Workspace ONE UEM

The Workspace ONE UEM connector retrieves the devices enrolled in your Omnissa Workspace ONE UEM tenant and their enrollment users into OverView, through the Workspace ONE UEM REST API.

Objective

The Workspace ONE UEM connector retrieves the following information:

• Devices enrolled in the tenant (hostname, serial number, manufacturer, model, IMEI, storage, encryption state and network interfaces)
• Operating system, installed applications and compliance status of each device
• Enrollment users associated with the devices

Prerequisites

• An administrator account allowed to create admin roles on the Accounts > Administrators > Admin Roles page, in the organization group the connector reads.
• The REST API is the same on both deployments, only the credential differs. SaaS tenants authenticate with an OAuth 2.0 client. The Workspace ONE Token Service that issues those tokens does not exist on-premises, where the API is reached with an API key and a read-only admin account instead.

Information to provide in OverView

Fill in the table matching your deployment. Every field in it is required.

SaaS tenant

On-premises deployment

Procedure

Create a read-only role

The role defines which API endpoints the credential can call. It is assigned to the OAuth client on SaaS, and to the admin account on-premises.

1. Sign in to the Workspace ONE UEM console and go to Accounts > Administrators > Admin Roles.
2. Click Add Role.
3. Enter a Name (e.g., OverView Connector) and a Description.
4. Enter each permission listed in Required Permissions in the Search Resources box, then select its Read check box. Leave every other resource cleared.
5. Click Save.

Create an OAuth client, on SaaS

1. Go to Groups & Settings > Configurations.
2. Enter OAuth in the Enter a name or category search box, then select OAuth Client Management.
3. Click Add.
4. Enter a Name and a Description, select the Organization Group containing the devices to import, and select the Role created above.
5. Set the Status to Enabled, then click Save.
6. Copy the Client ID and the Client Secret immediately: they are displayed only once, and cannot be retrieved once the screen is closed.

Create an API key and an admin account, on-premises

1. Go to Groups & Settings > All Settings > System > Advanced > API > REST API.
2. On the General tab, select Enable API Access, click Add, enter a Service name and a Description, then copy the generated API Key.
3. On the Authentication tab, select Basic.
4. Go to Accounts > Administrators > Admins, then click Add > Add Admin.
5. On the Basic tab, set the User Type to Basic and fill in the user name, password, first name and last name.
6. On the Roles tab, select the Organization Group containing the devices to import and the Role created above, then click Save.

Configure the Connector in OverView

1. In OverView, go to Data Sources Settings > Sources.
2. Select Workspace ONE UEM and click Configure.
3. Fill in the API URL and the credentials of your deployment, then click Save Configuration.

Required Permissions

The role needs two resources, both at the Read level: the connector never creates, modifies or deletes anything in Workspace ONE UEM.

They cover the devices/search, devices/{id}/network, devices/{id}/apps, devices/{id}/compliance and system/users/search endpoints.

Official Documentation

• Using UEM Functionality With a REST API
• Rest API for Workspace ONE UEM
• Role Based Access
• Workspace ONE UEM API reference