KeySkope
Start a free pilot
KeySkope / Documentation / Workspace ONE UEM
Documentation / Workspace ONE UEM

Workspace ONE UEM
Setup guide.

Review who can administer Workspace ONE UEM and the roles assigned to them.

Available · Reviewed 2026-09-18

Before you start

  • The correct UEM REST API host and organisation group.
  • An administrator authorised to create a dedicated account and custom role.

Read-only permissions

SettingPurpose / value
REST API Admins ReadRead administrator records. Restrict the account to the required organisation group; no edit or device-action privileges.

Connect Workspace ONE UEM

  1. At the organisation group to review, create a custom administrator role with REST API Admins Read. Check your tenant’s API help for the administrator search endpoint.
  2. Create a dedicated administrator account and assign that read-only role at the intended organisation-group scope. Do not use Console Administrator as a shortcut.
  3. In Groups & Settings → All Settings → System → Advanced → API → REST API, obtain the API tenant code for that group.
  4. Confirm the REST API server URL with your UEM administrator; it may differ from the console host.
  5. Enter the API host, dedicated account username/password and API key in KeySkope. Run a sync and compare administrator roles.

Connection fields

SettingPurpose / value
console_urlHTTPS UEM host serving the REST API.
username / passwordDedicated account with read-only admin API permission.
api_keyRequired aw-tenant-code value for the organisation group.

What appears in KeySkope

  • Console administrators and assigned role information. No device inventory, commands or endpoint telemetry.
  • The current connector uses Basic authentication plus aw-tenant-code. Tenants that prohibit this method need another supported authentication implementation before connecting.

Verify the first sync

  1. Wait for the sync to finish and review its status and any partial-collection notes.
  2. Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
  3. For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
  4. Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.

Troubleshooting

SettingPurpose / value
Missing tenant codeSupply the API key; it is separate from the account password.
403Check REST API Admins Read and organisation-group scope. Do not grant a full administrator role.

Official references

Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.

Ready to connect?

Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.

Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.