Symptoms
Devices in Work Managed mode, using Android 7 or older, may present an “Allow installation from this source?” (Hub) prompt when attempting to install internal apps. This prompt is displayed when the device allows installation from “Unknown Sources”. If the prompt is dismissed or hidden, the application will not be installed. If AirWatch Launcher is used on the device, the prompt may be blocked, resulting in failure to install the application.
The “Unknown Sources” setting is not enabled by default. The purpose of enabling this setting in Work Managed mode is to allow apps to be installed through side-loading or from 3rd party sources. As such, it is more secure for this setting to be disabled. Even without this setting enabled, VMware Workspace ONE can install internal apps silently.
To prevent this prompt, it is recommended to administratively disable the “Unknown Sources” setting on Work Managed devices on Android 7 and older by using an Android Restrictions profile. To achieve this, the profile should have the “Allow Non-Market App Installation” restriction unchecked (default state). If no Restrictions profile is pushed, the setting will be disabled on devices by default, but users will have the ability to enable it manually.
By default, AirWatch Launcher will automatically block and/or hide this prompt unless the Google Play Store is allowed in the Launcher profile. If you are using AirWatch Launcher and need “Unknown Sources” to be enabled, allowing Google Play Store would allow the prompt to be shown and accepted by the user.
Impact / Risks
If the prompt is dismissed or blocked in some way, the internal app will not be installed. AirWatch Launcher will block this prompt unless configured to allow the Play Store.
Workaround
Use the “Allow Non-Market App Installation” restriction in a disabled state to administratively disable the “Unknown Sources” setting on these devices.
