, Ï, ï) as UTF-8 does not support these
characters.
To support umlaut characters, add the following key to change Boxer’s encoding from UTF-8 to ISO-8859-1.
Set the value to true to

change the Boxer
False - Deactivated
EnableNewAuthEncoding Boolean encoding to ISO-8859-1
(default)True - Activated
that supports umlaut
characters.
Downloading Attachments
Add this key value pair to activate or deactivate downloading of attachments.

True - activate (default)
PolicyAllowAttachmentsDownload
Boolean downloading of
False - deactivate
attachments.
Managing Attachments
Add this key value pair to activate or deactivate attachments for sending mails..
True - activate (default)
PolicyAllowAttachments Boolean attachments for sending
False - deactivate
mails.
Spam Reporting
Add the following configuration keys to forward a spam marked email to the configured address and then
delete the email from the user’s account once it has been forwarded to the configured address.
Set the email address

Valid email address
AppSpamForwardAddress String where spam emails are
[email protected].
sent.
Set to delete the spam

False - deactivate
PolicyDeleteOnSpamForward
Boolean email from the user’s
(default)True - activate
device after forwarding.
Set to true to enable

spam action by the end
users. If deactivated, the
PolicyAllowActionSpam Boolean Spam option in
False - Deactivated
unavailable for the end
users.
(Android Only) Activate SSO

If SSO is enabled in Security Policies, enable Application uses AirWatch SDK and assign the following
application configuration key to add SSO functionality for Workspace ONE Boxer. For using SSO functionality
in Workspace ONE Boxer Android, you must have Workspace ONE console version 9.0.5 or above.
True - activate False -
AppForceActivateSSO Boolean SSO for Workspace
deactivate
ONE Boxer. Enterprise

Content requires this

value to be set to true.
Note:
• You can enable the AppForceActivateSSO key and configure SSO in the Workspace ONE UEM console.
For more information about SSO, see Configuring Security Policies in the Manage Apps with SDK
Settings documentation at Omnissa Product Documentation.
• To run the mobile SSO authentication smoothly on your Android device, make sure you use the latest
version of Chrome.
Health Check - Boxer Version update for iOS devices

Add the following console key to alter the app opened when the user taps to update Boxer.
Set the value to 1 to

change the default app
0 (default) - App Store 1 - opened when the user
AppUpdateSource Integer
Intelligent Hub taps to update Boxer
from the Health Check
screen.
QuickJoin - Vanity URL Support

To configure Boxer to detect meeting links with vanity URLs, add the following key in the Boxer’s application
configuration.
Set these URLs in the

console corresponding to
A JSON formatted string
the meeting types to
containing a map of the
permit Boxer to detect
PolicyCustomOnlineMeetingUrls
String meeting types and
meeting links with vanity
corresponding set of
URLs.Validate the format
wildcard URLs.
externally before entering
into the UEM Console.
Example of a configuration value:
{ "skype":[
"https://lync.company.com/*",
"https://sample.us/j/*"
],
"zoom":[
"https://meetings.company.com/*",

"https://sample.us/j/*",
"https://mtg.company.com/*"
],
"webex":[
"https://webex.company.com/*"
]
}
Browser Exception List

You can use the AppDefaultBrowserExceptions key to create exception lists for hyperlinks when hyperlinks
are Restricted or Unrestricted in the Workspace ONE UEM console.
You can configure the key value pairs to support the following functionalities:
• If hyperlinks are restricted in the Workspace ONE UEM console, all links open in Workspace ONE Web.
• If hyperlinks are restricted, but has an exception list, all available browsers are displayed but only links in
the exception list opens in the default browser.
• If hyperlinks are unrestricted in the Workspace ONE UEM console, all available browsers are displayed
and all links open in the default browser.
• If hyperlinks are unrestricted in the Workspace ONE UEM console, but has an exception list, all available
browsers are displayed and the links in the exception list only opens in Workspace ONE Web.
AppDefaultBrowserExceptions
Creates an exception list
= [“.acme.com”, to restrict and unrestrict
AppDefaultBrowserExceptions
String “acme.acme1.com”, specific links from
“source.acme.com”, opening in the default
“acme.com”] browser.
Note: If the browser exception regex value is set to *google.com and the user receives a link in Boxer such as
https://www.gooogle.com, then this link opens in Workspace ONE Web application as it matches the wildcard
for browser exception. However, if the link is like https://www.abc.com/?url=https://www.google.com/, then the
regex fails to match and the link can be open in any of the browser.
Enterprise Content
To configure Enterprise Content in Boxer, add the following key to Boxer’s application configuration.

True - activate False -
PolicyAllowEnterpriseContent
Boolean configure Enterprise
deactivate
Content in Boxer.
Note: Enterprise Content requires setting the key AppForceActivateSSO to true. AppForceActivateSSO is
supported in Workspace ONE Boxer for Android only. For more information about configuring SSO, see
Configuring Security Policies in the Manage Apps with SDK Settings documentation at Omnissa Product
Documentation.

Watermark Support
You can add a customized watermark text that covers sensitive areas in Boxer.
To configure the watermark, add the following keys to Boxer’s application configuration.
Example Configuration
Configuration Key Value Type Description
Value
Defines the watermark

PolicyWatermarkText String CustomWatermarkText
text.
(Optional) Defines the

opacity of the text.You
PolicyWatermarkOpacity Integer 20 (default)
can set any number from
0 through 100.
(Optional) Defines the

color of the text in the
PolicyWatermarkColor String #0079B8 (default)
hexadecimal format.Blue
is the default color.
Note: Ensure that the watermark text has appropriate visibility in Dark Mode or Dark Theme when you set the
color and opacity value different from the default value.
Security Classifications
Enable Email Classification Marking to assign security classifications to the emails sent from Workspace
ONE Boxer. Assign the following application configuration keys and values to enable Email Classification
Marking feature:
Note: Email classification is a supported feature in Delegated and Shared Accounts.
0 - deactivate (default) 1 - Activates or deactivates

PolicyClassMarkingsEnabled
Integer
activate classification markings.
(Optional) Enables and

defines x-header for
classification. Note:
Boxer sends the x-
PolicyClassMarkingsXHeader
String x-header-name
headers on email replies
or email forwards but not
with SmartForward or
SmartReply commands.
Version number for

PolicyClassVersion String 1.0
classification feature.
(Optional) Enables
0 - deactivate (default)1 -
PolicyClassMarkingsRankEnabled
Integer hierarchical classification
activate
ranking.

(Optional) Set the default

classification for emails.
The value must match a
Confidential, Restricted,
PolicyClassMarkingsDefaultClass
String display name from an
Protected, or Secret
entry in the
PolicyClassMarkings
configuration value.
PolicyClassMarkings Defines the hierarchical

PolicyClassMarkings String
Configuration Value list of classifications.
PolicyClassMarkings Configuration Value
[{
"Rank": 4,
"DisplayName": "Secret",
"Description": "This is secret...",
"Subject": "(Secret)",
"TopBody": "Classification: Secret",
"BottomBody": "Classification: Secret",
"XHeader": "Secret"
}, {
"Rank": 3,
"DisplayName": "Restricted",
"Description": "This is restricted...",
"Subject": "(Restricted)",
"TopBody": "Classification: Restricted",
"BottomBody": "",
"XHeader": "Restricted"
}, {
"Rank": 2,
"DisplayName": "Protected",
"Description": "This is protected...",
"Subject": "[Sec=Protected]",
"TopBody": "",
"BottomBody": "Classification: Protected",
"XHeader": "Protected"
}, {
"Rank": 1,
"DisplayName": "Confidential",
"Description": "This is confidential...",
"Subject": "(Confidential)",
"TopBody": "Classification: Confidential",
"BottomBody": "Classification: Confidential",
"XHeader": "Confidential"
}]
Enforce Users to Classify Emails

After you enable the email classification marking feature, you can further add a key to force your users to set
an appropriate classification to the emails they compose.
When the user attempts to send a message without a classification, Boxer prompts the user to select one, only
after which the user is allowed to send the email.
Set the value to 0 to

allow the user to send
emails without selecting a
0 (default) - Deactivated classification. Set the
PolicyClassMarkingsRequired
Integer
1 - Activated value to 1 to force the
user to select a
classification before they
can send the email.
Enforce Users to Classify Emails for External Recipients
You can force your users to set an appropriate classification to the emails they want to send to email recipients
outside of the organization. As a prerequisite, ensure the email classification is enabled and configured in the
UEM console.
When the user attempts to send a message to an external recipient without a classification, Boxer prompts the
user to select one, after which the user is allowed to send the email.
Set the value to 2 to send

emails to external
PolicyClassMarkingsRequired
Integer 2 - Activated
recipients with
classifications.
Restrict Screenshots in Boxer on Android Devices

Add the following key to restrict Android device users from taking screenshots in Boxer:
False - screenshots Set the value to true to

PolicyRestrictScreenshots Boolean allowed (default) True - restrict taking of
screenshots restricted screenshots in Boxer.
Skipping the In-App Tutorial (Block FTUE screen)

First Time User Experience (FTUE) screens and prompts can be deactivated using the
AppShowFirstTimeTutorials KVP.

Set the value to false to

AppShowFirstTimeTutorialsBoolean deactivate the in-app
False - Deactivated
tutorials.
Skipping the Battery Optimization Screen in Android Boxer

Add the following key to Boxer’s application configuration:
Set the value to false to

AppShowOptOutBatteryOptimizationScreen
Boolean skip the Battery
False - Deactivated
Optimization screen.
(iOS only) Enhance Modern Authentication Enrollment

To streamline the enrollment process, administrators can use the AccountAllowSplashScreenAutomaticSignIn
KVP to control automation of the Workspace ONE Boxer’s authentication screen. When the KVP is configured
to true, the enrollment process is automated by activating an automatic sign in on the OAuth splash screen. As
a result, an end user need not explicitly tap the Sign in button on the screen.
Set to true, Workspace

ONE Boxer displays an
automatic sign in on the
False - Deactivated
AccountAllowSplashScreenAutomaticSignIn
Boolean OAuth splash screen and
the end user need not
explicitly tap the Sign in
button.
Deactivate Plain Text in Emails on Android Boxer

The inline style elements in an email are displayed as plain text when the email is protected with S/MIME. Add
the following configuration key to display the inline elements in rich text format. This key when added overrides
the plain text setting.

True - Activated False - deactivate plain text
AppEnableSMIMEStyling Boolean
Deactivated (default) format and enable rich
text format.
Enable Autofill in Boxer for an Office 365 Account

To automatically prefill the user’s credentials (user name or email address) in a pop-up authentication window
of Office 365, add the following key:

By default, the key value

is 1. Based on your
preferences, set the
value to 1 to prefill the
0 - None 1 - Email
PolicyPrefillCredentialsPopUp
Integer user’s email address or 2
(default) 2 - User name
to prefill the user name.
Users can edit the
prefilled email or user
name.
Block External Images in Email on iOS Boxer

Add the following key to block loading of the external images in the email on iOS devices.
By default, the external

images are loaded in
True - Activated False
PolicyBlockExternalImages Boolean emails. Set the value to
(default) - Deactivated
true to prevent loading of
external images.
Note: The PolicyBlockExternalImages key can be applied for managed accounts on Exchange server
On-Premise or Office 365.
If the configuration key is not set, users can block the external images from Boxer’s Settings > Mail > More >
Block external images. The images are not displayed but the users can still view the images by tapping the
Show images button in the email bar. The configuration key when set to true overrides the user’s setting.
Enable Security Warning for External Links in Workspace ONE Boxer

External links in emails can sometimes lead to phishing attacks and expose users to malicious websites. To
provide a safe browsing experience to Boxer users, as an admin, you can add multiple domains or IP
addresses as an allowlist. Subdomains and directories are part of the main domain.
When the user taps on a link in the Boxer email that is not in the allowlist, the user sees a warning message. If
the user consents, the user navigates to the link. If the user disapproves, the warning disappears, and the user
stays on the email.
Note: The ExternalLinksAllowlist key can be applied for managed accounts on Exchange server On-
Premise or Office 365.
Use the following key and add the URLs that must be considered as an allowlist.
The string accepts URLs

Provide the list of URLs.
ExternalLinksAllowlist String and serves the role of an
For example,
allowlist.

[“acme.com”, “abc.com”,
“xyz.com”]
Enable AIP Sensitivity Labels in Workspace ONE Boxer

Add the following key to the Boxer’s application configuration.
Set the key value to true

False - Deactivated to enable the AIP
PolicySensitivityLabelsEmailClassification
Boolean
(default) True - Activated Sensitivity labels in
Item Operations Sync for IRM Templates

Add the following key value pair for Item Operation sync for IRM templates. This KVP is set on an account
level.
NOTE: - You must have a managed account on Exchange server On-Premises. - You must have enabled IRM.
When activated,
Workspace ONE Boxer
False - Deactivated
PolicyRefetchRMSTemplateUsingItemOperations
Boolean stores the IRM template
in the Item Operations
request.
Derived Credentials
Add these keys to enable derived credentials authentication policies for Workspace ONE Boxer. If PIV-D is
selected as a certificate provider, the device users must install PIV-D Manager application for enrolling into
Note: To enable S/MIME, you must configure the PolicySMIME key.
The default value of this

key is 0. To enable
derived credentials, set
the value to 1.(Android
0 - Deactivated1- PIV-D 2
PolicyDerivedCredentials Integer Only)To configure
- Purebred (Android only)
Purebred as a certificate
source for Certificate-
based authentication
(CBA), set the value to 2.

By default, the value of

this key is 0 and the
certificate source is the
Workspace ONE UEM
Console. To configure
PIV-D as the certificate
0 - Deactivated 1- PIV-D
source for S/MIME
PolicyDerivedCredentialsSMIME
Integer 2 - Purebred (Android
certificates (signing and
only)
encrypting), set the value
to 1.(Android Only)To
configure Purebred as a
certificate source for S/
MIME certificates, set the
value to 2.
Configure Android Boxer to Verify Purebred

Security is at risk if a malicious app pretends to be the Purebred app. Boxer uses the public signing key from
the Purebred app to verify app communication to mitigate such security concerns.
Since Purebred is not a Play Store app, if Purebred changes the signing key, the admins can override the
signing key using the AppPurebredPublicKey configuration key. Boxer uses an additional configuration key to
verify the package name of the trusted Purebred app.
Use this key to override

the Purebred public
A new Purebred public
AppPurebredPublicKey String signing key to verify the
signing key.
Purebred Registration
application.
Sets the trusted Purebred

The package name of the
AppPurebredPackageNameString package name to verify
trusted Purebred app
the app.
Note:You must configure both the keys for Boxer to perform trust check on the Purebred app available on the
device.
Excluding Sender’s Email Signature from the Conference Dialer

Add the following key to exclude the phone numbers displayed in the sender’s email signature when viewing
the OneTap dialing section of a calendar invite.
When the key value is set

False - Deactivated
AppExcludeSignatureFromEventParsing
Boolean to True, the phone
numbers in the sender’s

email signature is
removed from the
OneTap dialing section of
a calendar invite.
Enable Microsoft Teams Meetings

Add the key value pair to show the Team Meetings toggle button in the New Event screen when creating a
new calendar event. When enabled, you can see the toggle button to add the Teams Meeting to your calendar
invites.
Set to True to show the

Team Meetings toggle
EnableTeamsOnlineMeetings
Boolean button. Set to false to
Deactivated (Default)
hide the Teams Meetings
toggle button.
Note: You must use Modern Authentication, EWS, and Exchange Online (Office 365) to show the Teams
Meetings toggle. In Azure, administrators must allow access to the Teams app and provide consent on behalf
of users in the tenant. If you do not do so, each user must manually consent for the first time when a creating a
Teams meeting. This is only for regular meetings that include audio, video and screen sharing for up to 250
people. We do not currently support Teams live events.
Create Online Meetings for Zoom

As a prerequisite, ensure that cloud ENS (Email Notification Service) is enabled.
Add the key value pair to show the Zoom meeting toggle button in the New Event or Edit Event screens. With
the toggle button turned on, when a user creates or edits a meeting event, a Zoom link is automatically created
along with the other meeting details.
Note: When the user tries to create a meeting for the first time, user is prompted to authenticate in Zoom with
their credentials.
Set to True to show the

EnableZoomOnlineMeetingsBoolean Zoom meeting toggle
Deactivated (Default)
button.
(iOS only) Native Share Sheet

This feature allows Workspace ONE Boxer users to send images, videos, links, files, and text directly from any
native iOS application to Workspace ONE Boxer. By default, this feature is deactivated.
To activate the feature, set the following key value to true:

Set to True to allow users

to send images, videos,
links, files, and text
PolicyAllowNativeShare Boolean directly from native iOS
Deactivated
application to Workspace
ONE Boxer. By default,
the value is False.
(iOS only) Calendar Widget

This feature displays upcoming events of a user in a widget.
To activate the feature for managed devices, set the following key value to true:
Set to True for users to

view their events in a
Workspace ONE Boxer
Calendar Widget when
PolicyAllowCalendarWidgetBoolean the users have added the
Deactivated
calendar widget to their
home screens. By
default, the value is
False.
(Android only) Debug Logs

When having issues with Workspace ONE Boxer, this feature allows users to send logs directly to their IT
administrators or support teams without the necessity of being aware of their email address. Administrator can
configure the KVP value with the desired email address that must receive the debug logs.
Debug logs are directly

sent to the email address
SupportEmailAddress String Email address
configured as the KVP
value.
Resource URL for ENS (Email Notification Service)

PolicyENSResourceURL is an account-based KVP, used only for hybrid modern authentication with Resource
URL and not the O365 URL. When the KVP is enabled, administrators can configure a specific Resource URL.
To fetch the oAuth access token, Workspace ONE Boxer and ENS must use the configured Resource URL.
Hence, Workspace ONE Boxer must share the Resource URL with ENS as part of the register request
payload.

Used by Workspace ONE

Boxer and ENS to fetch
the OAuth access token
for hybrid modern
PolicyENSResourceURL String URL authentication with
Resource URL, which is
different from the O365
URL. For now, this KVP
supports only cloud ENS.
Resource URL for Authentication

AccountOauthResourceURL is an account-based KVP which can be used with hybrid modern authentication
when a specific Resource URL is required. During end-user authentication, when this KVP is configured, the
value of this KVP is used with more priority even if auto discover presents a valid Resource URL.
A valid URL for

AccountOauthResourceURLString URL
authentication
Configuration for Microsoft 365 Enterprise Application Authentication

When Workspace ONE Boxer is added to the Microsoft 365 Enterprise Application, the following Custom
Account Configuration KVPs - Office365OAuthClientID and Office365OAuthTenantID - must be added in the
Workspace ONE UEM console. To add the KVPs, navigate to the Boxer- Assignment -> Email Settings
screen in the Workspace ONE UEM console.
Predetermined, client ID
Office365OAuthClientID String ID for Workspace ONE
Boxer
Tenant ID in the Microsoft

Office365OAuthTenantID String ID 365 Enterprise
application
Add Shared Mailbox with Hybrid Modern Authentication Support

When using hybrid modern authentication, end users can add shared mailboxes in Workspace ONE Boxer.
This is an account-level KVP.

Set to true, end users

False - Deactivated can add shared
PolicyEnableHybridModernAuthEWS
Boolean
(default) True - Activated mailboxes with hybrid
modern authentication.
For information, see this KB article: How to enable hybrid modern authentication in Workspace ONE Boxer.
(Android only) Conditional Access Policies

When this KVP is enabled, administrators can set Azure Conditional Access Policies and apply these policies
through Workspace ONE Boxer. This is an account-level KVP.
NOTE: In addition to enabling the KVP, you must configure Microsoft Azure and Workspace ONE UEM
console with few other settings so that both components get integrated. This integration results in adding the
support for Azure Conditional Access Policies in Workspace ONE Boxer. For information about configuring
Azure and Workspace ONE UEM console, see Configure Support for Azure Conditional Access Policies in
Workspace ONE Boxer section in Workspace ONE Boxer Deployment Workspace ONE Boxer Deployment.
When the feature is

activated, administrators
can set the Conditional
Access Policies in
Microsoft Azure. With
these policies,
False - Deactivated
ConditionalAccessEnabled Boolean administrators can
restrict end user access
to their organisation’s
Office 365 Exchange
Online Server only
through Workspace ONE
Boxer.
(iOS only) Low Network Detection

When a slow network is detected for 10 milliseconds, Workspace ONE Boxer notifies the end user about such
low network conditions with a banner on the Inbox screen. This banner can be turned off by using the
AppEnableLowNetworkDetection KVP.
When the feature is

activated, Workspace
ONE Boxer notifies the
AppEnableLowNetworkDetection
Boolean end user about low
- Activated (default)
network conditions by
displaying a banner on
the Inbox screen. When

the KVP is set to false,

the end user stops
receiving the notification.
(iOS only) Configure Email Search Mode

Administrators can control the search mode configuration using the AccountEmailSearchMode KVP. This is an
account-based KVP.
Prerequisite: This feature requires EAS (Exchange ActiveSync) 16.1 or later.
To allow an extensive
search, set the value to
0. This search mode
shows more details such
as attachments and
events of each email
listed in the search result.
0 (default) - Extensive These emails are shown
AccountEmailSearchMode Integer
Search 1 - Quick Search in threads. To allow a
quick search, set the
value to 1. This search
mode returns a list of
results in just a few
seconds, hence this
mode is faster than the
extensive search mode.
Note: In the earlier versions of EAS, the default search mode is applied.
End users can choose the desired search mode from the Settings menu in the Workspace ONE Boxer
application for each user account.
Important Notes
If a user has changed any settings on the Boxer application, as an administrator you cannot modify the
following console keys:
• AccountDefaultSignature
• AccountName
• AccountUserDisplayName
• AccountSyncEmail
• AccountSyncCalendar
• AccountSyncContacts
• AccountNotifyEmail
• AccountNotifyCalendar
• AccountNotifyPush

Boxer maintains a flag indicating whether the setting has been changed. Even if the user changes the local
setting identical to default, Boxer still treats it as a user change. If a local change is not made by the user, the
updated console configuration is used.
Note: Any configuration changes for Boxer made on the console takes around 15 minutes to reflect the
change on the device.

DISA Purebred Support for Workspace ONE Boxer

Purebred is a mobile application developed and managed by the Defense Information Systems Agency
(DISA). It offers a secure and scalable way to distribute certificates on compatible mobile devices.
For Workspace ONE Boxer on Android, the Purebred Registration application acts as a certificate delivery
source. The Purebred Registration application helps Workspace ONE Boxer to use the Purebred PIV-D
certificates for authentication and S/MIME functionality (signing, encryption, or both). This application stores its
certificates in the Android KeyStore and shares the alias information of the certificates with Workspace ONE
Boxer.
With Purebred as a certificate source for Workspace ONE Boxer, you can configure Workspace ONE Boxer in
the following authentication modes:
• Certificate-based authentication (CBA)

• Certificate-based authentication using modern authentication
• Dual factor authentication (DCBA)
Set Up PIV-D as Your Derived Credential Provider on Workspace ONE

Boxer for iOS
Workspace ONE Boxer for iOS supports Workspace ONE PIV-D Manager application instead of the Purebred
Registration application for the derived credential certificates. You must have set up DISA Purebred application
on your iOS device and set up PIV-D to use the Purebred app as certificate provider. Later, you must set up
PIV-D as a credential provider in the UEM console for Workspace ONE Boxer to support Purebred as a
certificate source.
For more information about how to configure DISA Purebred in the PIV-D Manager application, see the How to
Configure DISA Purebred section in the Workspace ONE PIV-D Manager documentation.
Historical S/MIME certificates are also supported.
The method of configuring Workspace ONE Boxer to use PIV-D Manager application as a source for derived
credential certificates depends on the Workspace ONE UEM console version used.
If you use Workspace ONE UEM console version 2003 or earlier, configure the following key-value pairs:
• PolicyDerivedCredentials - Enable this key to use the PIV-D Manager application as a certificate source
for Certificate-based authentication (CBA).
• PolicyDerivedCredentialsSMIME - Enable this key to use the PIV-D Manager application as a certificate
source for the S/MIME certificates (signing or encryption).
For more information about the key value pairs, see Application Configurations for Workspace ONE Boxer.
If you use Workspace ONE UEM console version 2004 or later, you must perform the following steps to
configure Workspace ONE Boxer:
1. Enable PIV-D for Certificate-based authentication.
a. In the Boxer Assignment screen, navigate to Email Settings > Authentication.

b. Set the authentication type to Certificate.
c. Select PIV-D as Derived Credentials.
2. Enable PIV-D for S/MIME certificates.
a. Navigate to Email Settings > S/MIME and add the certificate source as Derived Credentials.
b. Select PIV-D as an issuer name.
Set Up Purebred as Your Derived Credential Provider on Workspace ONE

Boxer for Android
Configure Workspace ONE Boxer to support Purebred as a certificate source for the managed Android
devices.
In addition to setting up Purebred as the derived credential provider, you must verify the Purebred Registration
application and enroll Workspace ONE Boxer for Android with DISA Purebred.
For Workspace ONE Boxer to use PIV-D Manager application as a source for derived credential certificates,
you must configure Workspace ONE UEM console version 2003 or earlier with the following key-value pairs:
• PolicyDerivedCredentials - Enable this key to use the Purebred Registration application as a certificate
source for Certificate-based authentication (CBA).
• PolicyDerivedCredentialsSMIME - Enable this key to use the Purebred Registration application as a
certificate source for the S/MIME certificates (signing or encryption).
For more information about these keys, see the Derived Credentials section in the Application Configurations
for Workspace ONE Boxer topic.
If you are deploying Boxer using the Workspace ONE UEM console version 2004 or higher, you must apply
the following steps:
1. Enable Purebred for Certificate-based authentication.
a. In the Boxer Assignment screen, navigate to Email Settings > Authentication > Advanced.
b. Set the authentication type to Certificate.
c. Select Purebred as Derived Credentials.
2. Enable Purebred for S/MIME certificates.
a. Navigate to Email Settings > S/MIME and add the certificate source as Derived Credentials.
b. Select Purebred as an issuer name.
Verifying Purebred Registration Application

Android has the ability to install applications through sideloading, which can be an easy way for any
unauthorized application to act as Purebred and get installed on the device. To mitigate such security risk, you
can configure Workspace ONE Boxer to authenticate the Purebred Registration application using the Purebred

public signing key. To do so, you must enable the AppPurebredPublicKey KVP in the Workspace ONE UEM
console. When enabled, this key can easily override the signing key because Purebred is a non-Play Store
application.
For more information about the AppPurebredPublicKey KVP, see the see the Configure Android Boxer to
Verify Purebred section in the Application Configurations for Workspace ONE Boxer topic.
Enroll Android Boxer with DISA Purebred

User must configure Workspace ONE Boxer to access the Purebred Registration application and grant access
to each certificate that is installed on the device using Purebred. The Purebred Registration application installs
the derived credential certificates directly in the device trust store.
Ensure that your device is registered with the Purebred Registration application and all the certificates are
installed on your device.
1. When you launch the Boxer application, Tap Ok to allow Boxer to access the Purebred Registration
application to fetch all the certificate-related data. You can view the list of certificates that Boxer requires
upon tapping.
2. For each certificate, tap Grant Access. You must grant access to all the listed certificates. After you
grant access to all the listed certificates, an Android driven dialogue box pops up with the pre-selected
certificate. If you do not see any pre-selected certificate, it means that either of the following things has
happened:
◦ Certificates are missing from the trust store of your Android device.
◦ Inconsistent certificate names.
◦ The Original Equipment Manufacturer (OEM) has truncated the alias of the certificate. This
scenario is common in Samsung devices, where the device truncates the certificate alias length to
50 characters and save it in the device trust store.
◦ If Knox Container is enabled and certificates are installed into the container, then Knox appends
Knox to the name of the certificate.
3. To view the certificate details, Tap View certificate.
4. To select the certificate you want to use for authentication, tap Next. If your admin has configured Boxer
to use Purebred for S/MIME, you only have to grant access to the certificates, and after all the
certificates have been granted, the screen closes automatically.
5. On the Authentication Certificate Picker screen, you can use select another certificate to authenticate
your account if you do not want to use the pre-selected certificate.
6. To continue with the rest of the Boxer’s onboard process, tap Next. Note:
◦ If you have picked an incorrect certificate, you can return to the authentication certificate picker
screen and adjust it to the correct one by using error handling process. But If your Boxer is
configured for modern authentication, you can tap Back and select the right certificate.
◦ Android can revoke access to certificates. This revocation might occur due to the following
reasons:
▪ The certificates are missing from the device trust store.
▪ You have reinstalled the deleted certificate.

▪ Android revokes permission. The Boxer application notifies you when it is unable to access
the certificate in the device trust store. You can give Boxer access to the certificate by tapping
the notification.

Calendar and Mailbox Delegation in Workspace ONE Boxer
Calendar and Mailbox Delegation in Workspace

ONE Boxer
This topic provides information about calendar and mailbox delegation in Workspace ONE Boxer for
both the platforms, iOS and Android.
Requirements for Calendar and Mailbox Delegation

To enable the Calendar and Mailbox Delegation feature in Workspace ONE Boxer, ensure that you have the
following requirements:
• The Exchange server versions required are as follows:

◦ Calendar delegation - Microsoft Exchange Server 2010 or later
◦ Mailbox delegation - Microsoft Exchange Server 2013 or later
• Ensure that the authentication type used is the same for both Exchange Web Services (EWS) and
Exchange ActiveSync (EAS).The following authentication types are supported for Calendar and Mailbox
Delegation:
◦ Modern Authentication
◦ Basic Authentication
◦ Certificate-Based Authentication
• Ensure that EWS is enabled on your Exchange Server.
• If you are using Secure Email Gateway (SEG), ensure that EWS is enabled in the application.properties
file, which is available in the SEG Config folder.For more information about enabling EWS on SEG, see
the Configure the SEG V2 EWS Proxy for Email Notification Service topic in the Secure Email Gateway
(SEG) V2 documentation.
• If Email Notification Service 2 (ENS2) is not enabled in your environment, then ensure that the EWSUrl
key is added to the Workspace ONE Boxer’s application configuration in the Workspace ONE UEM
console.For more information about configuring the EWSUrl key, see the ENS2 Application Configuration
Keys topic in the Email Notification Service 2 (ENS2) documentation.
• Ensure that the delegator and delegates are present in the same Active Directory.
• To use delegated and shared accounts in Workspace ONE Boxer, a delegator must grant permissions to
the delegate’s account.To grant these permissions, Exchange admin center (EAC), Exchange
Management Shell, or Outlook mail for desktop or web can be used. It is recommended to use Exchange
admin center (EAC). EAC is a web-based management console, which is supported in Exchange Server
2013 and later. The Exchange Management Console (EMC) or the Exchange Control Panel (ECP) can
be used for earlier versions of Exchange Server.
Calendar Delegation for Workspace ONE Boxer

Calendar Delegation enables you to grant permission to an employee for handling meeting requests on behalf
of another employee through the Calendar screen.
When configuring Calendar Delegation, you must determine a delegate and delegator. The delegator is the
original calendar owner. The delegate is the user added to manage the calendar. For example, an executive is
the delegator and the executive assistant is the delegate.
A delegate can perform the following:
• Add a delegated calendar and manage the calendar of the delegator.

• Receive and respond to meeting requests on behalf of the delegator.
Note: Workspace ONE Boxer does not support the sharing of several individual calendars.
Ensure that you are aware of the following considerations:
• Workspace ONE Boxer does not support the delegation of Contacts.

• Delegates cannot access the delegator’s private events unless the delegator provides access.
• As per the limitation of EAS protocol, delegates cannot modify attachments in an exception of a recurring
event.
• In Workspace ONE Boxer for Android, currently, Shared and Delegated calendars can be synced only
manually.
Delegate Calendar
When delegating a calendar, a delegator can determine the level of access that the delegate must have to
their (delegator’s) calendar. Based on these permissions, the delegate can perform different actions on behalf
of the delegator.
Configuring permissions for calendar delegation depends on the Exchange setup that exists in the delegator’s
environment. For information about configuring permissions, the relevant Microsoft documentation can be
considered as a reference.
Manage Delegate Calendar Using Workspace ONE Boxer

With the delegate access, a delegate can read, create, and modify the delegator’s calendar, send, and
respond to meeting requests on their behalf.
NOTE: Prior to managing a delegator’s calendar, the delegator must grant access to the delegate.
A delegate must perform the following steps:
1. Navigate to Boxer Settings > Add account > Add shared account > Select an account and add the
delegator’s email account.
2. Wait for the delegated calendar to sync in the calendar tab.
Note: If the delegate uses an Office 365 account, duplicate calendars might be visible in the delegate’s
calendar screen.
Mailbox Delegation for Workspace ONE Boxer

You can use the mailbox delegation feature to grant access to an employee to handle the Exchange folders of
another employee on their behalf. For example, an executive assistant can manage their executive’s mailbox
based on the permissions set by the executive.
When enabling the mailbox delegation, you must determine a delegate and a delegator. A delegator is the
actual owner of the mailbox, and a delegate is a user added to manage the mailbox. For example, an
executive is a delegator, and the executive assistant is the delegate.
Email classification is a supported feature in shared and delegated accounts. A delegator can set different
permission levels for their delegates to access their mailbox. The permissions are as follows:

• Full Access - Delegates can read and triage a delegator’s emails.

• Send As - Delegates can send emails on behalf of the delegator. For example, a delegate can draft and
send an email directly from the delegator’s mailbox.
A delegator cannot delegate Contacts in Workspace ONE Boxer.
Note: If you are using Exchange Server 2013 or later with the Calendar Delegation enabled in the Exchange
admin center, no additional configuration is required for the Mailbox Delegation.
Manage Someone Else’s Mailbox in Workspace ONE Boxer

After a delegate is granted delegation permission, the delegate can create, update, delete, and copy the
delegator’s Exchange folders. The delegate can also read and respond to emails on behalf of the delegator. To
achieve this, the delegate must add the delegators’ account to Workspace ONE Boxer.
A delegator must grant access to a delegate before the delegate can use the delegator’s mailboxes. To
manage the delegator’s mailbox, the delegate must perform the following steps:
1. Navigate to Boxer Settings > Add account > Add shared account > select an account and add the
delegator’s email account.
2. Enter the delegator’s email address. If a configured delegated calendar already exists, the delegate must
remove the account and add it again.
Note: Initial synchronization of large email accounts might take a longer time. To speed up this process, the
Workspace ONE Boxer application must be kept open. Currently in Workspace ONE Boxer, the sync window
for shared or delegated accounts is the same as the sync window of the primary account.
Adding a Shared Mailbox and Calendar to Workspace ONE Boxer

Workspace ONE Boxer for iOS and Android gives the user the ability to add a shared account that the user
has access to and perform collaborative actions on that account based on the allotted permission.
A shared account is an account that lets multiple users send and receive email messages from a common
email address. This feature is useful for a team that manages a general mailbox to address customer queries.
Based on the permissions set by an admin, the end user can access a shared account with email messages
and calendar invites and can send events and emails as the account. A shared account also provides a
common calendar, allowing members to create, read, update, and delete events or check availability.
An end user can add a shared account by navigating to Boxer Settings > Add account > Add shared
account. A shared account does not have a password, so the user cannot log in to it directly. The user can
add a member to a shared account and use the Exchange admin centre to grant the following permissions:
• Full Access: Allows the user to access the shared account. User can create calendar items, read, view,
delete, and change email messages, create tasks and calendar contacts. User can send an email from
the shared account using the Send As permission.
• Send As: Allows the user to impersonate a shared mailbox when the user sends an email. For example,
when a user replies to a message sent to the shared mailbox, the email appears to be from the shared
mailbox, and not from the user’s email address.

Secure your Emails and Documents with Azure Information Protection (AIP) Sensitivity labels in Workspace ONE Boxer
Secure your Emails and Documents with Azure

Information Protection (AIP) Sensitivity labels in
Workspace ONE Boxer
With Azure Information Protection (AIP), you can secure your emails and documents that you exchange within
or outside your organization.
Microsoft Azure is a public cloud computing platform developed to provide a set of cloud services to address
your business challenges. It gives you the ability to build, manage, and deploy applications across a massive
global network using your favorite tools and frameworks. Azure Information Protection (AIP) is one of the
services offered by Microsoft Azure.
AIP protects the sensitive information of your company. It allows your organization to encrypt, classify, and
protect your emails and documents at the time of creation or modification. With AIP, you can:
• Manually or automatically add labels and classify emails and documents based on business rules.
• Enforce encryption on your emails and documents.
• Protect your information by applying header and footer text to the email.
AIP provides an excellent end-user experience by allowing users to secure their information by simply applying
the label. Organizations can also boost their security and Data Loss Prevention policies with a comprehensive
and unified approach for the data protection.
For more information on AIP, see What is Azure Information Protection?.
Supported Features of AIP

• The AIP feature supports only Modern authentication.
• With AIP, you can encrypt the content of your email with a label. By default, the Azure Cloud key is used
for encryption, but you can also set additional encryption at the server level by configuring the Protection
template ID of the label.
• AIP supports the Watermark feature. You can add a watermark by applying header and footer text to
your email.
• The default label is a label that automatically applies to the new email that you compose.
• AIP feature permits you to apply only one label per email.
• You can apply restrictions on your emails and documents based on the following categories:
◦ User actions - You can restrict users to perform the following actions on the received emails.
▪ View
▪ Reply
▪ Reply All
▪ Do not forward
◦ User groups - You can allow only selected users and groups to access your email.
◦ Time - You can set few days or a specific date for the users to access your email. When the time
expires, users cannot access the email.
• You can configure AIP to request for justification when users try to downgrade or remove a label.
• Each email in a thread can have a different label.
• If you configure the sensitivity labels in Workspace ONE UEM console, users cannot view the IRM
templates in Workspace ONE Boxer.

Enable Azure Information Protection (AIP) Sensitivity Labels for Your

Organization
As an admin, you can use the Azure portal to configure the Azure Information Protection sensitivity labels for
your organization. You must also configure Workspace ONE Boxer using a key-value pair to enable the AIP
feature.
1. Sign in to the Azure portal. For more information about the Azure portal, see Configuring the Azure
Information Protection policy.
2. Enable the following options in the organization settings of your Office 365 account.
a. Azure Information Protection
b. Microsoft Information Protection API
3. Activate the Data Protection and the Unified labeling options in AIP.
4. Configure the labels in the Classification settings of AIP.
5. Add and enable the PolicySensitivityLabelsEmailClassification key in the Workspace ONE UEM console.
To know how to configure this key, see see the Enable AIP Sensitivity Labels in Workspace ONE Boxer
section in the Application Configurations for Workspace ONE Boxer topic.
When you enable the PolicySensitivityLabelsEmailClassification key,
◦ It deactivates the default Boxer policies (Classifications and IRM templates) for end users and
replaces it with a set of AIP sensitivity labels, as set in Azure.
◦ The following key-value pairs become inactive and cannot be enabled:
▪ PolicyClassMarkingsEnabled
▪ PolicyClassMarkingsXHeader
▪ PolicyClassVersion
▪ PolicyClassMarkings
▪ PolicyClassMarkingsRankEnabled
▪ PolicyClassMarkingsDefaultClass Note:
◦ As an admin, you must provide consent to your tenant users to use the sensitivity labels.
Otherwise, each user has to consent manually. Users cannot use the labels without the consent.
◦ Labels might take 24 hours to synchronize from Azure to Workspace ONE Boxer.
Configure Azure Information Protection (AIP) Sensitivity Labels in

Workspace ONE Boxer
If your administrator has not provided you the consent to access the AIP sensitivity labels, you must consent
manually.
1. To enable the sensitivity labels in Workspace ONE Boxer, tap the Enable option in the banner displayed
on the inbox screen.

2. If you have multiple managed accounts and you are on All Accounts screen, you must select an account
for which you want to enable the sensitivity labels. When you have a single managed account, you are
directly redirected to the Microsoft page, where you have to consent manually.
3. Tap Accept on the Microsoft page and consent manually.
After receiving the consent, Boxer fetches all the labels from Azure. You can apply these labels to your
emails and also receive emails with labels.
4. To update the older emails with sensitivity labels, you can resynchronize Boxer.
Even if you do not receive the consent, you can still access the emails, but you cannot apply any restrictions
and classification to the email content.
Apply Azure Information Protection (AIP) Sensitivity labels to Emails

You can apply a sensitivity label when you compose a new email, reply, or forward a received email. To apply
a label on your email, you must tap the label icon. Upon tapping, you can see a list of all the labels configured
in Azure.
General Information:
• You cannot select the parent labels. You can only select the child labels.
• If the default label functionality is enabled in Azure, you can see that the label has already been applied
to the list.
• When you apply a label to an email, you can see the following things in the email body:
◦ Snackbar to confirm that you have applied a label.

◦ The label icon turns red.
◦ A solid red line appears under the subject of the email.
Note: Sensitivity labels do not support delegated accounts.
Receiving Emails with Azure Information Protection (AIP) Sensitivity

Labels
When you receive an email with an applied sensitivity label, you can see the name of the applied label and a
label icon marked in red. You can also see the header and footer text if the label has the settings for it. The
header and footer text that appears in the email body is according to the label settings in Azure.
Based on the settings of the label, sender can restrict you to perform actions such as Reply, Reply all, or
Forward on the received email.
When you tap the label name, you can view the additional label details such as name, permissions, and
restrictions applied on the received email. If the sender gives you the permission, you can also change the
label of the received email. Sometimes you are asked to provide a valid reason for changing the label. The
policy setting in Azure controls such requests.
You cannot access sensitivity labels in the cases where:

• Your admin has enabled the PolicySensitivityLabelsEmailClassification key in the Workspace ONE UEM
console, but has not configured the sensitivity labels in Azure.
• The Boxer application fails to connect to the Azure server.
Combination of IRM templates and Sensitivity labels
• When you receive an email with an already applied IRM template, then a default sensitivity label
configured by the Azure admin is applied to that email. You can also apply the labels manually.
• If you receive an email with an applied sensitivity label, you can use a different sensitivity label if you are
allowed to do so.
Combination of S/MIME and Sensitivity labels
• When you receive a signed or encrypted email and you apply a sensitivity label to it, the signing or
encryption level of protection is removed from that email.
• If you receive an email with an already applied sensitivity label, the label is removed automatically when
you sign or encrypt that email.

Device Management
Device Management
You can remove access to business data through device management tools in the Workspce ONE UEM
console. The actions available depend on the enrollment method.
Enterprise Wipe
Perform an enterprise wipe to remove all business data from an enrolled device. Enterprise wipe also removes
access to enterprise email accounts in Workspace ONE Boxer. While the action removes enterprise data,
enterprise wipe does not remove personal data from the device. Devices must be enrolled through typical
enrollment to use enterprise wipe. Standalone enrollment does not support enterprise wipe.
Performing an enterprise wipe also removes all personal accounts from Workspace ONE Boxer. End users
have to log in to those accounts again in Workspace ONE Boxer and sync to restore email for their personal
accounts. Enterprise wipe does the following:
• If the Remove on Unenroll setting was selected during the initial Workspace ONE Boxer app
configuration, Removes the Workspace ONE Boxer application during unenrollment from Workspace
ONE UEM.
• Sends a sync request to the app to remove all Workspace ONE Boxer data, including email, contacts,
and calendar. Data is actually removed only after the application syncs. Syncing occurs when the app is
active and performs a scheduled sync, or when the user starts the app. If an end user deletes the app
before the sync, then the Workspace ONE Boxer contacts remain on the device.
Device Wipe Considerations

Standalone enrolled Workspace ONE Boxer devices are not managed through Hub and no device samples
are sent back from device to the UEM console. The enrolled devices are always seen idle on the Device
Details page of the UEM console.
You must remove compliance policies that rely on device status from smart groups using Standalone
enrollment. If compliance policies are enabled, the UEM console reports these devices as violating compliance
policies and invokes any set actions such as device wipe.
Block Access to IBM Traveler Server

IBM Traveler server can be configured to allow access only to managed devices (Workspace ONE Intelligent
Hub, VMware Workspace ONE, Standalone Enrollment) using the Traveler’s notes.ini configuration. This
configuration can be edited to allow a client based on Workspace ONE Boxer User Agent. Workspace ONE
Boxer can have a unique user agent string to identify the managed mode for communicating with Traveler
server.
1. Log onto your Traveler server and locate notes.ini configuration file.
2. Open notes.ini configuration file and find the ‘NTS_USER_AGENT_ALLOWED_REGEX’ parameter.
3. Add ‘= AirWatch BoxerManaged’ after the ‘NTS_USER_AGENT_ALLOWED_REGEX’ parameter.
NTS_USER_AGENT_ALLOWED_REGEX = AirWatch BoxerManaged.

Device Management
4. (Optional) If you want to allow Workspace ONE Boxer managed and un-managed devices but block the
native email client from accessing the Traveler server, add ‘= AirWatch Boxer’ after the
‘NTS_USER_AGENT_ALLOWED_REGEX’ parameter.
NTS_USER_AGENT_ALLOWED_REGEX = AirWatch Boxer.
5. Select Save.
Workaround for Third-Party Address Book (iOS Only)

Fix the Third Party Address book error on Workspace ONE Boxer for iOS.
When end users configure an email account using the native iOS Mail settings, they are prompted with a
dialog asking what they would like to do with existing local contacts. One option is to Delete, which lets end
users delete their local address books. If this happens, then the native iOS Address Book is deleted, where
Workspace ONE Boxer stores its contacts if Caller ID is enabled. As a result, end users cannot export
Workspace ONE Boxer contacts for Caller ID functionality.
1. Navigate to Mail, Contacts, and Calendar in Settings and turn off Contacts sync for all accounts.
2. Start the Workspace ONE Boxer app and enable Caller ID in Settings.
3. Navigate back to the device’s Settings and under Mail, Contacts, and Calendar, turn on Contacts
sync for all accounts. End users are prompted with a dialog box asking them whether or not they want to
delete local contacts.
4. On the Existing Local Contacts dialog box, select Keep on My iPad.
5. On the Keep Local Contacts dialog box, select Keep. NOTE: If you keep your current contacts on your
iPad, you might see duplicate entries.
Workaround for Sync and Policy Errors on Workspace ONE Boxer using
IBM Notes
Fix the Sync and Policy errors that occurs on Workspace ONE Boxer when used with IBM Notes email server.
On Workspace ONE Console v9.2, sync and policy errors are observed on devices configured using email
type as IBM Notes with SEG. If the Managed Device policy is set to ON, then the device is detected as an
unmanaged device. As a result, mail sync is blocked until the next re-council (delta or complete sync). If the
Managed Device policy is set to OFF, then the device is detected as an unmanaged device. In this case, mail
sync is not blocked but the managed device SEG policies are not applied on the Workspace ONE Boxer. You
can resolve this errors by changing the Email Type from Lotus Notes to Microsoft Exchange. The issue and
workaround applies only for Workspace ONE console v9.2.
1. Navigate to Console > Email > Email Setting > Configure. If you are using it only for Workspace ONE
Boxer, you can edit an existing MEM configuration.
2. Select Edit Email Configuration. The Edit Email Configuration page is displayed.
3. From the Platform tab, select Email Type as Exchange and then select any Exchange version.
4. Select Next to navigate through the tabs and select Save.

Device Management
5. Navigate to Console > Email > Email Setting and verify if the email server type is displayed as
Microsoft Exchange.
6. Navigate to Apps & Books > Applications > Workspace ONE Boxer.
7. Select Assign and then select Add Assignment.
8. From Email Settings, select Email Management.
9. Choose the email setting configured with Exchange as the email server type.
10. Select Save & Publish.
Email sync starts and policies are applied on Workspace ONE Boxer.
Background Process Execution in Workspace ONE Boxer for Android

VMware Workspace ONE Boxer for Android has been updated to introduce certain changes that affect the
background execution of Workspace ONE Boxer.
Limits to Background Execution
Android 8.0 limits the activity of Workspace ONE Boxer app when users do not interact directly with it. This
results in OS stopping the background sync operations prematurely.
To continue to receive the real time notifications you must deploy Email Notification Service 2 and deactivate
the battery optimization for Workspace ONE Boxer. For more information on deploying Email Notification
Service 2, see Introduction to Email Notification Service 2.
Workspace ONE Boxer posts a notification on the system bar to perform operations when the app is
backgrounded. This notification is required to prevent the OS from stopping the app in the background. In
addition, deactivating battery optimization is necessary to allow Workspace ONE Boxer to perform network
operations once in the background.
Battery Optimization
The Battery Optimization is a default setting on Android devices. Users are prompted to deactivate battery
optimization when they first launch Workspace ONE Boxer on their android devices.
1. Open the Settings on your android devices or navigate to it from Workspace ONE Boxer’s battery
optimization prompt.
2. Tap Apps & notifications.
3. Expand Advanced.
4. Tap Special app access.
5. Tap Battery optimization.
6. On the Not optimized drop-down menu, select All Apps.
7. Scroll and tap Boxer, and then tap Don’t optimize.

Device Management
8. Tap Done.

Workspace ONE Boxer Comparison Matrix

This section provides information about the available features in Workspace ONE Boxer when configured with
Microsoft Exchange and IBM Lotus Notes server.
Workspace ONE Boxer Comparison Matrix for Microsoft Exchange

The following features matrix compares the differences between the iOS and Android versions supported by
Workspace ONE Boxer when configured with Microsoft Exchange.
Features and Functionality iOS Android
Remote Administrative Actions
Configure email accounts ✓ ✓
Wipe all enterprise data and

✓ ✓
settings
Clear passcode x x
Deployment Methods
VMware Workspace One ✓ ✓
Workspace One Intelligent Hub ✓ ✓
Standalone Enrollment (email

✓ ✓
access only)
Application Passcode Policy
Require Active Directory

x x
Enforce minimum length ✓ ✓
Alphanumeric passcode ✓ ✓
Require special characters ✓ ✓
Set passcode timeout ✓ ✓
Set maximum passcode age ✓ ✓
Enforce passcode history ✓ ✓
Set maximum failed attempts ✓ ✓
TouchID/Fingerprint Integration ✓ ✓
Reset Forgotten Passcode ✓ ✓
Share passcode across

✓ ✓
Workspace ONE apps

AES 256-bit SSL encryption in

✓ ✓
transit
AES 256-bit encryption at rest ✓ ✓
Activate or Deactivate adding

✓ ✓
multiple accounts
Detect compromised devices ✓ ✓
Activate or deactivate copy and

✓ ✓
paste
Activate or deactivate screenshots x ✓
Activate or deactivate downloading

✓ ✓
attachments
Restrict which apps can open

✓ ✓
attachments
Prevent sending to denylisted

x x
domains
Restrict sending to allowlisted

x x
domains
Force links to open in VMware

✓ ✓
Browser
Activate or deactivate Caller ID ✓ ✓
Remote IT Policies
Set default past days of mail to

✓ ✓
sync
Set past days of calendar to sync ✓ ✓
Ignore SSL errors x x
Activate or deactivate calendar

x x
access
Activate or deactivate contacts

x x
access
Authenticate account using a

✓ ✓
certificate
Authenticate account using

✓ ✓
credentials


✓ ✓
credentials and certificate
Activate or Deactivate HTML

x x
Email
Configure default email signature ✓ ✓
Activate or deactivate signature

x x
editing
Set maximum attachment size x x
Application Settings
Add multiple accounts ✓ ✓
Configure default past days of mail

✓ ✓
to sync
Configure default past days of

✓ ✓
calendar to sync
Configure swipe gestures ✓ ✓
Configure custom quick responses ✓ ✓
Activate or deactivate displaying

✓ ✓
local calendars

✓ ✓
local contacts
Activate or deactivate
✓ ✓
conversation view
Configure undo duration ✓ ✓
Configure auto-download of
x ✓
attachments over WiFi
Configure week start day ✓ ✓
Email Functionality
Combined inbox for multiple

✓ ✓
accounts
Send availability ✓ ✓
Email quick replies ✓ ✓
Reply with event invitation ✓ ✓
Cross-Account forwarding or reply

✓ x
to emails

Predictive email move ✓ ✓
Custom boxes (pin individual or

✓ ✓
combined subfolders)
View event conflicts in event

✓ ✓
invitations
Filter by flagged or starred ✓ ✓
Filter by unread emails ✓ ✓
Mark as read/unread/flagged ✓ ✓
Bulk actions for emails ✓ ✓
View email by conversations

✓ ✓
(threads)
Search by to/subject ✓ ✓
View email sub-folders ✓ ✓
Automatically sync email sub-

✓ ✓
folders
Search contacts in global address

✓ ✓
list
Save email to drafts ✓ ✓
Select all ✓ ✓
Select all from sender ✓ x
Configure Out of Office automatic

✓ ✓
replies
Calendar Functionality
Search by title or organizer x ✓
Accept/decline/tentative calendar
✓ ✓
invites
Create events and send event

✓ ✓
invitations
Reply to event organizer/

✓ ✓
attendees
Forward calendar events ✓ ✓
One click conference call dialing ✓ ✓
View events by month or day ✓ ✓

View calendar agenda ✓ ✓
Mark meeting as private ✓ ✓
View local device calendars ✓ ✓
Configure your availability status

✓ ✓
for meeting (Show As)
Edit recurring event schedule ✓ ✓
Respond to individual occurrences

✓ ✓
of a calendar event series
Respond to event invitation with

✓ ✓
comments
Configure calendars to display ✓ ✓
Contacts Functionality
Search contacts from global

✓ ✓
address list
Call and send messages to

✓ ✓
contacts
Caller ID contact sync ✓ ✓
View recent contacts ✓ x
Manage favorite contacts ✓ ✓
Create/edit/delete rich contacts ✓ ✓
View contact photos from GAL ✓ ✓
Information Rights Management
Read rights managed email

✓ ✓
messages
Add rights management to

✓ ✓
composed email messages
Restrict copy-paste (extract

✓ ✓
allowed)
Restrict printing ✓ ✓
Restrict forward ✓ ✓
Restrict reply ✓ ✓
Restrict reply all ✓ ✓

Prevent removing rights

✓ ✓
management on reply/forward
Restrict modifying recipients on

✓ ✓
reply/forward
Prevent programmatic access x x
Enforce email message content

x x
expiration
Restrict editing message contents

✓ ✓
(on reply/forward)
Preview rights management

x x
protected attachments
Notifications and Widgets
Push email notifications (iOS

✓ ✓
requires email notification service)
Display notifications for calendar

✓ ✓
events
Activate or deactivate email widget x ✓

✓ ✓
widget
Configure notification preferences ✓ ✓
S/MIME Functionality
Send S/MIME signed messages ✓ ✓
Send S/MIME encrypted

✓ ✓
messages

✓ x
messages to distribution lists
Automatically fetch encryption

✓ ✓
certificates from GAL
Configure S/MIME options per

✓ ✓
email message
Decrypt S/MIME encrypted

✓ ✓
messages
View validity of S/MIME signed

✓ ✓
messages
Attachment Functionality

Built-in attachment previews ✓ ✓
View locally saved attachments ✓ ✓
Add links to files from Content

✓ ✓
Solutions
Add files from document providers ✓ ✓
Attach from local attachments ✓ ✓
Troubleshooting and
Diagnostics
Send logs from application ✓ ✓
View device’s MDM and email

✓ ✓
connectivity status
Server Protocol Support
Microsoft Exchange ActiveSync ✓ ✓
IMAP (Personal Accounts Only) ✓ ✓
Interoperability
Microsoft Exchange 2016 ✓ ✓
Microsoft Exchange 2007 x x
Microsoft Office 365 ✓ ✓
Microsoft Office 365 with Modern

✓ ✓
Auth
IBM SmartCloud x x
IBM Lotus Notes 9.0 x x
Google Apps x x
Workspace ONE Boxer Comparison Matrix for IBM Notes Traveler

The feature matrix compares the differences between the iOS and Android versions supported by Workspace
ONE Boxer when configured with IBM Notes Traveler (Lotus Notes Traveler).
Remote Administrative Actions

Configure email accounts ✓ ✓
Wipe all enterprise data and

✓ ✓
settings
Clear passcode x x
Deployment Methods
VMware Workspace ONE ✓ ✓
Workspace ONE Intelligent Hub ✓ ✓
Standalone Enrollment (email

✓ ✓
access only)
Application Passcode Policy
Require Active Directory

x x
Enforce minimum length ✓ ✓
Alphanumeric passcode ✓ ✓
Require special characters ✓ ✓
Set passcode timeout ✓ ✓
Set maximum passcode age ✓ ✓
Enforce passcode history ✓ ✓
Set maximum failed attempts ✓ ✓
TouchID/Fingerprint Integration ✓ ✓
Reset Forgotten Passcode ✓ ✓
Share passcode across

✓ ✓
Productivity apps
AES 256-bit SSL encryption in

✓ ✓
transit
AES 256-bit encryption at rest ✓ ✓
Activate or deactivate adding

✓ ✓
multiple accounts
Detect compromised devices ✓ ✓
Activate or deactivate copy and

✓ ✓
paste
Activate or deactivate screenshots x ✓

Activate or deactivate downloading

✓ ✓
attachments
Restrict which apps can open

✓ ✓
attachments
Prevent sending to denylisted

x x
domains
Restrict sending to allowlisted

x x
domains
Force links to open in VMware

✓ ✓
Browser
Activate or deactivate Caller ID ✓ ✓
Remote IT Policies
Set default past days of mail to

✓ ✓
sync
Set past days of calendar to sync ✓ ✓
Ignore SSL errors x x

x x
access
Activate or deactivate contacts

x x
access
Authenticate account using a

x x
certificate

✓ ✓
credentials

x x
credentials and certificate
Activate or Deactivate HTML

x x
Email
Configure default email signature ✓ ✓
Activate or deactivate signature

x x
editing
Set maximum attachment size x x
Application Settings
Add multiple accounts ✓ ✓

Configure default past days of mail

✓ ✓
to sync
Configure default past days of

✓ ✓
calendar to sync
Configure swipe gestures ✓ ✓
Configure custom quick responses ✓ ✓

✓ ✓
local calendars

✓ ✓
local contacts
Activate or deactivate
✓ ✓
conversation view
Configure undo duration ✓ ✓
Configure auto-download of
x ✓
attachments over WiFi
Configure week start day ✓ ✓
Email Functionality
Combined inbox for multiple

✓ ✓
accounts
Send availability ✓ ✓
Email quick replies ✓ ✓
Reply with event invitation ✓ ✓
Cross-Account forwarding or reply

✓ x
to emails
Predictive email move ✓ ✓
Custom boxes (pin individual or

✓ ✓
combined subfolders)
View event conflicts in event

✓ ✓
invitations
Filter by flagged or starred ✓ ✓
Filter by unread emails ✓ ✓
Mark as read/unread/flagged ✓ ✓
Bulk actions for emails ✓ ✓

View email by conversations

✓ ✓
(threads)
Search by to/subject ✓ ✓
View email sub-folders ✓ ✓
Automatically sync email sub-

✓ ✓
folders
Search contacts in global address

✓ ✓
list
Save email to drafts ✓ ✓
Select all ✓ ✓
Select all from sender ✓ ✓
Configure Out of Office automatic

✓ ✓
replies
Calendar Functionality
Search by title or organizer x ✓
Accept/decline/tentative calendar
✓ ✓
invites
Create events and send event

✓ ✓
invitations
Reply to event organizer/

✓ ✓
attendees
Forward calendar events x x
One click conference call dialing ✓ ✓
View events by month or day ✓ ✓
View calendar agenda ✓ ✓
Mark meeting as private ✓ ✓
View local device calendars ✓ ✓
Configure your availability status

✓ ✓
for meeting (Show As)
Edit recurring event schedule ✓ ✓
Respond to individual occurrences

✓ ✓
of a calendar event series
Respond to event invitation with

✓ ✓
comments

Configure calendars to display ✓ ✓
Contacts Functionality
Search contacts from global

✓ ✓
address list
Call and send messages to

✓ ✓
contacts
Caller ID contact sync ✓ ✓
View recent contacts ✓ x
Manage favorite contacts ✓ ✓
Create/edit/delete rich contacts ✓ ✓
View contact photos from GAL ✓ ✓
Information Rights Management
Support rights managed emails x x
Notifications and Widgets
Push email notifications (iOS

x ✓
requires email notification service)
Display notifications for calendar

✓ ✓
events
Activate or deactivate email widget x ✓

✓ ✓
widget
Configure notification preferences ✓ ✓
S/MIME Functionality
Support S/MIME signed messages x x

✓ x
messages to distribution lists
Attachment Functionality
Built-in attachment previews ✓ ✓
View locally saved attachments ✓ ✓
Add links to files from Content

✓ ✓
Solutions
Add files from document providers ✓ ✓
Attach from local attachments ✓ ✓

Troubleshooting and
Diagnostics
Send logs from application ✓ ✓
View device’s MDM and email

✓ ✓
connectivity status
Server Protocol Support
Microsoft Exchange ActiveSync ✓ ✓
IMAP (Personal Accounts Only) ✓ ✓
Interoperability
Microsoft Office 365 ✓ ✓
IBM SmartCloud x x
IBM Lotus Notes 9.0.1.x ✓ ✓
IBM Lotus Notes 8.5.3 ✓ ✓
Google G Suite ✓ ✓

Frequently Asked Questions for Workspace ONE Boxer
Frequently Asked Questions for Workspace ONE

Boxer
This topic covers the most common questions asked by customers and administrators about the features in
FAQs for Mailbox Delegation

Q: What are the supported Exchange versions?
Exchange Versions 2013, 2016, 2019, and Office 365.
Q: Is there a limit on the number of delegates?
Yes, the delegate can only add 5 delegators.
Q: Which protocol is used for the delegation feature?
Exchange Web Service protocol is used for the delegation feature. You must enable EWS on your Exchange
Server.
Q: Does ActiveSync support the Mailbox Delegation?
This feature is not supported on ActiveSync due to the technical limitations of the ActiveSync protocol.
Q: Does this feature support the Secure Email Gateway (SEG)?
Yes, this feature supports Secure Email Gateway (SEG).
FAQs for Multiple Managed Accounts

Q: Is it required to configure and use all managed accounts?
No, you can skip signing into the multiple accounts. If at least one managed account is signed in, you can use
Boxer. You can also select to sign out from a particular account.
Q: How can I sign out from a managed account?
To sign out from a managed account, navigate to Boxer settings > Select the Account > Remove Account.
Q: How can I deactivate notification for a particular email account?
To deactivate notification, navigate to Boxer settings > Select the Account > Notification settings and
deselect the email notifications preference.
Q: What happens if the app passcode and SSO are enabled at the same time?
Note: App Passcode is not supported in Workspace ONE Boxer 22.05 and later for standalone enrollments.
You can migrate the Workspace ONE Boxer passcode settings to the SDK passcode settings. For more
information about configuring the SDK passcode, see the Security Policies Profiles for the SDK section in the

SDK and Managing Applications documentation at VMware Docs. Boxer uses the SDK for SSO. If SSO and
the Boxer Passcode are enabled, then the SSO settings are used.
General FAQs
Q: For a closed or restricted network is it mandatory to have access to https://discovery.awmdm.com
endpoint?
Yes it is as per the KB article https://kb.vmware.com/s/article/2960709?lang=en_US.
Q: What are the impacted services, If access is not given to https://discovery.awmdm.comendpoint?
The SSL/TLS network traffic cannot inspect as certificate pinning gets effected.
Q: Is Boxer communication impacted by access to https://discovery.awmdm.com endpoint? In this scenario

why only Android 9 and Android 10 devices be impacted?
The SSL/TLS network traffic cannot inspect as certificate pinning is impacted. Android 9 or 10 might have
added extra security for SSL/TLS. The code that connects to https://discovery.awmdm.com is part of AW SDK.
FAQs for Azure Information Protection (AIP) Sensitivity Labels

This topic covers the most common questions asked by customers and administrators about the AIP feature in
Q: Where I can create and manage labels?
You can create labels in the following:
• Azure AIP - Currently, the Microsoft Information Protection (MIP) SDK only supports labels that are
configured in Azure. The Azure AIP gets deprecated by April 2021. After depreciation, MIP SDK can start
fetching labels from the Office 365 Security and Compliance Center.
• Office 365 Security and Compliance Center - From April 2021 onwards, Office 365 Security and
Compliance Center can only create and manage labels. To avoid issues, customers must move the
labels from Azure to Office 365 soon.
Q: What versions of Exchange I can use for the AIP feature?
You can only use Office 365 for the AIP feature.
Q: AIP supports what mode of authentication?
AIP feature only supports Modern authentication.
Q: What mode of encryption is supported in AIP?
AIP only supports encryption with Azure Cloud key. You can provide additional encryption on the server.
Q: What is the minimum supported Boxer version for the AIP feature?
5.19 for iOS and Android Boxer.
Q: What is the minimum supported OS version for AIP?

AIP supports all the versions of iOS and version 7.0 for Android.
Q: Why I cannot see the labels?
The following are some possible reasons for which you cannot view the labels:
• Labels are not configured in Azure and the list is empty.

• You have not authenticated in Azure.
• You did not provide the consent in the Microsoft account to use the AIP Sensitivity labels application from
VMware.
• Your admin has not enabled the PolicySensitivityLabelsEmailClassification key. For more information
about this key, see the Enable AIP Sensitivity Labels in Workspace ONE Boxer section in Application
Configurations for Workspace ONE Boxer.
Q: Why I cannot access emails?
The following are some possible reasons for which you cannot access the emails:
• You are not part of the allowed user group or organization in the User Permissions settings of the label.
• You do not have the permission to view the content.
• Your access time has expired.
Note: Content access is managed in File Content Expiration settings of the label. Proper error
messages and action items can be displayed in Boxer if they are configured in the settings in Azure.
Q: Why I cannot change a label?
Because you do not have permission to change the label.

Workspace One Boxer Admin Guide

Uploaded by

Copyright:

Available Formats

Workspace One Boxer Admin Guide

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Workspace One Boxer Admin Guide

Uploaded by

Copyright:

Available Formats

Workspace ONE Boxer Admin Guide

Copyright ©2005-2024 Broadcom. All Rights Reserved. 2

Workspace ONE Boxer

Benefits of Using Workspace ONE Boxer

Audience of this Guide

Requirements to Deploy Workspace ONE Boxer

Android 8.0 and later iOS 12 and later

Supported File Types

DOC JPEG JPG MOV

Copyright ©2005-2024 Broadcom. All Rights Reserved. 3

PDF VCF DOCX XML

PPT EXCEL MP3 SLX

TXT HTML MP4 EML

BMP PNG GIF

DOC TXT CSV BMP

DOCX ASC PPT DIB

DOT JPG PPS WBMP

XLS JPEG PPSX TIF

XLSX GIF POTX EMF

XLTX TIFF PDF PCX

MP3 HTP PNG

Supported Email Infrastructure

Components to Use with Workspace ONE Boxer

Email Notification Service

Copyright ©2005-2024 Broadcom. All Rights Reserved. 4

Workspace ONE UEM Mobile Email Management Models (Optional)

Copyright ©2005-2024 Broadcom. All Rights Reserved. 5

Boxer Deployment Considerations

Historical S/MIME Certificates

Copyright ©2005-2024 Broadcom. All Rights Reserved. 6

Common Criteria Certification

Enterprise Content Support for Boxer

Supported features of Enterprise Content:

• Enterprise Content supports the following online repositories:

◦ User added repositories.

• Save email attachments to repositories.

• Compose a new email with an attachment from an online repository.

The following list describes the limitations of Enterprise Content

Copyright ©2005-2024 Broadcom. All Rights Reserved. 7

Workspace ONE Boxer Deployment

Smart Group Based Assignments

1. Add Workspace ONE Boxer as a public application.

Add Workspace ONE Boxer to Public Applications

2. Select Add Application.

3. Configure the text boxes that display and select Next.

View the organization group where the application

Choose the appropriate platform. Only iOS and

Select to search for the application in the app

Copyright ©2005-2024 Broadcom. All Rights Reserved. 8

Name Enter “Workspace ONE Boxer”.

5. Review the information that automatically populates in the Details tab.

7. Select Save and Assign.

Copyright ©2005-2024 Broadcom. All Rights Reserved. 9

Copyright ©2005-2024 Broadcom. All Rights Reserved. 10

3. Select Add Assignment in the Assignment window.

a. In the Distribution tab, enter the following information:

Name Enter the name of the assignment.

Description Enter the description for the assignment.

Enter smart groups to receive the Workspace