↳ GitHub sourceConnector
VMware Workspace ONE (via Codeless Connector Framework)
Description
The VMware Workspace ONE connector ingests enrolled device inventory and installed application details from the Workspace ONE Unified Endpoint Management (UEM) platform into Microsoft Sentinel. It supports device compliance tracking, non-compliant endpoint detection, and unauthorized application discovery across iOS, Android, Windows, and macOS managed devices.
- Declared status
- 1
- Declared author / publisher
- Microsoft
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
Read, Write, and Delete permissions are required.
Workspace
Workspace
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Connect VMware Workspace ONE to Microsoft Sentinel
Add Connection
Configure Workspace ONE Connection
Connection Name
Provide a unique name to identify this Workspace ONE tenant connection.
Instance URL
The base URL of your Workspace ONE UEM console (without trailing slash).
Auth URL
Region-specific OAuth token service URL. Do not include /connect/token - it is appended automatically.
Client ID
Client Secret
Collect Application Details
Yes, collect installed app inventory per device
No, collect device inventory only
App collection triggers one additional API call per enrolled device per poll cycle. For large fleets (> 5,000 devices), consider selecting 'No' to reduce API call volume.
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
VMwareWorkspaceOneConnector
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC