Skip to main content

VMware Workspace ONE / Omnissa rollout

Roll out pavri-endpointd to a macOS and/or Windows fleet via VMware Workspace ONE (Omnissa UEM) using an Environment Variables profile + a wrapped signed package.

1. Prerequisites​

  • Pavri tenant + admin role.
  • Workspace ONE UEM admin console access; permission to create Profiles and Applications.
  • Signed package:
    • macOS: pavri-endpointd.pkg (Developer ID + Notarization) — gated on CAP-3.8.
    • Windows: Intune/Win32 staged pavri-endpointd.exe package or equivalent Workspace ONE-wrapped artifact (Authenticode) — gated on CAP-3.7 item 1 (Windows-Intel).
  • See the CAP-3.7 and CAP-3.8 rows in docs/05-PHASED-ROADMAP.md (internal).

2. Token mint​

In the Pavri dashboard, navigate to Settings → Endpoints → Add Endpoint → Mint enrollment token. Tokens are single-use per endpoint, 24-hour TTL. Mint one token per Workspace ONE smart group scope — re-use across endpoints within the group is supported because the gateway tracks per-endpoint enrollment state.

3. Substitution markers​

Edit infra/mdm/workspace-one/pavri-endpointd-profile.xml before upload to Workspace ONE:

MarkerReplace with
${GATEWAY_URL}Your tenant's gateway URL (e.g. https://gateway.your-org.pavri.ai)
${ENROLLMENT_TOKEN}The token you minted in step 2
${ORG_ID}Your pavri org_id (visible at /admin/tenant in the dashboard)

Upload the substituted profile as a Custom Profile in the Workspace ONE UEM console (Devices → Profiles → Add → Custom). The profile delivers the three environment variables to the sensor process on both macOS and Windows.

For the full list of supported environment variables and command-line flags, see Sensor deployment reference.

4. Package signing​

Wrap the signed package for UEM ingestion:

infra/mdm/workspace-one/wrap.sh /path/to/pavri-endpointd.pkg
# or
infra/mdm/workspace-one/wrap.sh /path/to/pavri-endpoint-windows-amd64-<version>.zip

The wrapper copies the signed artifact with a .wsone suffix for upload to the UEM application catalog. The underlying binary signing requirements are identical to those described in the Jamf (Developer ID, macOS) and Intune (Authenticode, Windows) runbooks.

5. Staged rollout​

  1. Create a Workspace ONE smart group pavri-pilot (5% of enrolled devices; use a device ownership filter or a custom device attribute).
  2. Deploy the Environment Variables profile to pavri-pilot with Required intent. Confirm profile installation completes before proceeding.
  3. Upload the wrapped .wsone package to the Internal Application catalog and assign it to pavri-pilot with Auto deployment intent.
  4. Set the tenant default protection-profile to observe mode at /admin/protection-profiles.
  5. After 1 week of clean telemetry: expand the smart group to 25% of fleet, switch tenant default to soft_enforce.
  6. After 1 further week: expand to 100% and switch to enforce.

For mixed macOS + Windows fleets, create separate smart groups per platform and deploy the platform-appropriate package to each. The Environment Variables profile XML is identical for both platforms.

6. Rollback​

  • Per-endpoint emergency: at /admin/endpoints/{endpoint_id} → Set protection mode → observe — takes effect immediately, no UEM touch required.
  • Fleet-wide emergency: at /admin/protection-profiles → set tenant default to observe.
  • Full uninstall via Workspace ONE: change the application assignment to Uninstall intent in the UEM console. The uninstall action runs the platform-native package removal:
    • macOS: pkgutil --forget com.pavri.endpointd && rm /usr/local/bin/pavri-endpointd
    • Windows: Intune/Win32 app uninstall via the UEM application removal action, which invokes the bundled uninstall.ps1

7. Post-install verification​

macOS — on any enrolled endpoint:

# Verify the binary is present.
ls -l /usr/local/bin/pavri-endpointd

# Verify the LaunchDaemon is loaded and running.
sudo launchctl print system/com.pavri.endpointd | grep -E 'state|pid'

# Verify native-messaging manifests are healthy for any browsers in scope.
/usr/local/bin/endpointctl status-nm-manifests --browser=all

Windows — on any enrolled endpoint (PowerShell as Administrator):

# Verify the service is registered and running.
sc.exe query PavriEndpointd

# Verify native-messaging manifests.
& "C:\Program Files\Pavri\pavri-endpointd\endpointctl.exe" status-nm-manifests --browser=all

Confirm the endpoint shows up at /admin/endpoints in the dashboard within 60 seconds of the heartbeat interval.

Files in this rollout​

  • infra/mdm/workspace-one/pavri-endpointd-profile.xml — UEM Environment Variables profile.
  • infra/mdm/workspace-one/wrap.sh — package wrapper for UEM ingestion.
  • infra/mdm/workspace-one/README.md — short on-disk reference for Workspace ONE operators.