[Roveer]

I want to use "work space only" mode for a number of reasons but I'm finding it a little restrictive for our environment. One of the thing I think I remember from the last time I tried using it was that I couldn't allow users to install their own apps. Every app had to be approved and sent from the administrator. Is this true? Is there a way to allow the users to install their own apps?

Roveer

[Bluenoser63]

I want to use "work space only" mode for a number of reasons but I'm finding it a little restrictive for our environment. One of the thing I think I remember from the last time I tried using it was that I couldn't allow users to install their own apps. Every app had to be approved and sent from the administrator. Is this true? Is there a way to allow the users to install their own apps?

Roveer

That is correct. You only want users to be allowed to install approved apps. Otherwise, why have a work space at all?

[thurask]

Isn't the point of the work space that the admin decides what goes there?

[Roveer]

Well, actually Workspace contains all the security, encryption and ability to be controlled by BES 12 admin. The decision on whether or not to allow user installed apps should be software configurable for environments that might permit such a thing. More flexibility, not less. I don't want 2 spaces work/personal, I want 1 secure workspace with the ability to install apps. I understand that isn't possible, but it could/should be a administrator decision for environments that aren't securing national secrets such as my own.

Roveer

[Bluenoser63]

Well, actually Workspace contains all the security, encryption and ability to be controlled by BES 12 admin. The decision on whether or not to allow user installed apps should be software configurable for environments that might permit such a thing. More flexibility, not less. I don't want 2 spaces work/personal, I want 1 secure workspace with the ability to install apps. I understand that isn't possible, but it could/should be a administrator decision for environments that aren't securing national secrets such as my own.

Roveer

If your users install applications, then they space cannot be secure. An administrator that allows that shouldn't be an administrator.

[Roveer]

Not to worry, I still love BES 12 and we'll figure out how to make it work in our environment. We'll use one of the other modes and take all of the quirkiness that comes along with it, like the crappy way it handles contacts, which is cumbersome for the user and does not truly present a synchronized experience for the user. Thanks for your contribution.

[MrEvets]

Roveer I understand what you are asking but remember the the point you made that the work space is secure. Think about it this way, if you install an app outside the work space there is no way ever that app could ever access data inside the work space because the apps are run in a different security context not to mention the fact that there is an actual barrier of encryption it has to get through also. By running an app inside that encrypted space you have removed one of your defenses. All apps that run inside that area have access to data inside that area. If a user installs a bad app then your corporate data is not secure, this is why only approves apps can be installed because the BES admin has to determine if he trusts his company data with this app having access to it.

If corporate data is not a big deal (it should be unless you run a hot dog stand), I understand the need to have a managed device and only one side of the device, have you tried using MDM controls? this way the device is secured and when you leave all data is removed and the user can install as many apps as they want?