This document explains how to configure the Omnissa Workspace One UEM v1.0.0 plugin with the Risk Exchange module of the Cloud Exchange platform. This plugin fetches Devices data from the Devices > Devices page on the Omnissa Workspace One UEM platform. This plugin supports Tagging and Untagging devices action on the Omnissa Workspace One UEM platform.
Prerequisites
To complete this integration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances).
- A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
- Omnissa Workspace One UEM instance credentials (Client ID, Client Secret) for the API Token.
- Connectivity to the following OAuth URL:
- https://uat.uemauth.workspaceone.com
- https://na.uemauth.workspaceone.com
- https://emea.uemauth.workspaceone.com
- https://apac.uemauth.workspaceone.com
Omnissa Workspace One UEM Plugin Support
This plugin fetches Devices data from the Devices > Devices page on the Omnissa Workspace One UEM platform. This plugin supports Tagging and Untagging devices actions on the Omnissa Workspace One UEM platform.
| Type of Data Pulled | Actions Supported |
|---|---|
| Devices | Tag Device Untag Device |
Mappings
Mappings are used to view the pulled Devices and their respective details. Fields mapped during the plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.
Pull Mappings for Devices
| Plugin Field Label | Expected Data Type | Suggested Field Label | Suggested Aggregate Strategy |
|---|---|---|---|
| Device Uuid | String | Device Uuid | Unique |
| Device ID | String | Device ID | Unique |
| Organization ID | String | Organization ID | Unique |
| Mac Address | String | Mac Address | Overwrite |
| Device Serial Number | String | Device Serial Number | Unique |
| IMEI | String | IMEI | Overwrite |
| Asset Number | String | Asset Number | Overwrite |
| Devicename | String | Devicename | Overwrite |
| Local Devicename | String | Local Devicename | Overwrite |
| User Name | String | User Name | Overwrite |
| User Email Address | String | User Email Address | Overwrite |
| Compliance Status | String | Compliance Status | Overwrite |
| Compromised Status | String | Compromised Status | Overwrite |
| Enrollment Status | String | Enrollment Status | Overwrite |
| Udid | String | Udid | Overwrite |
| Eas ID | String | Eas ID | Overwrite |
| Device Friendly Name | String | Device Friendly Name | Overwrite |
| Device Reported Name | String | Device Reported Name | Overwrite |
| Organization Name | String | Organization Name | Overwrite |
| Platform | String | Platform | Overwrite |
| Model | String | Model | Overwrite |
| Operating System | String | Operating System | Overwrite |
| Last Seen | String | Last Seen | Overwrite |
| OS Build Version | String | OS Build Version | Overwrite |
Note
If you have the same records across multiple plugins, make sure you map the same field in the plugins. The Serial Number is a common field across Omnissa, CrowdStrike, and Netskope, so if you want to have common devices stored in a single record, make sure to have the serial number field unique and common across the platforms.
Permissions
You need one of these roles for creating the Client ID and Client Secret:
- Console Administrator
- Full admin access
API Details
List of APIs Used
| API Description | Method | Endpoint |
|---|---|---|
| Generate Auth Token | POST | /connect/token |
| Validate Connectivity | GET | /api/system/info |
| Fetch Devices | GET | /api/mdm/devices/search |
| Fetch Device Network Info | GET | /api/mdm/devices/<device_id>/network |
| Fetch Device Tags | GET | /api/mdm/devices/<device_uuid>/tags |
| Fetch All Tags | GET | /api/system/groups/<organization_id>/tags |
| Create Tag | POST | /api/mdm/tags/addtag |
| Tag Device | POST | /api/mdm/tags/<tag_id>/adddevices |
| Untag Device | POST | /api/mdm/tags/<tag_id>/removedevices |
Generate Auth Token
API Endpoint: /connect/token
Method: POST
Headers
| Key | Value |
|---|---|
| Content-Type | application/x-www-form-urlencoded |
| Authorization | Basic base64encoded(client_id:client_secret) |
Request Body
| Key | Value |
|---|---|
| grant_type | Client_credentials |
Sample Response
{
"access_token": "eyJhbGciOmtpZCI6IjQ2RUIyNjFFMjFERDkzOEQ5NTI2Q0Y3QzZCNjdDNEQyQTAyMUMyMEYiLCJ4NXQiOiJSdXNtSGlIZGs0MlZKczk4YTJmRTBxQWh3ZzgiLCJ0eXAiOiJhdCtqd3QifQ.eyJpc3MiOiJodHRwjOkZaS2APE9T7qpap2NEL_MivW9UUqgtwR4",
"expires_in": 3600,
"token_type": "Bearer",
"scope": "uem-api"
}
Validate Connectivity
API Endpoint: /api/system/info
Method: GET
Sample Response:
{
"ProductName": "AirWatch Platform Service",
"ProductCopyright": "Copyright (c) Omnissa, LLC.",
"ProductVersion": "24.10.709.25",
"Version": 1,
"Resources": {
"Workspaces": [
{
"Name": "Mobile Device Management",
"Location": "https://as1373.awmdm.com/api/mdm"
},
{
"Name": "Mobile Application Management",
"Location": "https://as1373.awmdm.com/api/mam"
},
{
"Name": "Mobile Content Management",
"Location": "https://as1373.awmdm.com/api/mcm"
},
{
"Name": "Mobile Email Management",
"Location": "https://as1373.awmdm.com/api/mem"
},
{
"Name": "System Administration",
"Location": "https://as1373.awmdm.com/api/system"
}
],
"Collections": []
},
"BuildKey": "17156688739",
"CommitId": "24dc55607ca5b9e5a011a361f737b5decd140579",
"ControlPlaneVersionDetails": {
"ControlPlaneVersion": "0.5.0-2025.10.31-380-a11c9d6",
"ControlPlaneServiceVersion": "main-2025.10.25-4149-e42c7397"
}
}
Fetch Devices
API Endpoint: /api/mdm/devices/search
Method: GET
Headers
| Key | Value |
|---|---|
| Authorization | Bearer <access_token> |
| Accept | application/json;version=2 |
Query Parameters
| Key | Value |
|---|---|
| page | number |
| page_size | 500 |
| sort | last_seen |
| sort_order | ASC |
Sample Response
{
"Devices": [
{
"EasIds": {},
"TimeZone": "",
"tenant_uuid": "7698845c-4289-4a99-aa53-7e73b9425f9c",
"Udid": "A75567492DCE1C291DAC0505FA4C7B1A8D49511256DB4DF31491667ACB6EC69C",
"SerialNumber": "VMware-42 12 c1 41 44 e6 9b 42-38 fc 3f 10 b5 2d 27 ca",
"MacAddress": "",
"Imei": "",
"EasId": "",
"AssetNumber": "A75567492DCE1C291DAC0505FA4C7B1A8D49511256DB4DF31491667ACB6EC69C",
"DeviceFriendlyName": "Ubuntu VM 10.50.8.224",
"DeviceReportedName": "ubuntu-A75567492DCE1C291DAC0505FA4C7B1A8D49511256~",
"LocationGroupId": {
"Id": {
"Value": 1109
},
"Name": "Netskope Cloud Exchange",
"Uuid": "7698845c-4289-4a99-aa53-7e73b9425f9c"
},
"LocationGroupName": "Netskope Cloud Exchange",
"UserId": {
"Id": {
"Value": 258470
},
"Name": "netskope user",
"Uuid": "4d4130de-ec61-4fa0-8bd9-f8dd0ff56802"
},
"UserName": "admin",
"DataProtectionStatus": 0,
"UserEmailAddress": "netskope.user@netskope.com",
"Ownership": "C",
"PlatformId": {
"Id": {
"Value": 21
},
"Name": "Linux"
},
"Platform": "Linux",
"ModelId": {
"Id": {
"Value": 99
},
"Name": "Ubuntu"
},
"Model": "Ubuntu",
"OperatingSystem": "5.15.0",
"PhoneNumber": "",
"LastSeen": "2025-11-03T08:08:20.197",
"EnrollmentStatus": "Enrolled",
"ComplianceStatus": "Compliant",
"CompromisedStatus": false,
"LastEnrolledOn": "2025-09-22T06:23:01.173",
"LastComplianceCheckOn": "0001-01-01T00:00:00.000",
"LastCompromisedCheckOn": "2025-11-03T08:08:20.147",
"IsSupervised": false,
"VirtualMemory": 0,
"OEMInfo": "ubuntu - 22.04 (Family: debian)",
"IsDeviceDNDEnabled": false,
"IsDeviceLocatorEnabled": false,
"IsCloudBackupEnabled": false,
"IsActivationLockEnabled": false,
"IsNetworkTethered": false,
"BatteryLevel": "",
"IsRoaming": false,
"SystemIntegrityProtectionEnabled": false,
"ProcessorArchitecture": 65535,
"EnrolledViaDEP": false,
"TotalPhysicalMemory": 0,
"AvailablePhysicalMemory": 0,
"OSBuildVersion": "",
"HostName": "",
"LocalHostName": "",
"SecurityPatchDate": "0001-01-01T00:00:00.000",
"EnrollmentUserUuid": "00000000-0000-0000-0000-000000000000",
"ManagedBy": 1,
"WifiSsid": "",
"DepTokenSource": 0,
"Id": {
"Value": 14839
},
"Uuid": "742dca04-d08d-4412-973b-892445f98d83"
}
],
"OrphanDevicesDetails": {
"Devices": [],
"Count": 0
},
"Page": 0,
"PageSize": 500,
"Total": 1
}
Fetch Device Network Info
API Endpoint: /api/mdm/devices/<device_id>/network
Method: GET
Headers
| Key | Value |
|---|---|
| Authorization | Bearer <access_token> |
| Accept | application/json;version=1 |
Path Parameter
| Key | Value |
|---|---|
| device_id | 12345 |
Sample Response
{
"RoamingStatus": false,
"DataRoamingEnabled": false,
"VoiceRoamingEnabled": false,
"IPAddress": {
"EthernetIPAddress": "10.50.8.224",
"EthernetIPAddress1": "192.168.250.1",
"EthernetIPAddress2": "192.168.240.1",
"EthernetIPAddress3": null,
"EthernetIPAddress4": null,
"EthernetIPAddress5": null,
"EthernetIPAddress6": null
},
"DeviceNetworkInfo": [
{
"ConnectionType": "ethernet",
"MACAddress": "00:50:56:92:EE:6D",
"Name": "ens160"
},
{
"ConnectionType": "ethernet",
"MACAddress": "96:7C:25:B0:74:FD",
"Name": "docker0"
},
{
"ConnectionType": "ethernet",
"MACAddress": "C2:DB:DA:E8:D3:A1",
"Name": "br-0852de633790"
},
{
"ConnectionType": "ethernet",
"MACAddress": "26:8E:C8:0A:46:ED",
"Name": "veth9686b78"
},
{
"ConnectionType": "ethernet",
"MACAddress": "F6:EC:24:D4:F7:66",
"Name": "veth9818255"
},
{
"ConnectionType": "ethernet",
"MACAddress": "9A:D8:40:06:CA:4B",
"Name": "veth43cf118"
},
{
"ConnectionType": "ethernet",
"MACAddress": "26:62:69:22:13:58",
"Name": "vethb28fbf3"
}
]
}
Fetch Device Tags
API Endpoint: /api/mdm/devices/<device_uuid>/tags
Method: GET
Headers
| Key | Value |
|---|---|
| Authorization | Bearer <access_token> |
| Accept | application/json;version=1 |
Path Parameters
| Key | Value |
|---|---|
| device_uuid | 742dca04-d08d-4412-973b-892445f98d83 |
Sample Response
{
"tags": [
{
"uuid": "c4bed485-61e0-40bb-bf89-edfe25303218",
"name": "tag1",
"date_tagged": "2025-09-23T12:36:46.357"
},
{
"uuid": "4c0d5ea0-a63c-433b-9197-954bb5cfede5",
"name": "tag2",
"date_tagged": "2025-09-23T12:36:47.573"
}
]
}
Fetch All Tags
API Endpoint: /api/system/groups/<organization_id>/tags
Method: GET
Headers
| Key | Value |
|---|---|
| Authorization | Bearer <access_token> |
| Accept | application/json;version=1 |
Path Parameters
| Key | Value |
|---|---|
| organization_id | 1109 |
Sample Response
{
"Tags": [
{
"Id": 10850,
"TagName": "tag1",
"TagType": 1,
"LocationGroupId": 1109
},
{
"Id": 10851,
"TagName": "tag2",
"TagType": 1,
"LocationGroupId": 1109
},
{
"Id": 10852,
"TagName": "tag3",
"TagType": 1,
"LocationGroupId": 1109
}
]
}
Create Tag
API Endpoint: /api/mdm/tags/addtag
Method: POST
Headers
| Key | Value |
|---|---|
| Authorization | Bearer <access_token> |
| Accept | application/json;version=1 |
Request Body
{
"TagName": "tag4",
"LocationGroupId": 1109
}
Sample Response
{
"Value": 10853
}
Tag Devices
API Endpoint: /api/mdm/tags/<tag_id>/adddevices
Method: POST
Path Parameters
| Key | Value |
|---|---|
| tag_id | 10851 |
Headers
| Key | Value |
|---|---|
| Authorization | Bearer <access_token> |
| Accept | application/json;version=1 |
Request Body
{
"BulkValues": {
"Value": ["101,102,103"]
}
}
Sample Response
{
"TotalItems": 3,
"AcceptedItems": 2,
"FailedItems": 1,
"Faults": {
"Fault": [
{
"ErrorCode": 400,
"ItemValue": "101",
"Message": "The device may be inaccessible or invalid"
}
]
}
}
Untag Devices
API Endpoint: /api/mdm/tags/<tag_id>/removedevices
Method: POST
Path Parameters
| Key | Value |
|---|---|
| tag_id | 10851 |
Headers
| Key | Value |
|---|---|
| Authorization | Bearer <access_token> |
| Accept | application/json;version=1 |
Request Body
{
"BulkValues": {
"Value": ["101,102,103"]
}
}
Sample Response
{
"TotalItems": 3,
"AcceptedItems": 2,
"FailedItems": 1,
"Faults": {
"Fault": [
{
"ErrorCode": 400,
"ItemValue": "101",
"Message": "The device may be inaccessible or invalid"
}
]
}
}
Performance Matrix
Below is the performance matrix conducted on a Large CE Stack with below-mentioned specifications by pulling 500k devices..
| Description | Specification |
|---|---|
| Stack details | Size: Large RAM: 32 GB CPU: 16 Cores |
| Devices fetched from Omnissa Workspace One UEM | ~70 minutes |
Note
We have validated the plugin with Microsoft (Windows), Linux, macOS, ipadOS, and IOS devices.
User Agent
netskope-ce-6.0.0-cre-omnissa-workspace-one-uem-v1.0.0
Workflow
- Get your Client ID and Client Secret from Omnissa platform.
- Configure the Omnissa plugin.
- Add a Business Rule for Omnissa.
- Add an Action for Omnissa.
- Validate the Omnissa plugin.
Watch a Video
Click play to watch a video:
Get your Client ID and Client Secret from Omnissa
- Log in your Omnissa Workspace One UEM platform and go to Groups & Settings > Configurations.
- Search for and select OAuth Client Management.
- Click Add.
- Enter a Name, Description, Organization Group, and select the Roles. Make sure you select the necessary roles mentioned in Permissions.
- Click Save and copy the Client ID and Client Secret.
To get the API Base URL:
- Go to Groups & Settings > All Settings > System > Advanced > API > Rest API.
- Copy the Rest API URL.
Note
Make sure to remove the /api from the URL if it exists.
Configure the Omnissa Workspace One UEM Plugin
- In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Omnissa Workspace One UEM v1.0.0 (CRE) plugin box.
- Add a Configuration Name and change the Sync Interval if needed.
- Click Next and enter the Configuration Parameters:
- API Base URL: API Base URL of the Omnissa Workspace One UEM tenant. Make sure to remove the /api prefix from the URL if present.
- OAuth URL: OAuth URL of the Omnissa Workspace One UEM tenant.
- Client ID: Client ID for the Omnissa Workspace One UEM tenant.
- Client Secret: Client Secret for the Omnissa Workspace One UEM tenant.
- Pull Device Tags: Pull Device Tags from the Omnissa Workspace One UEM tenant.
Note
You can check your OAuth URL using this documentation.
- Click Next. Select the Entity from the dropdown and provide the field mapping per your requirements.
To create a new field under any entity, click Add field.
Next provide the Field Label, Data type, enable Unique (or not) and select the Aggregate Strategy. When finished, click Save.
Suggested mappings:
- Click Save.
Add a Risk Exchange Business Rule for Omnissa Workspace One UEM
- In Risk Exchange, go to Business Rules and click Create New Rule.
- Enter a Rule Name and select the Entity for which the user records are stored, and then configure the query based on your requirements.
- Click Save.
Add Risk Exchange Actions for Omnissa Workspace One UEM
CRE Omnissa Workspace One UEM supports the following two action types:
- Tag Device: Users can add tags to the devices using this action.
- Untag Device: Users can remove tags from the devices using this action.
- No Action: No action will be performed for this action. Users can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.
Note
You can perform the actions on the devices pulled from Omnissa Workspace One UEM on the Netskope Tenant. To learn more about performing the user-related actions on Netskope, refer to the Netskope’s plugin guide.
Steps to Configure the Actions
Tag a Device
- In Risk Exchange, go to Actions and click Add Action Configuration.
- Select the required Business Rule, Configuration, and the Tag Device Action from their respective dropdowns.
- Device ID: This field can be mapped to Source field Device ID, or can be static when you provide Device ID as a string.
- Tag: This field can be mapped to Source field Tags, or can be static when you provide comma-separated values for tags per your requirements.
Format: Tag1,Tag2,Tag3 - Organization ID: This field can be mapped to Source field Organization ID, or can be static when you provide Organization ID as a string.
- Enable the Require Approval toggle if approval is needed before performing an action on the Devices.
- Click Save.
Untag a Device
- In Risk Exchange, go to Actions and click Add Action Configuration.
- Select the required Business Rule, Configuration, and the Untag Device Action from their respective dropdowns.
- Device ID: This field can be mapped to Source field Device ID, or can be static when you provide Device ID as a string.
- Tag: This field can be mapped to Source field Tags, or can be static when you provide comma-separated values for tags per your requirements.
Format: Tag1,Tag2,Tag3 - Organization ID: This field can be mapped to Source field Organization ID, or can be static when you provide Organization ID as a string.
- Enable the Require Approval toggle if approval is needed before performing an action on the Devices.
- Click Save.
No Action
- In Risk Exchange, go to Actions and click Add Action Configuration.
- Select the required Business Rule, Configuration, and the No Action Action from their respective dropdowns.
- Enable the Generate Alert toggle to generate alerts in Ticket Orchestrator.
- Enable the Require Approval toggle if approval is needed before performing an action on the Devices.
- Click on Save.
Validate the Omnissa Workspace One UEM Plugin
Validate in Cloud Exchange
- In Risk Exchange, go to Records. Select the Entity that was selected while configuring the field mapping for Devices to view the pulled Devices.
- Go to Logging and search for the logs of the plugin.
- Go to the Logging to verify the action performed for a Device. You can apply the filter with the plugin name or plugin configuration name.
Logs for the Tag Device action:
Logs for the Untag Device action:
- When a user matches one of the configured business rules, the configured action will be performed on the user. This can be seen at Cloud Exchange > Action Logs.
Validate on Omnissa Workspace One UEM
The Devices are pulled from the Devices > Devices page from the Omnissa Workspace One UEM.
For Tag Device and Untag Device actions:
- Click More Actions in the upper right corner and go to Manage Tags.
- You will see the assigned tags to that particular device.
Troubleshooting the Omnissa Workspace One UEM Plugin
Unable to configure the Omnissa Workspace One UEM plugin
If you are unable to configure the Omnissa Workspace One UEM plugin, it may be due to one of these reasons:
- Provided Incorrect Client ID and/or Client Secret.
- Provided Credentials that don’t have sufficient permissions.
What to do:
To resolve these issues, verify the Client ID and Client Secret, and that the permissions/roles are correct.
Unable to pull Devices from Omnissa Workspace One UEM
If you are unable to pull Devices from the Omnissa Workspace One UEM plugin, it may be due to one of these reasons:
- No Devices are present on the Omnissa Workspace One UEM platform.
- An error is received while pulling Devices from the platform.
- Mapping was not added while configuring the plugin in the entity source page.
What to do:
To resolve these issues:
- Check on the Omnissa Workspace One UEM platform if Devices exist or not.
- Receiving 500 error: The server might be down, wait for a while and check later.
- Receiving 403 error: The plugin configuration parameter does not have sufficient permissions or the credentials no longer exist. Verify the permission for the Client ID and Secret.
- If there is no error in the logs, it might be the case that the Devices are not available on the Platform to pull. Check the Device available on Omnissa Workspace One UEM and confirm the same.
- Make sure that the mapping is added and the “Device ID” field is mapped while configuring the plugin.
Unable to View Devices details on the Records page
If you are unable to view Devices details on the record table, it could be due to the Mapping for all the Omnissa Workspace One UEM fields were not provided while configuring the Omnissa Workspace One UEM plugin.
What to do:
To resolve this issue:
- Make sure to provide the needed mapping while configuring the plugin.
- Make sure that the fields created in an entity are according to the Mapping.
Unable to perform action on the Devices
If you are unable to perform action on the Device, it could be due to one of these reasons.
- Insufficient permission was provided for the action.
- Receiving error while performing an action.
- The device is not present on the Omnissa Workspace One UEM Platform.
- The Require Approval toggle button was enabled while configuring the Action, but the request is not approved.
What to do:
To resolve these issues:
- Insufficient permission was provided for the action. Verify if the required permission is provided.
- Go to the Omnissa Workspace One UEM Platform and verify if the Device for which an action needs to be performed is present or not.
- Go to Action Logs and select the logs that you want to approve the requests for. Click the Approve icon, or disable the Require Approval toggle from the configured Action, and perform the action again.