Integration with the Workspace ONE ITSM Connector for ServiceNow

Improve your daily operations for IT management with the Workspace ONE ITSM Connector for ServiceNow. With the Workspace ONE ITSM Connector for ServiceNow, helpdesk and support organizations face can access Workspace ONE UEM and Workspace ONE Assist actions from within the ServiceNow portal.

Before You Begin

To configure this connector, you must be able to access the API settings and create API configurations in Workspace ONE UEM at the Organization Group relevant to this setup (typically the latest parent group including all device and application data).

ITSM for ServiceNow supported versions:

• ServiceNow - Xanadu, Yokohama, Zurich, or Australia
• Workspace ONE UEM - 2310 or later
• Workspace ONE Assist - 23.10 or later
• Horizon 2312 - 8.12 or Later
  • Performing Horizon actions requires a Horizon license and a Horizon 8 deployment

Determine your authentication connection. Before configuring the connection in the application, create an OAuth 2.0 client on Workspace ONE UEM or a new dedicated account. Create a role with the required security rights.

For information on the following, see:

• Roles with required security rights: Role-Based Access
• Creating new role: Create a Role That Can Use REST APIs
• Creating an OAuth Client: Create an OAuth Client to Use for API Commands (SaaS)
• Basic Auth account: Admin Accounts

For a walkthrough, see Install and Configure Workspace ONE ITSM Connector for ServiceNow.

To access Workspace ONE UEM and Workspace ONE Assist functionality from the ServiceNow Incidents page, download and install the Omnissa Workspace ONE ITSM Connector from the ServiceNow Store.

1. Log in to your ServiceNow instance as an administrator.
2. Install the Workspace ONE ITSM Connector plugin from the plugins directory.
3. Continue through the Guided Setup for the connector.

Configure the Workspace ONE ITSM Connector for ServiceNow

To set up the ITSM connector, you must have the necessary credentials. Search for and select the Workspace ONE ITSM Connector.

To configure the ITSM connector, follow the guided setup. The following are the core configuration actions:

• Configure the connection - Connects your ServiceNow instance to Workspace ONE UEM.
• Configure the actions - Configures the actions available to the ITSM agents.
• Configure the application defaults - Sets the defaults for the application behavior.
• Assign Roles - Assigns Workspace ONE ITSM Connector roles to Groups and Users.

Configure the Connection

The Workspace ONE ITSM Connector supports authentication to Workspace ONE UEM through an OAuth 2.0 client or a Basic Auth and tenant key. OAuth 2.0 is industry standard protocol for secure authentication and authorization for REST API calls.

Option 1: Configure OAuth Details

Use this option in the ServiceNow guided setup if you are using OAuth 2.0. All details for configuration are for the Workspace ONE UEM API. To complete configuration, select and update the following details:

1. Go to the Configure OAuth Host details tab and click Configure.

2. Update the Host text box with the hostname for the Workspace ONE UEM API.

3. Select the Active check box.

   A warning message might display if you are switching from Basic Auth.

   All the other details on this page are preconfigured and should not be modified.

4. Go to the Configure OAuth Client details tab and click Configure.

5. Enter the OAuth Client details the Client ID.

6. Enter the Client Secret.

7. Enter the Token URL.

   All the other details on this page are preconfigured and should not be modified.

Option 2: Configure Basic Auth Details

Use this option in the ServiceNow guided setup if you are using Basic Auth Details. All details for configuration are for the Workspace ONE UEM API. To complete configuration, select and update the following details.

1. Go to the Configure Basic Auth Host tab and click Configure.

2. Update the Host text box with the hostname for the Workspace ONE UEM API.

3. Select the Active check box.

   A warning message might display if you are switching from OAuth.

   All the other details on this page are preconfigured and should not be modified.

4. Go to the Configure Basic Credentials tab and clickConfigure.

5. Update the User Name and the Password text boxes with credentials of the Basic Auth account you created.

6. ClickUpdate.

   All the other details on this page are preconfigured and should not be modified.

7. Go to the Configure Tenant Code tab and click Configure.

8. Update the Value text box with the Tenant Code for the Workspace ONE UEM API. The Tenant Code for your instance appears in your Workspace ONE UEMinstance under Settings > System > Advanced > API > REST API > AirWatchAPI .

9. Click Update.

Configure Intelligence OAuth 2.0 Details

Use this option in the ServiceNow guided setup to configure the Intelligence connection.

For information, see the section on entering Intelligence OAuth 2.0 Configuration Details in ServiceNow.

Validate Connection Details

After configuring the OAuth, Basic Auth, or Intelligence Auth 2.0 details, validate the connection. This section is read-only and shows the previously configured key values.

When using OAuth 2.0, select Verify OAuth Token. A message appears confirming that a token can be retrieved. If an error is reported, then verify and fix the credentials. Repeat until it succeeds.

When using OAuth 2.0, Basic Auth, or Intelligence Auth 2.0, select Test Connection. The connection to Workspace ONE UEM is verified. The version of the Workspace ONE UEMplatform appears. If there is an error code and error message, then the connection failed. If necessary, verify and update credentials.

After validating your UEM connection and enabling OG based access in application defaults, the following controls are available on this page:

• Fetch Organization Groups - Retrieves all OGs from the connected UEM tenant and stores them in ServiceNow. This operation may take several minutes depending on OG hierarchy size. A confirmation message is displayed on success.
• Clear Organization Groups - Removes all OG data and OG-to-User/User-Group mappings from ServiceNow. Use this before switching to a different UEM authentication source.

For full configuration instructions, see Configure Organization Group Based Access.

Mark each tab as complete before configuring the actions.

Configure Service Desk

Configure all the actions available to the Service Desk Administrator. By default, all actions are available. Edit to remove actions that you do not need.

Configure Actions

Configure all the actions available to the Workspace ONE UEM Administrator. By default, all actions are available.

Complete the following to remove actions that you do not need:

1. Search for and select the Workspace ONE ITSM Connector.
2. Click Setup.
3. Select Configure Service Desk.
4. Click Configure Actions.
5. Click Configure.
6. Select the actions that are not needed and remove them.
7. Click Save.

Assign Roles

After configuring actions, you must assign roles. To assign roles, complete the following:

1. Go to the Assign roles to User Groups or Assign roles to User tab and select Configure.
2. Select the User or User Group.
3. Go to the Role tab and select Edit to add the required roles.
4. Select Save.

The Workspace ONE ITSM Connector application has preconfigured roles.

The WS1UEMStandard and WS1UEMAdvanced roles control what actions are available to the ServiceNow ITSM agents. With the WS1UEMConsoleViewer role, you can access the Workspace ONE UEM console from the Incident form if you need further investigation or actions.

There are also enhanced roles which add flexibility. With enhanced roles, individual actions can be assigned to users and groups. While the WS1UEMStandard and the WS1UEMAdvanced roles provide the default set of actions, each action has its own associated role that can be managed individually.

The following are the available actions and roles:

Action	Role
WS1UEMStandard	x_omnis_ws1uem.ws1uemstandard
WS1UEMAdvanced	x_omnis_ws1uem.ws1uemadvanced
WS1UEMConsoleViewer	x_omnis_ws1uem.ws1uemconsoleviewer
Add Device	x_omnis_ws1uem.ws1uemadddevice
Application Install	x_omnis_ws1uem.ws1uemapplicationinstall
Change Passcode	x_omnis_ws1uem.ws1uemchangepasscode
Clear Passcode	x_omnis_ws1uem.ws1uemclearpasscode
Compliance Policy	x_omnis_ws1uem.ws1uemconsoleviewer
Delete Device	x_omnis_ws1uem.ws1uemdeletedevice
Device Wipe	x_omnis_ws1uem.ws1uemdevicewipe
Enterprise Wipe	x_omnis_ws1uem.ws1uementerprisewipe
Find Device	x_omnis_ws1uem.ws1uemfinddevice
Launcher Mode	x_omnis_ws1uem.ws1uemlaunchermode
Location	x_omnis_ws1uem.ws1uemconsoleviewer
Lock Device	x_omnis_ws1uem.ws1uemlockdevice
Lost Mode	x_omnis_ws1uem.ws1uemlostmode
Profile Install	x_omnis_ws1uem.ws1uemprofileinstall
Process Products	x_omnis_ws1uem.ws1uemprocessproducts
Remote Assist	x_omnis_ws1uem.ws1uemremoteassist
Remove Profile	x_omnis_ws1uem.ws1uemprofileremove
Request Device Log	x_omnis_ws1uem.ws1uemdevicelogs
Send Message	x_omnis_ws1uem.ws1uemsendmessage
Soft Reset	x_omnis_ws1uem.ws1uemsoftreset
Sync Device	x_omnis_ws1uem.ws1uemsyncdevice
View Encryption Recovery Key	x_omnis_ws1uem.ws1uemviewencryptionkeys
Uninstall Application	x_omnis_ws1uem.ws1uemapplicationuninstall
Grants access to IP address data in mobile device network performance metrics	x_omnis_ws1uem.ws1IntelligenceUserWithIPAccess

The following represents actions that are available for WS1UEMStandard and WS1UEMAdvanced.

Action	WS1UEMStandard	WS1UEMAdvanced
Add Device	Yes	Yes
Application Install	Yes	Yes
Change Passcode	Yes	Yes
Clear Passcode	Yes	Yes
Delete Device	No	Yes
Device Wipe	No	Yes
View Encryption Recovery Key	Yes	Yes
Enterprise Wipe	No	Yes
Find Device	Yes	Yes
Launcher Mode	Yes	Yes
Lock Device	Yes	Yes
Lost Mode	Yes	Yes
Profile Install	Yes	Yes
Process Products	Yes	Yes
Remote Assist	Yes	Yes
Remove Profile	Yes	Yes
Request Device Log	Yes	Yes
Send Message	Yes	Yes
Soft Reset	Yes	Yes
Sync Device	Yes	Yes
Uninstall Application	Yes	Yes

For descriptions of each action, see Device Actions.

Access-based New User Roles

Access-based roles for a new user in Workspace ONE UEM. For a new Workspace ONE UEM user, give the user the following permissions for a proper connection between the ITSM connector and Workspace ONE:

Category	Edit	Read
API > REST > Apps > REST API Apps Execute	Yes	No
API > REST > Devices > REST API MDM Devices	Yes	No
API > REST >Devices > REST API Devices Write	Yes	No
API > REST >Devices > REST API Devices Execute	Yes	No
API > REST >Devices > REST API Devices Advanced	Yes	No
API > REST >Devices > REST API Devices Read	No	Yes
API > REST >Products > REST API Products Execute	Yes	No
API > REST >Products > REST API Products Read	No	Yes
API > REST >Profiles > REST API Profiles Execute	Yes	No
API > REST >Profiles > REST API Profiles Read	No	Yes
API > REST > Users > REST API Users Read	No	Yes
Assist	Yes	No
Device Management > Device Details > Enter Admin Mode	Yes	No
Device Management > Device Details > Exit Admin Mode	Yes	No
Device Management > Device Details > Exit Launcher	Yes	No
Device Management > Device Details > Find Device	Yes	No
Device Management > Device Details > Applications > Device Request Logs	Yes	No
Device Management > Device Details > Messaging > Device Send Message	Yes	No
Device Management > Device Details > Messaging > Device Send Message	Yes	No
Device Management > Device Details > Messaging > Device Send Message Push Notification	Yes	No
Device Management > Device Details > Lock > Remote Device Lock	Yes	No
Device Management > Device Details > Enterprise Wipe > Device Remote mdm	Yes	No
Device Management > Device Details > Enterprise Wipe > Enterprise Reset	Yes	No
Device Management > Device Details > Device Wipe > Device Wipe	Yes	No
Device Management > Device Details > Passcode	Yes	No
Device Management > Device Details > Request Check-in	Yes	No
Device Management > Device Details > Remote Control	Yes	No
Device Management > Device Details > Remote View - Device Details	Yes	No
Settings > System > Conditional Access Integrations	Yes	No

Configure Self-Service Catalog

The Self-Service Catalog gives employees the ability to resolve issues and perform common actions.

To use self-service actions, complete the following Workspace ONE tasks.

Configure Catalog Category

All the self-service actions are available and active in the Workspace ONE category.

Note: Adding the Workspace ONE category is not necessary to use self-service actions. You can add self-service actions to other categories on the home page. If you want to add self-service actions to another category, then skip this section and go to the Configure Catalog Items section.

To add the Workspace ONE category:

1. Click Configure.
2. On the Service Catalog home page, click +.
3. Select the Workspace ONE category.
4. Click Add Here.

Configure Catalog Items

To configure self-service actions and assign the actions to categories, complete the following:

1. Click Configure.
2. Select Active.
3. On the Accessibility tab, search for and select the Category.
4. Click Update.

Assign Roles

After configuring Catalog Items, you must assign roles. Assign Workspace ONE ITSM Connector self-service roles to Groups and Users. To assign roles, complete the following:

1. Go to the Assign Roles tab, the User Groups tab, or the Assign Roles to User tab and select Configure.
2. Select the User or the User Group.
3. On the Role tab, click Edit to add the required roles.
4. Click Save.

The following are the available self-service actions and roles:

Action	Role
All Actions	** x_omnis_ws1uem.WS1CatalogAdvanced
Add Device	x_omnis_ws1uem.ws1catalogadddevice
Change Passcode	x_omnis_ws1uem.ws1catalogchangedevicepasscode
Find Device	x_omnis_ws1uem.ws1catalogfinddevice
Launcher Mode	x_omnis_ws1uem.ws1uemlaunchermode
Lock Device	x_omnis_ws1uem.ws1cataloglockdevice
Remove Profile	x_omnis_ws1uem.ws1uemprofileremove
Sync Device	x_omnis_ws1uem.ws1catalogsyncdevice
Uninstall Application	x_omnis_ws1uem.ws1uemapplicationuninstall
View Encryption Recovery Key	x_omnis_ws1uem.ws1catalogviewencryptionkey

Configure the Application Defaults

Configure the following Workspace ONE UEM default settings:

• Workspace ONE Integrations - Configure the visibility of Workspace ONE integration tabs (UEM, Experience, and Horizon) within the ServiceNow interface. Select or deselect the respective options to show or hide these tabs based on your deployment requirements.

• Workspace ONE UEM Note - For more audit capabilities, configure this setting to add a note to a device in Workspace ONE UEM after every successful action is performed. This note details the time, action, and the ServiceNow user that performed the action.

• Workspace ONE UEM Email Validation Check - For all Workspace ONE UEM actions triggered within an incident, the ITSM Connector validates that the email address of the caller is the same as the email address retrieved from the device in Workspace ONE UEM.

• Exception List for Email Validation - An exception list of the email addresses where the email validation check is not carried out. Individual emails can be added, or a semicolon separated list can be used for multiple entries.

• Workspace ONE Multi Tenant - When the instance has to connect to several Workspace ONE UEM tenants, select this feature to enable the application to look up different Workspace ONE UEM tenants for the CI. The lookup is limited to three OAuth connections which are configured as part of the guided setup. For more information, see Using Multi Tenant.

• Workspace ONE Device Search - For cases when a configuration item is not attached to an incident or a serial number is not found in CI, use this to enable additoinal capabilities for manually searching devices in Workspace ONE UEM by serial number.

• Workspace ONE Intelligence Analytics - For ingesting incident data from the ServiceNow instance and ITSM Connector usage data into Workpsace ONE Intelligence. Only enable in a single tenant Workspace UEM environment. For more information see, Configuring Workspace ONE Intelligence Analytics- Data Ingestion

• Workspace ONE Notification App Name for iOS - For iOS to send push notifications to the Intelligent Hub app ensure this name matches the Intelligent Hub App Name in Devices & User > Apple > Apple iOS in the Workspace UEM console.

• Workspace ONE Organization Groups - Check this option to enable Organization Group (OG) based access control. When enabled, Service Desk Associates and administrators can only perform device actions on devices belonging to OGs assigned to them. This option is available only for single UEM tenant deployments. Enabling or disabling this option does not affect existing OG-to-User or OG-to-User Group mappings. For full configuration instructions, see Configure Organization Group-Based Access.

• Workspace ONE Intelligence Data - It contains a dropdown that allows administrators to configure the time period for which experience data is displayed in the ITSM Connector popup. The available options are 24 hours, 7 days, 14 days, 30 days, 60 days, or 90 days.

  Once configured, the selected time window is displayed in the Workspace ONE ITSM popup window when a device is viewed in ServiceNow.

  Behavioral notes:

  • Performance data is fetched for a maximum of 7 days, regardless of the configured time window. If the admin sets the window to more than 7 days, performance data is still retrieved for only 7 days.

  • Device events list uses the time window configured by the admin. A maximum of 100 records are retrieved per device event type. Pagination is enabled in the UI for device event lists.

  • Most Used Apps list also uses the time window configured by the admin.

  • Battery Health metric has been removed from the Contributors list.

Configure Organization Group Based Access

Organization Group (OG)-based access is a feature that allows ServiceNow administrators to restrict which Workspace ONE UEM organization groups a Service Desk Associate (SDA) or administrator can act on. When enabled, users can perform device actions only on devices that belong to OGs explicitly assigned to them or to their user group. This feature is supported only for single UEM tenant deployments.

Important: OG-based access is mutually exclusive with the Workspace ONE Multi Tenant feature. To enable OG-based access, you must first disable Multi Tenant in the application defaults. This feature is supported on Zurich and Yokohama ServiceNow instances.

Prerequisites

• Single UEM tenant environment.
• Workspace ONE Multi Tenant feature is disabled.

Enable or Disable OG-Based Access

1. Navigate to Guided Setup > Configure application defaults.
2. Select or clear the Workspace ONE Organization Groups checkbox to enable or disable the feature, respectively.
3. Enabling or disabling this feature does not affect any existing OG-to-user or OG-to-user group mappings already stored in ServiceNow.

Fetch Organization Groups from UEM

Once the feature is enabled, you must fetch OGs from UEM and store them in ServiceNow before you can create mappings.

1. Navigate to Guided Setup > Configure Connections > Validate UEM connection details, and then select Configure.
2. Select Fetch Organization Groups. This operation may take some time. A success message is displayed when the fetch completes.

Internally, selecting Fetch Organization Groups performs the following operations:

• Retrieves the full list of OGs from the connected UEM tenant using GET /system/groups/search?page=0&pagesize=100.
• Identifies the OG with the minimum ID value and treats it as the root (parent) OG.
• Fetches the full OG tree for the root OG using GET /system/groups/{OG_UUID}/tree and stores all entries in ServiceNow.

Clear Organization Groups

To remove all OG data from ServiceNow (for example, when switching to a different UEM tenant):

1. Navigate to Guided Setup > Configure Connections > Validate UEM Connection Details > Configure.
2. Select Clear Organization Groups.

Warning: Selecting Clear Organization Groups removes all OGs and all associated mappings (to both users and user groups) stored in ServiceNow. If you are switching UEM authentication details to connect to a different UEM, clear OGs first, and then re-fetch them after reconfiguring the connection.

Assign OGs to Users and User Groups

After OGs are fetched, a ServiceNow administrator can assign OGs to individual users or user groups.

• When an OG is assigned to a user group, it is automatically propagated to all child user groups. Administrators can remove any automatically created child mapping at any time.
• When an OG is removed from a user group, it is automatically removed from all child user groups.

Note on OG hierarchy: OGs have a parent-child relationship in UEM; This feature supports direct/explicit mapping between OGs and users/groups. Assigning OG A to a user does not, automatically, grant access to child OGs B or C. You must explicitly assign each OG to grant access to it. You can easily accomplish this by using slush buckets in ServiceNow. Select the parent organization group and all its child organization groups at once, and then assign them to the target user or group.

Access Behavior for SDAs and Administrators

This access check applies to both Service Desk Associates (SDAs) and ServiceNow administrators.

Configure Compliance Policies

Sevice desk associates can verify the Compliance Policy to determine which policy is failing on a device so they can fix an issue. To use this feature, at least once security or compliance policy must be assigned to the device. You can see policies by navigating to Security > Compliance > Compliance Policies.

To view policy details on an existing ticket, go to Compliance Policy Details. A pop-up screen will show details if at least one security or compliance policy was previously assigned to the device.