Workspace ONE

Workspace ONE UEM runs one PowerShell script on a schedule, so devices stay onboarded and re-apply if their setup drifts. There is no detection script — the schedule does that job.

Before you begin

Push Python 3 as an app first, with InstallAllUsers=1 PrependPath=1 Include_launcher=1. The script runs as SYSTEM, and a per-user install is not on SYSTEM’s PATH.
Allow HTTPS to getunbound.ai, backend.getunbound.ai, api.getunbound.ai, raw.githubusercontent.com and github.com.

1. Get your API key

Sign in to Unbound as an admin and open Configure. Under Choose scope select My org (MDM), then under Run the install command select the Windows tab and copy the command. Your key is the value after -ApiKey. It is masked on screen and copied in full.

2. Add the script

In the Workspace ONE UEM console go to Resources → Scripts → Add → Windows.

General

Name: Unbound daily onboard. Select Next.

Details

Language: PowerShell. Execution Context: System. Execution Architecture: 64-bit. Timeout: 18000 — five hours, in seconds. The first run includes a discovery scan that can take hours on a large machine; a shorter timeout kills it partway through. Paste this as the script, replacing YOUR_ADMIN_API_KEY with the key from step 1:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$base = 'C:\Program Files\Unbound'
New-Item -ItemType Directory -Force -Path $base | Out-Null
icacls $base /setowner '*S-1-5-32-544' /T /C | Out-Null
icacls $base /reset /T /C | Out-Null
icacls $base /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
$acl = Get-Acl $base
$allowed = @('S-1-5-18', 'S-1-5-32-544')
if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed -or
    ($acl.Access | Where-Object {
        $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -notin $allowed })) {
    throw "Could not secure $base. Refusing to continue."
}
Remove-Item (Join-Path $base '*') -Force -Recurse -ErrorAction SilentlyContinue

$installer = Join-Path $base 'onboard.ps1'
Invoke-WebRequest -Uri 'https://getunbound.ai/setup/mdm/windows/onboard' -OutFile $installer -UseBasicParsing -ErrorAction Stop

& $installer -ApiKey 'YOUR_ADMIN_API_KEY' -Backfill
$code = $LASTEXITCODE

if ($code -eq 0) {
    try { Set-Content -Path (Join-Path $base 'last-success.txt') -Value (Get-Date -Format 'o') -ErrorAction Stop }
    catch { Write-Output "Installed, but could not write the marker. $_"; $code = 1 }
}
Remove-Item $installer -Force -ErrorAction SilentlyContinue
exit $code

Variables

None. Select Save.

The icacls lines lock C:\Program Files\Unbound to SYSTEM and administrators before the key is written, and the script stops if it cannot.

3. Assign it

Open the script and select Assign → New Assignment.

Definition

Assignment Name: Unbound daily onboard. Under Select Smart Group, choose your developer device group.

Deployment

Under Triggers select Schedule and set the interval to 24 hours. Also select the Run Immediately event, so devices already enrolled run it at their next check-in instead of waiting a day. Select Save.

4. Verify

Open the device under Devices → List View, then the Scripts tab. The Status column shows Executed for Unbound daily onboard. Failed means the exit code was not 0 — open the row to read the output.

Device

C:\Program Files\Unbound\last-success.txt updates daily.

Unbound

Devices appear with a recent last-seen time.

Troubleshooting

Symptom	Fix
`Python 3 is required but not found in PATH`	Re-deploy Python with `InstallAllUsers=1 PrependPath=1 Include_launcher=1`, then reboot.
`Could not download` or a `404`/`403` on `raw.githubusercontent.com`	The installer fetches its Python stage from GitHub. Allow `raw.githubusercontent.com` through your proxy, including TLS inspection.
Status shows Failed	Open the device’s Scripts tab and read the output. The installer prints which step failed.
Status shows Failed with output that stops during Discovery	The script hit its Timeout. Confirm it is `18000` (five hours).
Copilot rows show `auto`	Allow one daily cycle. Sessions VS Code has already rotated cannot be read.

Command switches

Switch	Purpose	Default
`-ApiKey <key>`	Your admin API key. Required unless `-Clear`	—
`-BackendUrl <url>`	Where setup results and scans are reported	`https://backend.getunbound.ai`
`-GatewayUrl <url>`	The AI gateway the installed tools point at	`https://api.getunbound.ai`
`-FrontendUrl <url>`	Your dashboard host, written into each user’s config	`https://gateway.getunbound.ai`
`-Backfill`	Import past Claude Code, Codex and GitHub Copilot sessions	off
`-SkipManagedSettings`	Claude Code only: install the hook, leave its managed settings to you. See Tamper Resistance	off
`-Clear`	Remove the configuration for every tool	off

Remove Unbound

Remove the script’s assignment first, or the next scheduled run reinstalls. Then, in an elevated PowerShell on the device:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$f = Join-Path $env:ProgramFiles 'Unbound\onboard.ps1'
New-Item -ItemType Directory -Force -Path (Split-Path $f) | Out-Null
Invoke-WebRequest -Uri 'https://getunbound.ai/setup/mdm/windows/onboard' -OutFile $f -UseBasicParsing
& $f -Clear
Remove-Item (Split-Path $f) -Recurse -Force

Tamper Resistance

Keeping Unbound active on every device with managed settings.

Getting Started

CLI

Policies

Analytics

Hooks API

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Workspace ONE

Before you begin

1. Get your API key

2. Add the script

3. Assign it

4. Verify

Workspace ONE

Device

Unbound

Troubleshooting

Command switches

Remove Unbound

Tamper Resistance

​Before you begin

​1. Get your API key

​2. Add the script

​3. Assign it

​4. Verify

Workspace ONE

Device

Unbound

​Troubleshooting

​Command switches

​Remove Unbound

Tamper Resistance

Before you begin

1. Get your API key

2. Add the script

3. Assign it

4. Verify

Troubleshooting

Command switches

Remove Unbound