Skip to main content
Workspace ONE is a digital workspace platform. Connect your Workspace ONE account to Oleria to bring user and group access into your identity and access graph.

​
What Oleria discovers

  • User accounts and profile attributes synced from Workspace ONE’s directory.
  • Groups and their memberships.
Oleria uses this data for dormant account detection and access reviews, refreshed on Oleria’s regular sync schedule.

​
Prerequisites

  • Admin access in Workspace ONE with permission to create OAuth clients.
  • A Workspace ONE plan that includes SCIM provisioning.
  • Admin access on the Oleria platform to add a new integration.

​
Get your SCIM credentials from Workspace ONE

1

Create an OAuth client in Workspace ONE

Sign in to Workspace ONE as an admin and create an OAuth client for SCIM in Workspace ONE Access > Settings > OAuth 2.0 Management. Make it a service client with the admin scope. SCIM access uses the OAuth 2.0 client credentials grant, so Oleria requests a fresh access token for each sync.
2

Copy the client credentials

Copy these values before you leave the page - you’ll paste them into Oleria in the next section:
  • SCIM Base URL - the SCIM 2.0 endpoint Workspace ONE shows when you enable provisioning.
  • Client ID and Client Secret - from the OAuth client you created.
  • Token URL - https://<tenant>.vmwareidentity.com/SAAS/auth/oauthtoken, or https://<tenant>.workspaceoneaccess.com/SAAS/auth/oauthtoken for newer tenants.
Copy the client secret now and store it securely. Rotate it per your organization’s security policy.

​
Connect Workspace ONE to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Workspace ONE tile.
2

Complete the connection form

Fill in the connection form:
3

Save the integration

Select Connect to validate the credentials and save the integration.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. Oleria syncs users and groups from Workspace ONE on its regular sync schedule once the initial sync completes.
If you rotate the client secret in Workspace ONE, update the Client Secret in Oleria by editing the integration.

​
Remediation actions

Oleria can also take these actions in Workspace ONE when the OAuth client can update users and groups:
  • Enable or disable a user account
  • Add or remove a user from a group
  • Create a new user or group
Oleria doesn’t check the OAuth client’s permissions until an action runs. If an action fails, confirm the OAuth client can update users and groups in Workspace ONE.

​
Contact us

For questions about this integration, contact us at support@oleria.com.