Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Workspace ONE UEM Integration

Follow these steps to link a Workspace ONE account to your organization, and understand how HPE Mist Networking Access Assurance leverages the enrolled device compliance status for policy rule creation.

HPE Mist Networking Access Assurance supports native integration with Workspace ONE® UEM, enabling comprehensive evaluation of endpoint compliance across devices such as laptops and mobile phones. Using predefined policies, Workspace ONE assesses device compliance based on security parameters such as antivirus presence, firewall status, and OS patch levels. HPE Mist Networking Access Assurance retrieves the latest device compliance status from Workspace ONE and applies it to authentication policies to enforce access control decisions.

Flow diagram showing integration of HPE Mist Networking Access Assurance with Workspace ONE UEM for device compliance and network access control. Managed devices use 802.1X EAP-TLS to connect to wired or wireless networks. HPE Mist Networking enforces access policies based on compliance state retrieved from Workspace ONE UEM, which evaluates device compliance periodically.

Device Compliance Status Data Retrieval from Workspace ONE

HPE Mist Networking Access Assurance retrieves device compliance information from Workspace ONE using an API-based polling mechanism and webhooks. By default, HPE Mist Networking Access Assurance polls Workspace ONE every 2 hours for each authenticated managed client and caches the compliance status for efficient retrieval. When webhooks are configured, Workspace ONE sends real-time compliance state notifications to HPE Mist Networking Access Assurance whenever a device's compliance status changes, eliminating the need to wait for the next polling interval.

To avoid adding additional latency to authentication, device compliance information is retrieved only after authentication is complete. After a device is initially onboarded, its compliance status is continuously updated through webhook notifications, if configured. If you have not configured webhooks, the compliance status is refreshed every 2 hours using the polling mechanism.

If a device’s compliance state changes, HPE Mist Networking Access Assurance automatically triggers a Change of Authorization (CoA) to re-evaluate the policy and enforce the appropriate access control measures. This automatic triggering of CoA ensures that compliance changes are promptly addressed, maintaining security and policy adherence without requiring manual intervention.

Figure 1 illustrates how HPE Mist Networking Access Assurance retrieves Workspace ONE-managed device compliance data for authentication.

Figure 1: Authentication and Authorization Process for Workspace ONE

Flow diagram showing network access control and device compliance validation using HPE Mist Networking Access Assurance and Workspace ONE UEM. Highlights EAP-TLS authentication, quarantine VLAN, MDM lookup, compliance status response, and authorization update for secure network access.

Note:

To support the CoA functionality, APs must run firmware version 0.14 or later

HPE Mist Networking Access Assurance uses the following information during client authentication to match a client with a device record in Workspace ONE:

Note:

Some of the screenshots included in this topic are sourced from third-party applications. Be aware that these screenshots might change over time and might not always match the current version of the applications.

  • Non-randomized MAC address—For authentication using EAP-TTLS or EAP-TLS, the MAC address of the client device is matched against a managed device record in Workspace ONE. To ensure accurate MAC-based device matching, you must disable MAC address randomization in the Wi-Fi configuration profiles on client devices.

    Configuration interface for setting up a corporate network profile in a UEM system with fields for SSID, description, connectivity settings, security type, and navigation buttons.

  • Workspace ONE UDID encoded in SAN:DNS certificate attribute—In Workspace ONE Certificate templates, use the {DeviceUid} variable to encode the Device UDID in the SAN:DNS certificate field.

    Certificate template configuration interface with fields for private key type, security identifier, SAN type, automatic renewal, and publish private key options. Save and cancel buttons included.

Configure Client ID and Client Secret in Workspace ONE

To integrate Workspace ONE with HPE Mist Networking Access Assurance, you'll need to set up a Workspace ONE API Client ID and Client Secret.

Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.
  1. In the Workspace ONE portal, navigate to Groups & Settings> Configurations>OAuth Client Management, then click Add.
    User interface for managing configurations in a software application. The "Configurations" page under Groups and Settings shows OAuth Client Management option categorized under Customization and Integration.
    OAuth Client Management interface in a UEM system with navigation menu and highlighted Configurations option under Groups and Settings. Includes Add button for creating a new OAuth client.
  2. Enter the required details to create a Client ID. Ensure that the role is set to Read Only and the status is Enabled, as shown in the following example. Click Save.
    User interface for registering a new OAuth client with fields for Name, Description, Organization Group, Role, and Status. Save and Cancel buttons at the bottom.
  3. Copy the generated Client ID and Client Secret. These credentials are required to link your organization with Workspace ONE.
    Register a New Client interface for creating credentials in Workspace ONE UEM. Includes Name, Description, Organization Group, Role, Status, Client ID, Client Secret, and a CLOSE button. Advises saving credentials securely.

Add Workspace ONE as an Identity Provider

  1. From the left menu of the HPE Mist management portal, select Organization> Access>Identity Providers.
  2. In the Linked Accounts section, click Link Account.
  3. Select Omnissa Workspace ONE UEM.
    Identity Providers section in management portal, showing IDPs like OpenRoaming, OAuth, LDAPS with Default IDP marked, no linked accounts, and options to link accounts like Microsoft Intune and Jamf Pro.
  4. In the Link Account page, provide the Instance URL (for example, https://ABC.awmdm.com OR https://ABC.airwatchportals.com), Client ID and Client Secret. Then, click Link Account.
    User interface for linking an account in a system, with fields for Instance URL, Client ID, and Client Secret, Link Account and Cancel buttons, and a message indicating no linked accounts.

    After you link the Workspace ONE account, you can see the account status on the Identity Providers page. You can click the account to view the details of the last sync and the webhook configuration details, including the Webhook URL, Username, and Password.

    Organization page showing identity provider integration details for Workspace ONE UEM including sync status, account ID, linked user email, company name, linked timestamp, application name, webhook status, URL, and credentials, with options to unlink account, save, or cancel changes.

Configure Webhook Notifications in Workspace ONE UEM

Before configuring webhook notifications, ensure to:

  • Onboard the organization before linking the Workspace ONE account.

    Ensure the organization is onboarded to HPE Mist Networking Access Assurance by connecting at least one client to NAC (either through a successful onboarding or a NAC client deny event) before linking the Workspace ONE account. This ensures that the necessary backend configuration is completed before webhook credentials are generated.

  • Reconfigure webhooks after re-linking the Workspace ONE account.

    If the Workspace ONE account is unlinked and then linked again, HPE Mist Networking Access Assurance generates a new Webhook URL, Username, and Password. Update the webhook configuration in the Workspace ONE console with these newly generated credentials.

  • Relink the Workspace ONE account when GDPR is enabled after initial linking (applicable only to EU organizations with GDPR enabled).

    If the Workspace ONE account was linked before GDPR was enabled, unlink and relink the account after enabling GDPR. This ensures that the backend configuration is updated to reflect the GDPR settings and generates the appropriate webhook configuration.

To configure webhooks in Workspace ONE UEM:

  1. Navigate to Groups & Settings > All Settings > System > Advanced > API > Event Notifications.
  2. Click Add Rule.
    Event Notifications configuration interface with options for Inherit and Override, Add Rule button, search bar, refresh button, and empty table displaying No Records Found. Navigation panel includes Advanced API settings.
  3. Enter the event notification details.
  4. Specify a Target Name. Enter the Target URL, Username, and Password generated by HPE Mist Networking Access Assurance after linking the Workspace ONE account. Choose the Format as JSON.
  5. Click Test Connection and verify that the connection is successful.
  6. Enable Device Compliance Status Change under Events to subscribe to compliance state notifications. This allows Workspace ONE to send real-time compliance updates to HPE Mist Networking Access Assurance whenever a device's compliance status changes. Click Save.
    User interface for adding event notifications with fields for target name, URL, credentials, format, test connection button, event subscription toggles, and save or cancel buttons.

Verify Client Connection and Device Lookup Status

The initial MDM lookup for a new client occurs after the device has been authenticated for the first time. To facilitate this lookup, you'll need to create an auth rule that allows first-time device connections and assigns the devices to a quarantine VLAN.

Note: Do not include the Compliant or Non-Compliant MDM compliance labels in the match conditions for this rule. You can optionally use the Unknown Compliant label as a match criterion. Ensure this rule is placed at a lower priority than your standard access policies.

User interface for managing authentication policies in a network management system titled Auth Policies. Displays policy rules with match criteria, network access, assigned configurations, status, and hit counts. Features include options to add rules, create or assign labels, filter rules, and view NAC events.

The Change of Authorization (CoA) action specifies the RADIUS CoA operation used to enforce an updated network policy when a device's compliance status changes. By default, CoA action is set as CoA Reauthenticate. You can change the CoA action, if required, to CoA Disconnect by going to the Access Assurance section in the Organization>Settings page.

Configuration interface for Access Assurance settings with options to enforce HPE Mist Networking Auth in EU regions only, select HPE Mist Networking Auth Connection Mode IPv4, IPv6, or Dual Stack, set CoA action to Reauthenticate or Disconnect, and detect inactive endpoints with labeling after 90 days inactivity.

The following example describes the MDM lookup workflow in which a CoA is triggered by webhook notifications when the device's compliance status changes:

  • When a device initially connects to the network, its compliance state is not yet known. Hence, it is evaluated against the auth rule that is created to allow devices connecting for the first time. Initial Onboarding is the auth rule in the following example.

    NAC Events for a MAC address under Auth Policy. Includes event types, timestamps, device details, and certificate info like CN, SAN, issuer, expiry, subject, auth rule, RADIUS attributes, port type, site, NAS vendor, and IP. Navigation menu on the left.

    After successful authentication, HPE Mist Networking Access Assurance performs an MDM lookup to retrieve the device's compliance status. Based on the compliance status, a Change of Authorization (CoA) is triggered, causing the client to reconnect and be assigned the appropriate policy (Compliant Devices in this example).

    NAC Events interface, showing authentication and access logs with timestamps, device names, event statuses, detailed event info, navigation, and filter options for network monitoring.

  • If the compliance status of the device changes, webhooks immediately sends a compliance state update. In this example, the device status has changed to non-compliant.

    Network management interface showing Auth Policy section with NAC Events table listing event type, device, timestamp, and status. Event details panel displays compliance change, client MAC address, port type, site, and source. Navigation menu on left for monitoring and management.

    HPE Mist Networking Access Assurance processes the update in real time, triggers a CoA, and reassigns the client to the configured policy and associated VLAN.

    Network management interface showing Auth Policy section focused on NAC Events with details about device authentication, compliance, and connection attributes.

  • When the device returns to a compliant state, another real-time webhook notification is received, and HPE Mist Networking Access Assurance immediately triggers a CoA to re-evaluate the client session.

    NAC events list with event details, selected event description, and navigation options.

    The device is then reassigned to the Compliant Device policy without waiting for the default 2-hour polling interval.

    Network management interface showing NAC Events section with a table of authentication logs, event details panel, navigation menu, and filter options.

For all subsequent authentications, HPE Mist Networking Access Assurance uses cached MDM data, which is refreshed every 2 hours by default. When webhooks are configured, compliance status updates are processed in real-e time instead of waiting for the next polling interval.