FuseFuse
IntegrationsWorkspace ONE UEM

Connect Workspace ONE UEM

Create an Omnissa Workspace ONE UEM OAuth client and submit API, token, and tenant fields to Init.

Agent markdown

Before you start

Workspace ONE UEM uses customer client credentials (oauth2_client_credentials + customer_credentials). There is no Init platform OAuth app for this provider.

Connection admin/user enables REST API access, creates an OAuth client, copies the AW tenant code, and submits the multi-field Connect payload.

You need:

  • A Workspace ONE UEM administrator who can manage OAuth clients and REST API settings at the target organization group.
  • The SaaS REST API hostname (*.awmdm.com), regional token host, AW tenant code (API key), and organization-group UUID.
  • Access to Init Connect for the tenant that will own the connection.

Configure the provider

Enable REST API and create an OAuth client (Connection admin/user)

  1. In the Workspace ONE UEM console, open Groups & Settings → All Settings → System → Advanced → API → REST API.
  2. Enable API access and copy the API key (used as aw_tenant_code) plus the REST API URL host under *.awmdm.com.
  3. Open Groups & Settings → Configurations → OAuth Client Management and add an OAuth client scoped to the organization group Init should use.
  4. Copy the client ID and client secret when shown. The secret is displayed once.
  5. Note the organization group UUID for the OG the client is authorized against.
  6. Select the regional OAuth token URL for your SaaS region (for example https://na.uemauth.workspaceone.com/connect/token). Allowed hosts are na, emea, apac, and uat under uemauth.workspaceone.com.

There is no one-time Init platform Workspace ONE registration.

Connect to Init

Connection admin/user starts a Workspace ONE UEM Connect session and submits:

FieldRequiredNotes
api_urlYesHTTPS REST API origin on *.awmdm.com.
token_urlYesHTTPS regional token URL ending in /connect/token on an allowlisted uemauth.workspaceone.com host.
client_idYesOAuth client ID from UEM.
client_secretYesOAuth client secret.
aw_tenant_codeYesREST API key sent as the aw-tenant-code header.
organization_group_uuidYesUUID of the organization group for this connection.
token_auth_methodNoclient_secret_basic (default when omitted) or client_secret_post.

Use inert placeholders such as example-token-not-valid in documentation only. Never paste live secrets or tenant codes into tickets.

Permissions

OAuth client and organization-group assignment control which UEM resources Init can read. Align the client’s OG and role with the generated action requirements.

REST API access must remain enabled, and the AW tenant code must belong to the same customer environment as api_url.

Verify the connection

  1. Complete Connect and confirm the connection is active.
  2. Run Init’s connection test or a safe read such as listing organization groups or devices under the connected OG.
  3. Success looks like UEM returning JSON for that OG without 401 token errors or invalid tenant-code responses.

Rotate or revoke access

  1. Create a new OAuth client secret (or a replacement OAuth client) in Workspace ONE UEM.
  2. Reconnect in Init with the updated client_id / client_secret and the same API URL, token URL, AW tenant code, and organization-group UUID unless those also changed.
  3. Disable or delete the previous OAuth client after cutover.
  4. Rotate the REST API key in UEM if the AW tenant code was exposed, then reconnect with the new aw_tenant_code.

Troubleshooting

SymptomWhat to check
Connect rejects api_urlMust be HTTPS on *.awmdm.com.
Connect rejects token_urlHost must be an allowlisted regional uemauth.workspaceone.com URL with path /connect/token.
401 on token exchangeClient ID/secret mismatch, wrong token_auth_method, or disabled OAuth client.
Invalid tenant / API key errorsaw_tenant_code does not match the REST API key for that environment.
Empty or wrong OG dataorganization_group_uuid must be the UUID the OAuth client is authorized for.
Connect rejects token_auth_methodUse only client_secret_basic or client_secret_post.

Workspace ONE UEM

Omnissa Workspace ONE UEM organization groups, devices, apps, profiles, and users.

Workspace ONE UEM actions

On this page

Before you startConfigure the providerEnable REST API and create an OAuth client (Connection admin/user)Connect to InitPermissionsVerify the connectionRotate or revoke accessTroubleshooting