VMware Workspace ONE

Connect VMware Workspace ONE to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In VMware Workspace ONE:

   1. In the Workspace ONE UEM console, go to Groups & Settings › All Settings › System › Advanced › API › REST API.
   2. On the General tab, set Current Setting to Override if the organization group inherits these settings, and make sure Enable API Access is selected (API calls are authenticated only when this check box is enabled).
   3. Access token (OAuth 2.0, Omnissa's preferred method): go to Groups & Settings › Configurations › OAuth Client Management and create an OAuth client. Omnissa recommends a dedicated service account with a role scoped to only the permissions the integration needs. Note the Client ID, Client Secret and Token URL; the access token is then requested from the Token URL with that client ID and secret.
   4. Username and password (Basic, the alternative): on the REST API page's Authentication tab, select Basic, and use a dedicated Workspace ONE UEM service account (Basic credentials exist only in Workspace ONE UEM) whose role is scoped to only the permissions the integration needs.

   Where to find the other values:

   • Host: Groups & Settings › All Settings › System › Advanced › Site URLs shows the hostname of your Workspace ONE UEM API.
   • Tenant code: Groups & Settings › All Settings › System › Advanced › API › REST API, General tab: the API Key for the AirWatch API service is the tenant code. Click Add to generate a separate key for a new service; the API Key is a read-only value generated when you select Add.

   VMware Workspace ONE's public documentation does not cover every step.

   Workspace ONE UEM is now an Omnissa product (docs at docs.omnissa.com). Partial because the field labels of the OAuth client creation dialog (name, organization group, role) and the exact token request were not found in a readable official page, and no official page naming a built-in read-only administrator role (or the steps to create a custom read-only role under Accounts) was read; the role step above follows Omnissa's general advice to use a dedicated service account with a role scoped to only the needed permissions. OAuth access tokens are short-lived and must be requested again from the Token URL when they expire. Usage limits on the REST API page's Usage tab default to 5,000 calls per minute and 50,000 calls per day. On-premises deployments may need an IIS restart on the API servers for REST API settings to apply. Verification 2026-10-07: one_time_display set to null because no fetched source says whether the OAuth client secret is shown once; 'read-only device access' role wording replaced with Omnissa's stated advice (a role scoped to only the needed permissions); developer.omnissa.com renders client-side and had no readable text.

   Source: docs.omnissa.com, docs.omnissa.com, techzone.omnissa.com, docs.omnissa.com, developer.omnissa.com, checked 2026-10-07.

   The permissions Safeguard needs: Devices: read (read-only administrator).

2. On Compliance › Connectors, open VMware Workspace ONE, click Connect, choose API token and fill in:

   Field	What to enter
   Host	Optional. An address under awmdm.com.
   Tenant code	Optional.
   Access token	Optional. Stored encrypted and never shown again.

   Or, instead: Username (optional), Password (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read VMware Workspace ONE and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks