Omnissa Workspace One UEM Plugin for Risk Exchange

This document explains how to configure the Omnissa Workspace One UEM v1.0.0 plugin with the Risk Exchange module of the Cloud Exchange platform. This plugin fetches Devices data from the Devices > Devices page on the Omnissa Workspace One UEM platform. This plugin supports Tagging and Untagging devices action on the Omnissa Workspace One UEM platform.

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Omnissa Workspace One UEM instance credentials (Client ID, Client Secret) for the API Token.
• Connectivity to the following OAuth URL:
  • https://uat.uemauth.workspaceone.com
  • https://na.uemauth.workspaceone.com
  • https://emea.uemauth.workspaceone.com
  • https://apac.uemauth.workspaceone.com

Omnissa Workspace One UEM Plugin Support

This plugin fetches Devices data from the Devices > Devices page on the Omnissa Workspace One UEM platform. This plugin supports Tagging and Untagging devices actions on the Omnissa Workspace One UEM platform.

Mappings

Mappings are used to view the pulled Devices and their respective details. Fields mapped during the plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.

Pull Mappings for Devices

Permissions 

You need one of these roles for creating the Client ID and Client Secret:

• Console Administrator
• Full admin access

{
    "access_token": "eyJhbGciOmtpZCI6IjQ2RUIyNjFFMjFERDkzOEQ5NTI2Q0Y3QzZCNjdDNEQyQTAyMUMyMEYiLCJ4NXQiOiJSdXNtSGlIZGs0MlZKczk4YTJmRTBxQWh3ZzgiLCJ0eXAiOiJhdCtqd3QifQ.eyJpc3MiOiJodHRwjOkZaS2APE9T7qpap2NEL_MivW9UUqgtwR4",
    "expires_in": 3600,
    "token_type": "Bearer",
    "scope": "uem-api"
}

{
    "ProductName": "AirWatch Platform Service",
    "ProductCopyright": "Copyright (c) Omnissa, LLC.",
    "ProductVersion": "24.10.709.25",
    "Version": 1,
    "Resources": {
        "Workspaces": [
            {
                "Name": "Mobile Device Management",
                "Location": "https://as1373.awmdm.com/api/mdm"
            },
            {
                "Name": "Mobile Application Management",
                "Location": "https://as1373.awmdm.com/api/mam"
            },
            {
                "Name": "Mobile Content Management",
                "Location": "https://as1373.awmdm.com/api/mcm"
            },
            {
                "Name": "Mobile Email Management",
                "Location": "https://as1373.awmdm.com/api/mem"
            },
            {
                "Name": "System Administration",
                "Location": "https://as1373.awmdm.com/api/system"
            }
        ],
        "Collections": []
    },
    "BuildKey": "17156688739",
    "CommitId": "24dc55607ca5b9e5a011a361f737b5decd140579",
    "ControlPlaneVersionDetails": {
        "ControlPlaneVersion": "0.5.0-2025.10.31-380-a11c9d6",
        "ControlPlaneServiceVersion": "main-2025.10.25-4149-e42c7397"
    }
}

{
    "Devices": [
        {
            "EasIds": {},
            "TimeZone": "",
            "tenant_uuid": "7698845c-4289-4a99-aa53-7e73b9425f9c",
            "Udid": "A75567492DCE1C291DAC0505FA4C7B1A8D49511256DB4DF31491667ACB6EC69C",
            "SerialNumber": "VMware-42 12 c1 41 44 e6 9b 42-38 fc 3f 10 b5 2d 27 ca",
            "MacAddress": "",
            "Imei": "",
            "EasId": "",
            "AssetNumber": "A75567492DCE1C291DAC0505FA4C7B1A8D49511256DB4DF31491667ACB6EC69C",
            "DeviceFriendlyName": "Ubuntu VM 10.50.8.224",
            "DeviceReportedName": "ubuntu-A75567492DCE1C291DAC0505FA4C7B1A8D49511256~",
            "LocationGroupId": {
                "Id": {
                    "Value": 1109
                },
                "Name": "Netskope Cloud Exchange",
                "Uuid": "7698845c-4289-4a99-aa53-7e73b9425f9c"
            },
            "LocationGroupName": "Netskope Cloud Exchange",
            "UserId": {
                "Id": {
                    "Value": 258470
                },
                "Name": "netskope user",
                "Uuid": "4d4130de-ec61-4fa0-8bd9-f8dd0ff56802"
            },
            "UserName": "admin",
            "DataProtectionStatus": 0,
            "UserEmailAddress": "netskope.user@netskope.com",
            "Ownership": "C",
            "PlatformId": {
                "Id": {
                    "Value": 21
                },
                "Name": "Linux"
            },
            "Platform": "Linux",
            "ModelId": {
                "Id": {
                    "Value": 99
                },
                "Name": "Ubuntu"
            },
            "Model": "Ubuntu",
            "OperatingSystem": "5.15.0",
            "PhoneNumber": "",
            "LastSeen": "2025-11-03T08:08:20.197",
            "EnrollmentStatus": "Enrolled",
            "ComplianceStatus": "Compliant",
            "CompromisedStatus": false,
            "LastEnrolledOn": "2025-09-22T06:23:01.173",
            "LastComplianceCheckOn": "0001-01-01T00:00:00.000",
            "LastCompromisedCheckOn": "2025-11-03T08:08:20.147",
            "IsSupervised": false,
            "VirtualMemory": 0,
            "OEMInfo": "ubuntu - 22.04 (Family: debian)",
            "IsDeviceDNDEnabled": false,
            "IsDeviceLocatorEnabled": false,
            "IsCloudBackupEnabled": false,
            "IsActivationLockEnabled": false,
            "IsNetworkTethered": false,
            "BatteryLevel": "",
            "IsRoaming": false,
            "SystemIntegrityProtectionEnabled": false,
            "ProcessorArchitecture": 65535,
            "EnrolledViaDEP": false,
            "TotalPhysicalMemory": 0,
            "AvailablePhysicalMemory": 0,
            "OSBuildVersion": "",
            "HostName": "",
            "LocalHostName": "",
            "SecurityPatchDate": "0001-01-01T00:00:00.000",
            "EnrollmentUserUuid": "00000000-0000-0000-0000-000000000000",
            "ManagedBy": 1,
            "WifiSsid": "",
            "DepTokenSource": 0,
            "Id": {
                "Value": 14839
            },
            "Uuid": "742dca04-d08d-4412-973b-892445f98d83"
        }
    ],
    "OrphanDevicesDetails": {
        "Devices": [],
        "Count": 0
    },
    "Page": 0,
    "PageSize": 500,
    "Total": 1
}

{
    "RoamingStatus": false,
    "DataRoamingEnabled": false,
    "VoiceRoamingEnabled": false,
    "IPAddress": {
        "EthernetIPAddress": "10.50.8.224",
        "EthernetIPAddress1": "192.168.250.1",
        "EthernetIPAddress2": "192.168.240.1",
        "EthernetIPAddress3": null,
        "EthernetIPAddress4": null,
        "EthernetIPAddress5": null,
        "EthernetIPAddress6": null
    },
    "DeviceNetworkInfo": [
        {
            "ConnectionType": "ethernet",
            "MACAddress": "00:50:56:92:EE:6D",
            "Name": "ens160"
        },
        {
            "ConnectionType": "ethernet",
            "MACAddress": "96:7C:25:B0:74:FD",
            "Name": "docker0"
        },
        {
            "ConnectionType": "ethernet",
            "MACAddress": "C2:DB:DA:E8:D3:A1",
            "Name": "br-0852de633790"
        },
        {
            "ConnectionType": "ethernet",
            "MACAddress": "26:8E:C8:0A:46:ED",
            "Name": "veth9686b78"
        },
        {
            "ConnectionType": "ethernet",
            "MACAddress": "F6:EC:24:D4:F7:66",
            "Name": "veth9818255"
        },
        {
            "ConnectionType": "ethernet",
            "MACAddress": "9A:D8:40:06:CA:4B",
            "Name": "veth43cf118"
        },
        {
            "ConnectionType": "ethernet",
            "MACAddress": "26:62:69:22:13:58",
            "Name": "vethb28fbf3"
        }
    ]
}

{
    "tags": [
        {
            "uuid": "c4bed485-61e0-40bb-bf89-edfe25303218",
            "name": "tag1",
            "date_tagged": "2025-09-23T12:36:46.357"
        },
        {
            "uuid": "4c0d5ea0-a63c-433b-9197-954bb5cfede5",
            "name": "tag2",
            "date_tagged": "2025-09-23T12:36:47.573"
        }
    ]
}

{
    "Tags": [
        {
            "Id": 10850,
            "TagName": "tag1",
            "TagType": 1,
            "LocationGroupId": 1109
        },
        {
            "Id": 10851,
            "TagName": "tag2",
            "TagType": 1,
            "LocationGroupId": 1109
        },
        {
            "Id": 10852,
            "TagName": "tag3",
            "TagType": 1,
            "LocationGroupId": 1109
        }
    ]
}

{
    "TagName": "tag4",
    "LocationGroupId": 1109
}

{
    "Value": 10853
}

{
    "BulkValues": {
        "Value": ["101,102,103"]
    }
}

{
    "TotalItems": 3,
    "AcceptedItems": 2,
    "FailedItems": 1,
    "Faults": {
        "Fault": [
            {
                "ErrorCode": 400,
                "ItemValue": "101",
                "Message": "The device may be inaccessible or invalid"
            }
        ]
    }
}

{
    "BulkValues": {
        "Value": ["101,102,103"]
    }
}

{
    "TotalItems": 3,
    "AcceptedItems": 2,
    "FailedItems": 1,
    "Faults": {
        "Fault": [
            {
                "ErrorCode": 400,
                "ItemValue": "101",
                "Message": "The device may be inaccessible or invalid"
            }
        ]
    }
}

Performance Matrix

Below is the performance matrix conducted on a Large CE Stack with below-mentioned specifications by pulling 500k devices..

User Agent

netskope-ce-6.0.0-cre-omnissa-workspace-one-uem-v1.0.0

Workflow

1. Get your Client ID and Client Secret from Omnissa platform.
2. Configure the Omnissa plugin.
3. Add a Business Rule for Omnissa.
4. Add an Action for Omnissa.
5. Validate the Omnissa plugin.

Watch a Video

Click play to watch a video:

Get your Client ID and Client Secret from Omnissa

1. Log in your Omnissa Workspace One UEM platform and go to Groups & Settings > Configurations.

   

2. Search for and select OAuth Client Management.

   

3. Click Add.

   

4. Enter a Name, Description, Organization Group, and select the Roles. Make sure you select the necessary roles mentioned in Permissions.

   

5. Click Save and copy the Client ID and Client Secret.

To get the API Base URL:

1. Go to Groups & Settings > All Settings > System > Advanced > API > Rest API.

   

2. Copy the Rest API URL.

Configure the Omnissa Workspace One UEM Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Omnissa Workspace One UEM v1.0.0 (CRE) plugin box.

   

2. Add a Configuration Name and change the Sync Interval if needed.

   

3. Click Next and enter the Configuration Parameters:
   • API Base URL: API Base URL of the Omnissa Workspace One UEM tenant. Make sure to remove the /api prefix from the URL if present.
   • OAuth URL: OAuth URL of the Omnissa Workspace One UEM tenant.
   • Client ID: Client ID for the Omnissa Workspace One UEM tenant.
   • Client Secret: Client Secret for the Omnissa Workspace One UEM tenant.
   • Pull Device Tags: Pull Device Tags from the Omnissa Workspace One UEM tenant.

   

   Note

   You can check your OAuth URL using this documentation.

4. Click Next. Select the Entity from the dropdown and provide the field mapping per your requirements.

   To create a new field under any entity, click Add field.

   

   Next provide the Field Label, Data type, enable Unique (or not) and select the Aggregate Strategy. When finished, click Save.

   

   Suggested mappings:

   

   

5. Click Save.

   

Add a Risk Exchange Business Rule for Omnissa Workspace One UEM

1. In Risk Exchange, go to Business Rules and click Create New Rule.
2. Enter a Rule Name and select the Entity for which the user records are stored, and then configure the query based on your requirements.

   

4. Click Save.

   

Add Risk Exchange Actions for Omnissa Workspace One UEM

CRE Omnissa Workspace One UEM supports the following two action types:

• Tag Device: Users can add tags to the devices using this action.
• Untag Device: Users can remove tags from the devices using this action.
• No Action: No action will be performed for this action. Users can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

Steps to Configure the Actions

Tag a Device

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Configuration, and the Tag Device Action from their respective dropdowns.
   • Device ID: This field can be mapped to Source field Device ID, or can be static when you provide Device ID as a string.
   • Tag: This field can be mapped to Source field Tags, or can be static when you provide comma-separated values for tags per your requirements.
     Format: Tag1,Tag2,Tag3
   • Organization ID: This field can be mapped to Source field Organization ID, or can be static when you provide Organization ID as a string.

   

3. Enable the Require Approval toggle if approval is needed before performing an action on the Devices.
4. Click Save.

   

Untag a Device

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Configuration, and the Untag Device Action from their respective dropdowns.
   • Device ID: This field can be mapped to Source field Device ID, or can be static when you provide Device ID as a string.
   • Tag: This field can be mapped to Source field Tags, or can be static when you provide comma-separated values for tags per your requirements.
     Format: Tag1,Tag2,Tag3
   • Organization ID: This field can be mapped to Source field Organization ID, or can be static when you provide Organization ID as a string.

   

3. Enable the Require Approval toggle if approval is needed before performing an action on the Devices.
4. Click Save.

   

No Action

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Configuration, and the No Action Action from their respective dropdowns.
3. Enable the Generate Alert toggle to generate alerts in Ticket Orchestrator.
4. Enable the Require Approval toggle if approval is needed before performing an action on the Devices.
5. Click on Save.

   

Validate the Omnissa Workspace One UEM Plugin

Validate in Cloud Exchange

1. In Risk Exchange, go to Records. Select the Entity that was selected while configuring the field mapping for Devices to view the pulled Devices.

   

2. Go to Logging and search for the logs of the plugin.

   

3. Go to the Logging to verify the action performed for a Device. You can apply the filter with the plugin name or plugin configuration name.

   Logs for the Tag Device action:

   

   Logs for the Untag Device action:

   

4.  When a user matches one of the configured business rules, the configured action will be performed on the user. This can be seen at Cloud Exchange > Action Logs.

   

Validate on Omnissa Workspace One UEM

The Devices are pulled from the Devices > Devices page from the Omnissa Workspace One UEM.

For Tag Device and Untag Device actions:

1. Click More Actions in the upper right corner and go to Manage Tags.

   

2. You will see the assigned tags to that particular device.

   

Troubleshooting the Omnissa Workspace One UEM Plugin

Unable to configure the Omnissa Workspace One UEM plugin

If you are unable to configure the Omnissa Workspace One UEM plugin, it may be due to one of these reasons:

• Provided Incorrect Client ID and/or Client Secret.
• Provided Credentials that don’t have sufficient permissions.

What to do:

To resolve these issues, verify the Client ID and Client Secret, and that the permissions/roles are correct.

Unable to pull Devices from Omnissa Workspace One UEM

If you are unable to pull Devices from the Omnissa Workspace One UEM plugin, it may be due to one of these reasons:

• No Devices are present on the Omnissa Workspace One UEM platform.
• An error is received while pulling Devices from the platform.
• Mapping was not added while configuring the plugin in the entity source page.

What to do:

To resolve these issues:

1. Check on the Omnissa Workspace One UEM platform if Devices exist or not.
2. Receiving 500 error: The server might be down, wait for a while and check later.
3. Receiving 403 error: The plugin configuration parameter does not have sufficient permissions or the credentials no longer exist. Verify the permission for the Client ID and Secret.
4. If there is no error in the logs, it might be the case that the Devices are not available on the Platform to pull. Check the Device available on Omnissa Workspace One UEM and confirm the same.
5. Make sure that the mapping is added and the “Device ID” field is mapped while configuring the plugin.

Unable to View Devices details on the Records page

If you are unable to view Devices details on the record table, it could be due to the Mapping for all the Omnissa Workspace One UEM fields were not provided while configuring the Omnissa Workspace One UEM plugin.

What to do:

To resolve this issue:

1. Make sure to provide the needed mapping while configuring the plugin.
2. Make sure that the fields created in an entity are according to the Mapping.

Unable to perform action on the Devices

If you are unable to perform action on the Device, it could be due to one of these reasons.

• Insufficient permission was provided for the action.
• Receiving error while performing an action.
• The device is not present on the Omnissa Workspace One UEM Platform.
• The Require Approval toggle button was enabled while configuring the Action, but the request is not approved.

What to do:

To resolve these issues:

1. Insufficient permission was provided for the action. Verify if the required permission is provided.
2. Go to the Omnissa Workspace One UEM Platform and verify if the Device for which an action needs to be performed is present or not.
3. Go to Action Logs and select the logs that you want to approve the requests for. Click the Approve icon, or disable the Require Approval toggle from the configured Action, and perform the action again.