# Connect Workspace ONE UEM

Canonical URL: https://docs.fuse.init.inc/integrations/workspace-one-uem/setup

Create an Omnissa Workspace ONE UEM OAuth client and submit API, token, and tenant fields to Init.



## Before you start [#before-you-start]

Workspace ONE UEM uses **customer client credentials** (`oauth2_client_credentials` + `customer_credentials`). There is no Init platform OAuth app for this provider.

**Connection admin/user** enables REST API access, creates an OAuth client, copies the AW tenant code, and submits the multi-field Connect payload.

You need:

* A Workspace ONE UEM administrator who can manage OAuth clients and REST API settings at the target organization group.
* The SaaS REST API hostname (`*.awmdm.com`), regional token host, AW tenant code (API key), and organization-group UUID.
* Access to Init Connect for the tenant that will own the connection.

## Configure the provider [#configure-the-provider]

### Enable REST API and create an OAuth client (**Connection admin/user**) [#enable-rest-api-and-create-an-oauth-client-connection-adminuser]

1. In the Workspace ONE UEM console, open **Groups & Settings → All Settings → System → Advanced → API → REST API**.
2. Enable API access and copy the **API key** (used as `aw_tenant_code`) plus the REST API URL host under `*.awmdm.com`.
3. Open **Groups & Settings → Configurations → OAuth Client Management** and add an OAuth client scoped to the organization group Init should use.
4. Copy the **client ID** and **client secret** when shown. The secret is displayed once.
5. Note the **organization group UUID** for the OG the client is authorized against.
6. Select the regional OAuth token URL for your SaaS region (for example `https://na.uemauth.workspaceone.com/connect/token`). Allowed hosts are `na`, `emea`, `apac`, and `uat` under `uemauth.workspaceone.com`.

There is no one-time Init platform Workspace ONE registration.

## Connect to Init [#connect-to-init]

**Connection admin/user** starts a Workspace ONE UEM Connect session and submits:

| Field                     | Required | Notes                                                                                                  |
| ------------------------- | -------- | ------------------------------------------------------------------------------------------------------ |
| `api_url`                 | Yes      | HTTPS REST API origin on `*.awmdm.com`.                                                                |
| `token_url`               | Yes      | HTTPS regional token URL ending in `/connect/token` on an allowlisted `uemauth.workspaceone.com` host. |
| `client_id`               | Yes      | OAuth client ID from UEM.                                                                              |
| `client_secret`           | Yes      | OAuth client secret.                                                                                   |
| `aw_tenant_code`          | Yes      | REST API key sent as the `aw-tenant-code` header.                                                      |
| `organization_group_uuid` | Yes      | UUID of the organization group for this connection.                                                    |
| `token_auth_method`       | No       | `client_secret_basic` (default when omitted) or `client_secret_post`.                                  |

Use inert placeholders such as `example-token-not-valid` in documentation only. Never paste live secrets or tenant codes into tickets.

## Permissions [#permissions]

OAuth client and organization-group assignment control which UEM resources Init can read. Align the client’s OG and role with the generated action requirements.

REST API access must remain enabled, and the AW tenant code must belong to the same customer environment as `api_url`.

## Verify the connection [#verify-the-connection]

1. Complete Connect and confirm the connection is active.
2. Run Init’s connection test or a safe read such as listing organization groups or devices under the connected OG.
3. Success looks like UEM returning JSON for that OG without `401` token errors or invalid tenant-code responses.

## Rotate or revoke access [#rotate-or-revoke-access]

1. Create a new OAuth client secret (or a replacement OAuth client) in Workspace ONE UEM.
2. Reconnect in Init with the updated `client_id` / `client_secret` and the same API URL, token URL, AW tenant code, and organization-group UUID unless those also changed.
3. Disable or delete the previous OAuth client after cutover.
4. Rotate the REST API key in UEM if the AW tenant code was exposed, then reconnect with the new `aw_tenant_code`.

## Troubleshooting [#troubleshooting]

| Symptom                             | What to check                                                                                   |
| ----------------------------------- | ----------------------------------------------------------------------------------------------- |
| Connect rejects `api_url`           | Must be HTTPS on `*.awmdm.com`.                                                                 |
| Connect rejects `token_url`         | Host must be an allowlisted regional `uemauth.workspaceone.com` URL with path `/connect/token`. |
| `401` on token exchange             | Client ID/secret mismatch, wrong `token_auth_method`, or disabled OAuth client.                 |
| Invalid tenant / API key errors     | `aw_tenant_code` does not match the REST API key for that environment.                          |
| Empty or wrong OG data              | `organization_group_uuid` must be the UUID the OAuth client is authorized for.                  |
| Connect rejects `token_auth_method` | Use only `client_secret_basic` or `client_secret_post`.                                         |