VMware Workspace ONE UEM integration guide

In the Workspace ONE UEM console, select Global and then select the customer-level organization group.

Navigate to Accounts.

Expand Administrators and click Roles.

Click Add Role, and in the window that opens, provide the name and a description.

In the Categories section, expand API and click REST. A list of possible resources is displayed.

Click Details to see more of the resources, and select the resources needed.

In the Categories section, expand Device Management and select Bulk Management.

The list of possible resources displays.

Click Details to see more of the resources, and select the resources.

In Categories, expand Settings and select Tags, if this option is available on your installation. The list of possible resources displays.

Click Details and select the resources.

Click Save.

Log in to Workspace ONE.

Create a Workspace ONE UEM Administrator User by navigating to Account > Administrators > List View > Add > Add Admin.

Give the administrator user the role and permissions that you set up previously.

Click Roles > Select one or more Smart Groups intended to contain the managed devices > Select the API Role created above > Apply the role to one or more Smart Groups if necessary.

Click the API tab > Enable Certificates and create the certificate password.

You need the password to the certificate twice in this process, to export the certificate, and to import the certificate into the the Mobile Security Console. To finalize this process follow these steps:

Log in to Mobile Security console.

Go to the Manage page.

Select Integrations.

Click on Add MDM and select the MDM integration you want to use.

Click Next, and a window opens containing fields to input the Workspace ONE API URL, admin account, and name of the UEM system, along with other configuration fields to integrate the two systems.

Enter information pertinent to the UEM integration list in the table, and click Next.

Click Next and choose the User Group(s) to synchronize. The available groups show up in the Available Device Groups list and can be moved to the Selected Mobile Security Console Groups list by clicking on the plus sign (‘+’). This can be reversed by clicking on the minus sign (‘-’).

Click Next.

Specify the MDM alerts if you want to be notified when there are MDM sync errors. If you want more than one email address, separate them by a comma.

Click Finish to save the configuration and start the first synchronization by clicking Sync Now.

On this page, click Send Application Configuration.

Use the following configuration keys and values as needed for the configuration.

Click Publish and Save to push this to devices in the Smart Group.

Log in to the VMware Workspace ONE console.

Navigate to Groups & Settings > Groups > Assignment Groups and add a new smart group.

On the left navigation menu, navigate to Resources > Profiles and Baselines > Profiles and add a new profile.

Click Add > Add Profile.

Select the Apple iOS platform, and then select Device Profile.

Enter the name for your profile.

Click Add on the Custom Settings row and immediately move the Enable Customer Lookup Value toggle to the right. This allows the "{DeviceUID}" macro to work.

Paste in your edited XML. You can also edit it in this form, since there are just a few to alter.

Click Next.

Assign the profile to the assignment group(s) of interest, take the defaults on the other fields, and click Save & Publish.

Log in to the the Mobile Security Console.

Navigate to the Manage > Integrations, and add the VMware Workspace ONE MDM.

Navigate to threat policies on the Policy page and the Threat Policy tab.

Select the group from the Selected Group field. This value is the original Smart Group for devices.

Update the App Pending Activation threat with MDM Action and Mitigation Action field values.

Save and Deploy your changes.