> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace ONE

> Connect your Workspace ONE account to Oleria to continuously discover user and group access across your digital workspace platform.

Workspace ONE is a digital workspace platform. Connect your Workspace ONE account to Oleria to bring user and group access into your identity and access graph.

## What Oleria discovers

* User accounts and profile attributes synced from Workspace ONE's directory.
* Groups and their memberships.

Oleria uses this data for dormant account detection and access reviews, refreshed on Oleria's [regular sync schedule](/integrations/overview.md#sync-model).

## Prerequisites

* Admin access in Workspace ONE with permission to create OAuth clients.
* A Workspace ONE plan that includes SCIM provisioning.
* Admin access on the Oleria platform to add a new integration.

## Get your SCIM credentials from Workspace ONE

**1. Create an OAuth client in Workspace ONE**

Sign in to Workspace ONE as an admin and create an OAuth client for SCIM in **Workspace ONE Access > Settings > OAuth 2.0 Management**. Make it a service client with the admin scope. SCIM access uses the OAuth 2.0 client credentials grant, so Oleria requests a fresh access token for each sync.

**2. Copy the client credentials**

Copy these values before you leave the page - you'll paste them into Oleria in the next section:

* **SCIM Base URL** - the SCIM 2.0 endpoint Workspace ONE shows when you enable provisioning.
* **Client ID** and **Client Secret** - from the OAuth client you created.
* **Token URL** - `https://<tenant>.vmwareidentity.com/SAAS/auth/oauthtoken`, or `https://<tenant>.workspaceoneaccess.com/SAAS/auth/oauthtoken` for newer tenants.

> [!NOTE]
>
> Copy the client secret now and store it securely. Rotate it per your organization's security policy.

## Connect Workspace ONE to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations**, then select the **Workspace ONE** tile.

**2. Complete the connection form**

Fill in the connection form:

| Field | Notes |
| :- | :- |
| Instance Name | Optional. Short, recognizable label for this connection (for example, `workspace-one-prod`). |
| SCIM Base URL | Required. The SCIM 2.0 endpoint for Workspace ONE. |
| Authentication Method | Required. Select **Client Credentials**. |
| Client ID | Required. The OAuth client ID from Workspace ONE. |
| Client Secret | Required. The OAuth client secret from Workspace ONE. |
| Token URL | Required. `https://<tenant>.vmwareidentity.com/SAAS/auth/oauthtoken`, or `https://<tenant>.workspaceoneaccess.com/SAAS/auth/oauthtoken` for newer tenants. |

**3. Save the integration**

Select **Connect** to validate the credentials and save the integration.

## Verify the integration

Confirm the new instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. Oleria syncs users and groups from Workspace ONE on its [regular sync schedule](/integrations/overview.md#sync-model) once the initial sync completes.

> [!NOTE]
>
> If you rotate the client secret in Workspace ONE, update the **Client Secret** in Oleria by editing the integration.

## Remediation actions

Oleria can also take these actions in Workspace ONE when the OAuth client can update users and groups:

* Enable or disable a user account
* Add or remove a user from a group
* Create a new user or group

> [!NOTE]
>
> Oleria doesn't check the OAuth client's permissions until an action runs. If an action fails, confirm the OAuth client can update users and groups in Workspace ONE.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.