Skip to main content
Workspace ONE UEM runs one PowerShell script on a schedule. Devices stay onboarded, and a device whose setup has drifted gets put back on the next run. You do not need a detection script, because the schedule does that job.

​
Before you begin

  • Push Python 3 as an app first, with InstallAllUsers=1 PrependPath=1 Include_launcher=1. The script runs as SYSTEM, and a per-user install is not on SYSTEM’s PATH.
  • Allow HTTPS to getunbound.ai, raw.githubusercontent.com, github.com, and the hosts after -BackendUrl and -GatewayUrl in your install command.

​
1. Copy the command

Sign in to your Unbound dashboard and open Configure. On a dedicated deployment, that is your own address rather than gateway.getunbound.ai. Under Choose scope select My org (MDM), then under Run the install command select the Windows tab and copy the command. It looks like this, with your own key and URLs:
Two parts of it matter here. The value after -ApiKey is your admin API key. One key covers the whole fleet, and each device uses it to fetch its own device key. The dashboard masks it on screen but copies it in full. The switches after the key point devices at your deployment. -Backfill shows up only when Seed events from past activity is on in Configure.

​
2. Add the script

In the Workspace ONE UEM console go to Resources → Scripts → Add → Windows.
1

General

Name: Unbound daily onboard. Select Next.
2

Details

Language: PowerShell. Execution Context: System. Execution Architecture: 64-bit. Timeout: 18000, which is five hours in seconds. The first run includes a discovery scan that can take hours on a large machine, and a shorter timeout kills it partway through. Paste this as the script:
Replace YOUR_SWITCHES with the switches that follow your key in the command from step 1, for example -BackendUrl https://backend.getunbound.ai -GatewayUrl https://api.getunbound.ai -FrontendUrl https://gateway.getunbound.ai -Backfill. That keeps the URLs and -Backfill matched to what Configure gave you. Leave -ApiKey $env:UnboundApiKey alone. The key comes from the variable in the next step. If you forget to replace YOUR_SWITCHES, the installer rejects it and the run shows Failed, so a missed edit cannot quietly point devices at the wrong place.
3

Variables

Add one variable. Key: UnboundApiKey. Value: your admin API key from step 1. Select Save.Workspace ONE hands variables to the script as environment variables, so the key stays out of the script body.
The script downloads the same installer your Configure command uses and runs it in the same process with your switches. Workspace ONE gets the installer’s exit code back, so each run shows as Executed or Failed in the console. The key comes from the variable, so it never sits in the script body or on another process’s command line. The installer deletes itself when it finishes.

​
3. Assign it

Open the script and select Assign → New Assignment.
1

Definition

Assignment Name: Unbound daily onboard. Under Select Smart Group, choose your developer device group.
2

Deployment

Under Triggers select Schedule and set the interval to 24 hours. Also select the Run Immediately event, so devices already enrolled run it at their next check-in instead of waiting a day. Select Save.

​
4. Verify

Workspace ONE

Open the device under Devices → List View, then the Scripts tab. The Status column shows Executed for Unbound daily onboard. Failed means the exit code was not 0. Open the row to read the output.

Unbound

Devices appear on Settings → Devices, and show a recent Last Sync on AI Tools Discovery.

​
Troubleshooting

​
Command switches

​
Remove Unbound

Remove the script’s assignment first, or the next scheduled run reinstalls. Then, in an elevated PowerShell on the device:
On a dedicated deployment, add the -BackendUrl and -GatewayUrl switches from your install command after -Clear.

Tamper Resistance

Keeping Unbound active on every device with managed settings.