Reports

Use Reports by Workspace ONE Intelligence to collate data in your Workspace ONE UEM deployment. Workspace ONE Intelligence reporting uses a cloud-based report storage system to gather data and create the reports.

The Workspace ONE Intelligence feature provides faster, easier access to critical business intelligence data than the stock reports included in Workspace ONE UEM. Build reports using starter templates or customize canned reports, selecting from several categories, like apps, devices, and OS updates. These reports provide the latest data extracted from your Workspace ONE UEM environment.

Reports service

Reports use a separate service to push data to a reports cloud service. This service captures data useful to administrators when trying to answer critical questions. The feature gathers an initial snapshot of your deployment and continues to capture ongoing changes.

Limits to the number of reports

You can create and run up to 100 reports for each organization group (OG). If you have 100 reports in an OG but you need another unique report, you must delete a report to make space.

Deleting reports in the Reports list view

If you reached the limit for created and ran reports, you can manually delete reports by selecting them from the Reports list view.

Note: The system cannot retrieve deleted reports, so consider this behavior before you delete.

In Workspace ONE Intelligence, go to Workspace > Reports.
In the Reports list view, select the checkbox for the report you want to delete. This action displays the Delete menu item.
Select Delete and confirm your decision.

Running the reports wizard

The reports wizard guides you through creating a customized report. The wizard has blank templates that you can use as a base for your reports, or you can customize canned reports.

Access the Workspace ONE Intelligence UI.
Go to Workspace > Reports and then select Add.
Select From Template or you can add a custom report.
If using a template, select a template type. For example, you can select Apps > Managed Apps.
1. Select Start on a template from the template results.
2. Select a Download Format, CSV or JSONL.
  Important: You cannot change the selected format after you create and run the report. This behavior helps to maintain the same format and output when you share the file with other users.
3. View the Filters for the template. You can add more filter rules.
4. View the Report Preview to see results of the reports query. You can edit the rules to change the data in the preview.
5. Save the report.
If creating a custom report, in the Category menu item, select a connector and a category. For example, you can select Workspace ONE UEM > Apps.
1. If the category allows it, you can select the Data Type.
2. Select the Download Format, CSV or JSONL (JSON Lines).
  Important: You cannot change the selected format after you create and run the report. This behavior helps to maintain the same format and output when you share the file with other users.
3. Configure the Filters using an attribute that corresponds to the data you are trying to gather. For example, you can select Apps > App Last Seen> the Managed Apps.
4. Select an operator and the filter rule value.
5. View the Report Preview to see results of the reports query. You can edit the rules to change the data in the preview.
6. Save the report.
In the Reports list view, select the report and use the Overview tab to access actions. You can run the report from this tab.

Scheduling restrictions

Only owners of reports can create or edit schedules for reports. If you share a report with others, they cannot edit or create a schedule. They can only view the schedule.

Reports and using DAP

Data Access Policies (DAP) in Intelligence control what Workspace ONE UEM data your users, specifically Analysts, see in dashboards and reports. When your Intelligence environment uses DAP, the reporting mechanism behaves differently (with sharing, scheduling, and using the Report Download API) to accommodate DAP. For details on reporting behavior and DAP, see What are Data Access Policies?.

Sharing reports

You can share Reports with other Workspace ONE Intelligence users. This action is available for any report that you create. The owner of the report is designated with full access, while the users who share the report are designated with Can View (read only) or Can Edit access (read and write).

You can filter reports by selecting Created By Me or Shared With Me.

Configuring report sharing

You can share reports with users sourced from the Workspace ONE UEM Admin List View and the Azure AD Admin List View.

In Workspace ONE Intelligence, go to Workspace > Reports and select and open the desired report you want to share.
On the Overview tab, select Share.
Enter a name in the Add Users text field and select the user to share the report with them. You can add multiple users.
Configure users with Can View or Can Edit permissions.
- Can View: This permission gives the user read-only access to the report. Users with this permission can do the following actions.
  - View
  - Add to Bookmarks
  - Duplicate
- Can Edit: This permision gives the user reading and writing actions.
Use the Public Link Sharing to get a public link that users can give to others to access the report. Anyone can access the report with the public link so use this option with caution.
Save your settings.

Saving your sharing settings results in users receiving an email with a link to Download the report. Users can also download the report from the console using the Download tab in the report in the consol.

Transferring ownership of reports

Admins with the Administrator permission, can transfer the ownership of reports. This feature is useful when your colleagues move on to other opportunities. Transfer the ownership of their Workspace ONE Intelligence objects while they are off boarding to retain object management. For details on admins and Roles Based Access Control (RBAC) in Workspace ONE Intelligence, see Accounts Management.

Finding unowned reports

Admins can find unowned reports and assign ownership to other admins.

In Workspace ONE Intelligence, go to Workspace > Reports.
Select the Unowned filter and deselect the Created By Me and Shared With Me filters.
You can work with multiple reports or a single report.
- Transfer from the Reports list page:
  - Select the check boxes of all the reports of which you want to transfer the ownership.
  - You can use this option for both bulk transfer and single transfers.
- Transfer from the Report’s details page: You can use this method for a single report transfer.
  - Click the report name in the Report Name column. This action opens the report’s details.
  - Select the Overview tab.
    You now have access to the Transfer Ownership feature.
Select Transfer Ownership.
Start to enter an admin user in the Transfer to owner text field, and select the user from the list.

The system emails the new admin owner of the report.

Historical reports (time series data)

You can create historical reports for all integrations that support time series events.

To create historical reports, select the Historical Data Type. Historical reporting offers the listed filters.

Date Range: Select a date range that includes the data you want to pull for your report. Use the drop down list or create a custom date range with a maximum of 31 days.
Download Format Limit: The download format, CSV/JSONL, has a limit of 500 MB. If your data exceeds 500 MB, the system truncates the report. The system limits the report size because users can open reports that are 500 MB or less on most machines. If your report is bigger than 500 MB, consider editing your report filters to reduce the report size.

Report Retention Policy

Super admins (admins with all roles based access control permissions) can use the Report Retention Policy to manage generated and downloaded report storage. The policy is deactivated by default. After the super admin activates it, they can select a time frame in which to retain those reports. The system deletes those reports identified as older than the configured time of retention.

Reports list view

The Report Retention Policy does not delete reports in the list view. It only deletes generated and downloaded versions of the reports listed in the Reports list view. You can delete reports in the list view, but do not configure the Report Retention Policy to perform this type of deletion.

No retrieval of deleted reports

The Report Retention Policy workflow runs every 15 minutes. The system cannot retrieve report versions deleted by the policy. Consider this behavior when you activate the policy.

Requirements

You must be a super admin to configure the Report Retention Policy and to delete generated and downloaded versions of reports.

Configuring the Report Retention Policy

In Workspace ONE Intelligence, go to Workspace > Reports > Settings.
Select Activate to configure the policy.
Select the maximum time, in days, to keep generated and downloaded report versions. This configured retention time applies to all reports.
Save the policy. The console displays a message that reads Report Retention Policy period updated.

Deleting downloaded and generated report versions from the Downloads tab

If you do not want to wait for the Report Retention Policy, you can manually delete generated and downloaded report versions.

In Workspace ONE Intelligence, go to Workspace > Reports.
In the Reports list view, open the report you want to work in by clicking on the Report Name.
Go to the Downloads tab.
Select the downloads you want to delete. This action displays the Delete menu item.
Select Delete and confirm your decision.

Seeing delete actions in the report’s activity log

You can see actions taken for a single report. This view also reports the Admin Account that performed the actions.

In Workspace ONE Intelligence, go to Workspace > Reports.
In the Reports list view, open the report you want to work in by clicking on the Report Name.
Go to the Activity tab.
View the Deleted status in the Action column.
View the super admin who performed the action in the Admin Account column.

Contains or includes

The operators Contains Any of, Contains, and Includes have different UI behaviors and return different results.

Contains
- Strings data types
  - Use the Contains operator to work as a wildcard search.
  - The Contains (deprecated) operator performs a prefix search in previews and in widgets.
  - Move your existing filters to use the Contains operator and not the Contains (deprecated) to avoid possible interruptions in the future.
- Collections data types
  - Use the Contains Any of operator because it results in an exact match for any of the entries provided in the collection.
  - The Contains (deprecated) operator acts as a prefix search in previews and in widgets.
  - Move your existing filters to use Contains Any of to avoid possible interruptions in the future.
  - Wildcard searches are not supported for collections data types.
Includes: This operator returns a direct match. For example, when you use it with App Name, App Name Includes Google, the system returns an initial list of apps with Google in the app name. You can select the exact apps you want that apply to your query. The filter then returns an exact match to the query in the Report Preview.

Filter descriptions

Reports, dashboards, and workflows in Workspace ONE Intelligence use filters to create the report on specific areas of your Workspace ONE UEM deployment. These filters use a specific logic to determine what information to include in the report, dashboard, or workflow. They also represent the data the system collects.

Apps filters

Device Last Seen - The Workspace ONE Intelligence console records and displays historical data in reports when the analysis engine recognizes changes in the states of data samples. However, there are a few exceptions to this behavior. For the Device Last Seen filter in Apps Reports, the listed data samples do not trigger a status change and are not reflected in historical Apps Reports.

Device Available Capacity
Device Available Physical Memory
Device Backup Battery Life Percent
Device Next Compliance Check

You can always find accurate data for Device Last Seen in the snapshot version.

Note: Workspace ONE Intelligence displays app details it receives from Workspace ONE UEM. Every environment displays different application statuses because environments have different apps in different stages of the app management life cycle. If you need details on the available app lifecycle management statuses, see the Workspace ONE UEM topic Tracking and Monitoring your Application Deployment.

Filter	Operator	Description
Active	Equals	Reports if the app is actively deployed from the Workspace ONE UEM console to devices.
App Created Date	Before, After, Between, Not Between, Within, Not Within	Time at which an app was first uploaded as reported by the Workspace ONE UEM console.
App First Seen	Before, After, Between, Not Between, Within, Not Within	Lists the date an app was first seen on a device, as reported by the Workspace ONE UEM console.
App Install Status	Equals	Reports the installation status of an app as reported by the Workspace ONE UEM console.
App Last Seen	Before, After, Between, Not Between, Within, Not Within	Lists the date an app was last seen on a device, as reported by the Workspace ONE UEM console.
App Name	Includes, Does Not Include, Equals, Starts With, Contains	Lists the unique public name used to identify an app as defined at the app attribute level.
App Version	Includes, Does Not Include, Equals, Starts With, Contains	Lists the version of the app as defined at the app attribute level.
Assigned App Version	Includes, Does Not Include, Equals, Starts With, Contains	List the version of an app that is assigned and deployed from the Workspace ONE UEM console.

Beta	Equals	Reports whether an app was designated as pre-release during upload into the Workspace ONE UEM console.
Bundle Size	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the size of compiled code and resources of an app, measured in bytes, as defined at the app attribute level.

Compliance Status	Includes, Does Not Include, Equals, Starts With, Contains	Indicates whether an app is in compliance with rules set in Workspace ONE UEM.
Compromised	Equals	Indicates whether the app list reports a potential security threat.
Cost	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the price an organization paid for the app as reported in the Workspace ONE UEM console.
Cost Center	Includes, Does Not Include, Equals, Starts With, Contains	Lists the business unit that the organization assigns the cost of the app to as reported in the Workspace ONE UEM console.
Created By User	Includes, Does Not Include, Equals, Starts With, Contains	Unique user designated to first upload the app as reported by the Workspace ONE UEM console.
Currency Description	Includes, Does Not Include, Equals, Starts With, Contains	List the currency used to purchase the app as reported in the Workspace ONE UEM console.

Description	Includes, Does Not Include, Equals, Starts With, Contains	Lists the metadata text provided during the upload of the app as reported by the Workspace ONE UEM console.
Developer	Includes, Does Not Include, Equals, Starts With, Contains	Lists the developer who created the app as reported in the Workspace ONE UEM console.
Developer Email	Includes, Does Not Include, Equals, Starts With, Contains	Lists the app developer’s email contact as reported in the Workspace ONE UEM console.
Developer Phone Number	Includes, Does Not Include, Equals, Starts With, Contains	List the app developer’s phone contact as reported in the Workspace ONE UEM console.
Device GUID	Includes, Does Not Include, Equals, Starts With, Contains	Represent a global unique identifier (GUID) generated by Windows for Windows devices as it pertains to the app list.
Device ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Unique identification for each device generated by Workspace ONE UEM.
Device Last Seen	Before, After, Between, Not Between, Within, Not Within	The last time when a device checked in with the Workspace ONE UEM console and app parameters changed from the last reported parameter values.
Device Name	Includes, Does Not Include, Equals, Starts With, Contains	The device name created by the end user as it pertains to the app list.
Device Organization Group GUID	Includes, Does Not Include, Equals, Starts With, Contains	Represents a global unique identifier (GUID) generated by Workspace ONE UEM. It identifies a group created in the Workspace ONE UEM console that is assigned to an app and is deployed to a device.
Device Organization Group ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Represents a unique identifier for an Organization Group defined in Workspace ONE UEM.
Device Organization Group Name	Includes, Does Not Include, Equals, Starts With, Contains	The name of an Organization Group in Workspace ONE UEM.
Device UDID	Includes, Does Not Include, Equals, Starts With, Contains	Unique identification generated by the device manufacturer.
Dynamic Size	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the size of compiled code and resources, measured in bytes, for an app that requires access to a server (through WiFi or cellular) as defined at the app attribute level.

Email	Includes, Does Not Include, Equals, Starts With, Contains	The email address used to register a device into Workspace ONE UEM as it pertains to a specific app.
Enrollment Date	Before, After, Between, Not Between, Within, Not Within	Reports the date when a device enrolled as managed with Workspace ONE UEM as it pertains to the app list.
Enrollment Status	Includes, Does Not Include, Equals, Starts With, Contains	Indicates the last, reported, enrollment stage of the device with the Workspace ONE UEM console as it pertains to an app deployed on that device.

First Name	Includes, Does Not Include, Equals, Starts With, Contains	Lists the first name of the user the app is registered to. It is an attribute reported by the Workspace ONE UEM console.
Friendly Name	Includes, Does Not Include, Equals, Starts With, Contains	The device name generated by Workspace ONE UEM.

Identifier	Includes, Does Not Include, Equals, Starts With, Contains	Lists the unique string used to identify an app package as defined at the app attribute level.
Installation Date	Before, After, Between, Not Between, Within, Not Within	Lists the date at which the app was last installed on the device, as reported by the Workspace ONE UEM console.
Installation Status Reason	Includes, Does Not Include, Equals, Starts With, Contains	Lists the stage of installation the app is undergoing as reported by the Workspace ONE UEM console.

Last Action Taken	Includes, Does Not Include, Equals, Starts With, Contains	Reports the last action taken on a device that pertains to an app.
Last Name	Includes, Does Not Include, Equals, Starts With, Contains	Lists the last name of the user the app is registered to. It is an attribute reported by the Workspace ONE UEM console.
Last Seen	Before, After, Between, Not Between, Within, Not Within	Lists the last time a device checked in and app parameters changed from the last reported parameter values.
Launcher Active	Equals	Indicator of whether the device is in kiosk mode through Android Launcher.

Manage (Device)	Equals	Reports if the device is managed by the Workspace ONE UEM console as it pertains to an app.
Managed App	Equals	Indicates whether the app has been provisioned as a corporate entity, as reported by the Workspace ONE UEM console.
Managed App Status	Includes, Does Not Include, Equals, Starts With, Contains	Indicates whether the app successfully installed on a device as reported by the Workspace ONE UEM console.
Managed By	Includes, Does Not Include, Equals, Starts With, Contains	Reports which type of management is present from the app list.
Middle Name	Includes, Does Not Include, Equals, Starts With, Contains	Lists the middle name of the user the app is registered to. It is an attribute reported by the Workspace ONE UEM console.
Model	Includes, Does Not Include, Equals, Starts With, Contains	The model information reported by a device and displayed in Workspace ONE UEM under Device Details.
Modified By User	Includes, Does Not Include, Equals, Starts With, Contains	Lists the user that last modified to an app.

OS Version	Includes, Does Not Include, Equals, Starts With, Contains	The OS version reported by a device and displayed in Workspace ONE UEM under Device Details.
OS Version Build	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists a number that represents the specific build of the device’s operating system as it pertains to an app. It is formatted as `<major version>.<minor version>.<patch>`.
OS Version Major	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the first number string in the operating system version number that It is formatted as `<major version>.<minor version>.<patch>`.
OS Version Minor	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the second number string in the operating system version number that It is formatted as `<major version>.<minor version>.<patch>`.
Organization Group GUID	Includes, Does Not Include, Equals, Starts With, Contains	A global unique identifier (GUID) generated by Workspace ONE UEM that identifies a group created in the Workspace ONE UEM console.
Organization Group Hierarchy	Contains All Of, Contains Any Of, Contains None Of, Contains	The hierarchy of Organization Groups in Workspace ONE UEM.
Ownership	Includes, Does Not Include, Equals, Starts With, Contains	Indicates whether a device (as it pertains to an app) is owned by a person or by an organization.

Phone Number	Includes, Does Not Include, Equals, Starts With, Contains	Lists the phone number of the device as it pertains to an app, as reported by the Workspace ONE UEM console.
Platform	Includes, Does Not Include, Equals, Starts With, Contains	Lists the manufacturer or type of device as it pertains to an app, as reported by the Workspace ONE UEM console.
Prevent Backup	Equals	Indicates whether the app is granted permission to back up data to iCloud, as designated in the Workspace ONE UEM console.
Push Mode	Includes, Does Not Include, Equals, Starts With, Contains	Indicates the method the Workspace ONE UEM console uses to deploy the app, On-Demand (the user uploads and installs at their convenience), or Auto (the console deploys the app for the user to install immediately).

Remove App On Unenrollment	Equals	Indicates whether the Workspace ONE UEM console removes the app when it performs an enterprise wipe on the device.

Serial Number	Includes, Does Not Include, Equals, Starts With, Contains	Lists a number that identifies a mobile device as this number pertains to an app.
Support Email	Includes, Does Not Include, Equals, Starts With, Contains	Lists an email for the support team of the company that created and maintains the app.
Support Number	Includes, Does Not Include, Equals, Starts With, Contains	Lists a number for the support team of the company that created and maintains the app.
Support URL	Includes, Does Not Include, Equals, Starts With, Contains	Lists a URL for the support team of the company that created and maintains the app.

Type	Includes, Does Not Include, Equals, Starts With, Contains	Indicates whether the app is a public or internal app, as reported by the Workspace ONE UEM console.

UEM App GUID	Includes, Does Not Include, Equals, Starts With, Contains	Lists a unique value attributed to the app by the Workspace ONE UEM console.
UEM App ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the unique string used to identify an app package as defined at the app attribute level and reported by the Workspace ONE UEM console.
Un-Enrollment Date	Before, After, Between, Not Between, Within, Not Within	Lists the date a device unregisters as managed with the Workspace ONE UEM console as the device pertains to an app .
User Domain	Includes, Does Not Include, Equals, Starts With, Contains	Lists the domains users authenticate to and work in when they use an app.
User GUID	Includes, Does Not Include, Equals, Starts With, Contains	A global unique identifier (GUID) generated by a system to represent a specific user.
Username	Includes, Does Not Include, Equals, Starts With, Contains	The basic or directory user name used to register an app into Workspace ONE UEM.

Version Code	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the version code of the app as defined at the app attribute level.

Devices filters

Filter	Operator	Description
AC Line Status	Includes, Does Not Include, Equals, Starts With, Contains	Indicates whether the device is using the AC plug.
Activation Lock Enabled	Equals	Indicates whether the device locks when the user wakes it from inactivity.
Android Battery Health	Includes, Does Not Include, Equals, Starts With, Contains	Reports how much battery charge a battery has in an Android device.
Antivirus Status	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates whether an event has occurred on a device.
Asset Number	Includes, Does Not Include, Equals, Starts With, Contains	Represents a unique identifier stored in the Workspace ONE UEM console that the organization generates and the admin enters into the console.
Autoupdate Status	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates whether a device is set to update automatically or manually.
Available Device Storage Capacity	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates the amount of data a device has remaining, measured in kilobytes (KB), megabytes (MB), gigabytes (GB), and terabytes (TB). You must enter the value in bytes.
Available Physical Memory	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates the amount of RAM that is unused and available on a device.

BIOS Version	Includes, Does Not Include, Equals, Starts With, Contains	The version of BIOS on a device.
Battery Percent	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates the percentage of charge a device battery has available.
Boot App Security Version Update	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Identifies the security version of the Boot Application that was loaded during initial start of a selected device.
Boot Debugging Enabled	Equals	Points to a device in development and testing. These devices are typically less secure, might run unstable code, or be configured with fewer security restrictions required for testing and development.
Boot Manager Rev List Version	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates the version of the Boot Manager running on a device so you can track and manage the security of the start sequence and environment.

CPU Virtualization	Equals	Indicates whether the device allows a single processor to act as if it were multiple CPUs.
Cellular Technology	Includes, Does Not Include, Equals, Starts With, Contains	Indicates the cellular or mobile technology the device uses for communication. Types include global systems for mobile (GSM), code division multiple access (CDMA), and universal mobile telecommunications system (UMTS).
Cloud Backup Enabled	Equals	Indicates whether the device allows the user to back up data to a cloud.
Code Integrity Enabled	Equals	Indicates the version of the code that is performing integrity checks during the start sequence.
Compliance Status	Includes, Does Not Include, Equals, Starts With, Contains	Indicates whether the device is in compliance with rules set in Workspace ONE UEM.
Compromised	Equals	Indicates whether the device has a potential security threat like if it is jail broken or rooted.
Country	Includes, Does Not Include, Equals, Starts With, Contains	Indicates the country the device was manufactured in.

Data Roaming Enabled	Equals	Indicates that the device can use cellular data when not in its network.
Dell Battery Health	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports how much battery charge a battery has in a Dell device.
Description	Includes, Does Not Include, Equals, Starts With, Contains	Mirrors the description for the device the admin entered in the Workspace ONE UEM console.
Design Capacity	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates the maximum output of an Apple device battery based on it design. This value often decreases as the battery age increases.
Device GUID	Includes, Does Not Include, Equals, Starts With, Contains	Represent a global unique identifier (GUID) generated by Windows for Windows devices.
Device ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	The unique Device ID created by Workspace ONE UEM that is used to look up a device.
Device Name	Includes, Does Not Include, Equals, Starts With, Contains	Represents an ID given to a device so that it can work with other devices and components. A device user or admin can change this name.
Device Organization Group GUID	Includes, Does Not Include, Equals, Starts With, Contains	Represents a global unique identifier (GUID) generated by Workspace ONE UEM that identifies a group created in the Workspace ONE UEM console and assigned to a device when you add the device to the organization group.
Device Organization Group ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Represents a unique identifier for an Organization Group defined in Workspace ONE UEM.
Device Organization Group Name	Includes, Does Not Include, Equals, Starts With, Contains	The name of an Organization Group in Workspace ONE UEM.
Device Storage Capacity	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates the total device capacity. You must enter the value in bytes.
Device Type	Includes, Does Not Include, Equals, Starts With, Contains	Indicates the form factor of a device. For example, it indicates if the device is a tablet, phone, or desktop.
Device UDID	Includes, Does Not Include, Equals, Starts With, Contains	Indicates a unique identifier generated by the manufacturer.
Display Name	Includes, Does Not Include, Equals, Starts With, Contains	Indicates a name that presents to others that communicate with the device and is often different than the user name.

EAS Identifier	Includes, Does Not Include, Equals, Starts With, Contains	A unique device identifier provided by Exchange for iOS endpoints.
Email	Includes, Does Not Include, Equals, Starts With, Contains	The email address used to register a device into Workspace ONE UEM.
Encryption Status	Equals	Indicates whether the device encrypts communications.
Enrollment Date	Before, After, Between, Not Between, Within, Not Within	Reports the date when a device enrolled as managed with Workspace ONE UEM.
Enrollment Status	Includes, Does Not Include, Equals, Starts With, Contains	Indicates the last, reported, enrollment stage of the device with the Workspace ONE UEM console.
Enterprise Version Description	Includes, Does Not Include, Equals, Starts With, Contains	Indicates the version of the OEM service the device uses.

Firewall Global State Status	Equals	Whether there is the Firewall Global State is present on the device.
Firewall Status	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports if the device uses an enabled, and healthy Firewall.
Firmware Password Status	Equals	Indicates if the device uses a password to restrict access to device start options.
First Name	Includes, Does Not Include, Equals, Starts With, Contains	Lists the first name of the user the device is registered to. It is an attribute reported by the Workspace ONE UEM console.
Friendly Name	Includes, Does Not Include, Equals, Starts With, Contains	The device name generated by Workspace ONE UEM.
Full Charge Capacity	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	The maximum charge a battery can currently hold. As battery health decreases over time, so does its full charge capacity.

GPS Latitude	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports a coordinate value of a device that represents its distance north or south from the equator.
GPS Longitude	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports a coordinate value of a device that represents its distance east or west from the prime meridian.

Home Carrier	Includes, Does Not Include, Equals, Starts With, Contains	Displays the name of the service provider to which the device is connected.

IMEI	Includes, Does Not Include, Equals, Starts With, Contains	Lists the unique 15-digit number that identifies the device. This value often is used when a device is lost or stolen.
IP Address	Includes, Does Not Include, Equals, Starts With, Contains	Lists the numeric address of machine that is part of a TCP/IP-based network. It is a unique identifier and represents a node in a network.
Interrogator Data	Equals	Data from an interrogator or reader concerning the signals it sends out for communications.

Last Cloud Backup	Before, After, Between, Not Between, Within, Not Within	Lists the date the device stored data to a cloud storage.
Last Compliance Check	Before, After, Between, Not Between, Within, Not Within	Lists the date the device checked in with Workspace ONE UEM and was validated against UEM device compliance rules.
Last Name	Includes, Does Not Include, Equals, Starts With, Contains	Lists the last name of the user the device is registered to. It is an attribute reported by the Workspace ONE UEM console.
Last Seen	Before, After, Between, Not Between, Within, Not Within	The last time when a device checked in and device parameters changed from the last reported parameter values.
Lost Mode Enabled	Equals	Indicates if a device enabled lost mode so that you can track it if it is lost or stolen.

MAC Address	Includes, Does Not Include, Equals, Starts With, Contains	Reports the unique hardware identification number that identifies the device on a network.
Managed	Equals	Reports if the device is managed or unmanaged by the Workspace ONE UEM console.
Managed By	Includes, Does Not Include, Equals, Starts With, Contains	Reports which type of management is present on the device. For example, mobile device management.
Manufacturer Name	Includes, Does Not Include, Equals, Starts With, Contains	The manufacturer information for a rugged device.
Middle Name	Includes, Does Not Include, Equals, Starts With, Contains	Lists the middle name of the user the device is registered to. It is an attribute reported by the Workspace ONE UEM console.
Model	Includes, Does Not Include, Equals, Starts With, Contains	The model information reported by a device and displayed in Workspace ONE UEM under Device Details.

Next Compliance Check	Before, After, Between, Not Between, Within, Not Within	Indicates a future time the device checks in with the Workspace ONE UEM console to validate its compliance status with compliance rules set in the console.

OS Version	Includes, Does Not Include, Equals, Starts With, Contains	The OS version reported by a device and displayed in Workspace ONE UEM under Device Details.
OS Version Build	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists a number that represents the specific build of the device’s operating system. It is formatted as `<major version>.<minor version>.<patch>`.
OS Version Major	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the first number string in the operating system version number that is formatted as `<major version>.<minor version>.<patch>`.
OS Version Minor	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the second number string in the operating system version number that is formatted as `<major version>.<minor version>.<patch>`.
Organization Group GUID	Includes, Does Not Include, Equals, Starts With, Contains	A global unique identifier (GUID) generated by Workspace ONE UEM that identifies a group created in the Workspace ONE UEM console.
Organization Group Hierarchy	Contains All Of, Contains Any Of, Contains None Of, Contains	The hierarchy of Organization Groups in Workspace ONE UEM.
Ownership	Includes, Does Not Include, Equals, Starts With, Contains	Indicates whether a device is owned by a person or by an organization.

Passcode Compliant	Equals	Indicates if a device uses a passcode that meets passcode format rules set in the Workspace ONE UEM console.
Passcode Compliant with Profiles	Equals	Indicates if a device uses a passcode that meets passcode format rules and also includes profiles configured and deployed from the Workspace ONE UEM console.
Passcode Present	Equals	Reports if a device uses a passcode.
Personal Hotspot Enabled	Equals	Reports if a user has enabled the device to share its data connection to another device over the air.
Phone Number	Includes, Does Not Include, Equals, Starts With, Contains	Lists the phone number of the device as reported by the Workspace ONE UEM console.
Platform	Includes, Does Not Include, Equals, Starts With, Contains	Lists the manufacturer or type of device as reported by the Workspace ONE UEM console.

Recovery Key Escrowed	Equals	Indicates whether a key to decrypt encrypted data is held in escrow (a location other than the device) so that a third party can recover encrypted communications from a device.
Recovery Key First Escrowed Time	Before, After, Between, Not Between, Within, Not Within	Indicates the time when a key that decrypts encrypted data was stored in escrow, a location other than the device.
Recovery Key Last Time Still Valid	Before, After, Between, Not Between, Within, Not Within	Indicates the time a key that decrypts encrypted data that is stored in escrow, a location other than the device, was valid to encrypt.
Recovery Key Value	Includes, Does Not Include, Equals, Starts With, Contains	Used to recover devices protected by BitLocker encryption.
Reset Count	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports the number of times a PC has hibernated or resumed. Reported only for devices that support TPM 2.0.
Restart Count	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports the number of times a PC has rebooted. Reported only for devices that support TPM 2.0.
Roaming	Equals	Indicates whether the device allows cellular data use while roaming.

SIM Card ID	Includes, Does Not Include, Equals, Starts With, Contains	Lists a number that identifies a specific SIM card in a device that stores a key to allow the device over the air communications with a carrier.
SIM Sequence Number	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between
Secure Boot Enabled	Equals	If enabled, it indicates that the core components used to boot the machine have the correct cryptographic signatures trusted by the organization that manufactured the device. The UEFI firmware validates trusted signatures and then allows the machine start. If any files have been tampered with, breaking their signature, the system does not start.
Security Patch Date	Before, After, Between, Not Between, Within, Not Within	Lists the date an installed security patch on a device was published by the applicable platform security team.
Serial Number	Includes, Does Not Include, Equals, Starts With, Contains	Lists a number that identifies a mobile device. Some device manufacturers use the same number for the IMEI number and the serial number.
Shared	Equals	Indicates whether the device is used by multiple users, as in a check-in and check-out scenario.
Supervised	Equals	Indicates whether a device is registered with an end-point management system in supervised mode. This mode gives control of the device to the end-point management system.
Supports Offline Geofencing	Equals	Indicates if the device supports controlling the communication range of a device when the device is off the mobile network.

TPM Chip	Equals	Reports if a device has a trusted platform module (TPM) chip used to store RSA encryption keys for hardware authentication.
Time Machine Backup	Before, After, Between, Not Between, Within, Not Within	Indicates whether an iOS device has enabled and uses Time Machine to create a copy of the device at a specific date and time.
Time Machine Backup Status	Equals	Reports if users have successfully saved a ghost or copy of their devices with Time Machine.
Total Physical Memory	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Indicates the total amount of RAM, used and unused, on a device.
Trusted Execution	Equals	Allows devices to use the Trusted Platform Module chip, CPU Virtualization, and Virtualization IO for trust decisions.

Un-Enrollment Date	Before, After, Between, Not Between, Within, Not Within	Lists the date a device unregisters as managed with the Workspace ONE UEM console.
User Domain	Includes, Does Not Include, Equals, Starts With, Contains	Lists the domains users authenticate to and work in when they use the device.
User GUID	Includes, Does Not Include, Equals, Starts With, Contains	A global unique identifier (GUID) generated by a system to represent a specific user.
Username	Includes, Does Not Include, Equals, Starts With, Contains	The basic or directory user name used to register a device into Workspace ONE UEM.

Virtual Secure Mode Status	Equals	Reports if a Windows device user has enabled Virtual Secure Mode.
Virtualization I/O	Equals	Allows input/output virtualization.
Voice Roaming Enabled	Equals	Indicates whether the device allows telephony use while roaming.

Zebra Battery Charge Cycle Count	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Lists the number of times a Zebra battery has been charged.
Zebra Battery Health	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports the charge available on a Zebra battery.
Zebra Battery Manufacturer Date	Includes, Does Not Include, Equals, Starts With, Contains	Lists the date the battery was made.
Zebra Battery Part Number	Includes, Does Not Include, Equals, Starts With, Contains	Lists a specific number that identifies the battery design.
Zebra Battery Serial Number	Includes, Does Not Include, Equals, Starts With, Contains	Lists a unique number that identifies the single specific battery.

OS Updates filters

Filter	Operator	Description
CVE Identifier List	Contains All Of, Contains Any Of, Contains None Of, Contains	An entry in a public dictionary called the CVE List maintained by MITRE that provides a definition for an identified common vulnerability and exposure (CVE).
Common Vulnerability Scoring System	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	An open industry way to represent the severity of a vulnerability using a numbered score.

Device GUID	Includes, Does Not Include, Equals, Starts With, Contains	A global unique identifier (GUID) generated by Windows for Windows devices.
Device ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Unique identification for each device generated by Workspace ONE UEM.
Device Name	Includes, Does Not Include, Equals, Starts With, Contains	The device name created by the end user.
Device Organization Group GUID	Includes, Does Not Include, Equals, Starts With, Contains	A global unique identifier (GUID) generated by Workspace ONE UEM that identifies a group created in the Workspace ONE UEM console and assigned to a device when you add the device to the organization group.
Device UDID	Includes, Does Not Include, Equals, Starts With, Contains	Unique identification generated by the device manufacturer.

Email	Includes, Does Not Include, Equals, Starts With, Contains	The email address used to register a device into Workspace ONE UEM.
Enrollment Date	Before, After, Between, Not Between, Within, Not Within	The date a Windows device enrolled as managed with Workspace ONE UEM.
Enrollment Status	Includes, Does Not Include, Equals, Starts With, Contains	Reports if the device is enrolled or unenrolled from Workspace ONE UEM.

Friendly Name	Includes, Does Not Include, Equals, Starts With, Contains	The device name generated by Workspace ONE UEM.

Last Seen	Before, After, Between, Not Between, Within, Not Within	The date and time the device checked in with the Workspace ONE UEM console.

Manufacturer Name	Includes, Does Not Include, Equals, Starts With, Contains	The manufacturer information for a rugged device.
Model	Includes, Does Not Include, Equals, Starts With, Contains	The model information reported by a device and displayed in Workspace ONE UEM under Device Details.

OS Version	Includes, Does Not Include, Equals, Starts With, Contains	The OS version reported by a device and displayed in Workspace ONE UEM under Device Details.
Organization Group GUID	Includes, Does Not Include, Equals, Starts With, Contains	A global unique identifier (GUID) generated by Workspace ONE UEM that identifies a group created in the Workspace ONE UEM console.
Organization Group Hierarchy	Contains All Of, Contains Any Of, Contains None Of, Contains	The hierarchy of Organization Groups in Workspace ONE UEM.
Organization Group ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Unique identification for each Organization Group in Workspace ONE UEM.
Organization Group Name	Includes, Does Not Include, Equals, Starts With, Contains	The name of an Organization Group in Workspace ONE UEM.

Un-Enrollment Date	Before, After, Between, Not Between, Within, Not Within	The date a device unenrolled from Workspace ONE UEM.
User GUID	Includes, Does Not Include, Equals, Starts With, Contains	Indicates a unique identifier generated for each user.
Username	Includes, Does Not Include, Equals, Starts With, Contains	The basic or directory user name used to register a device into Workspace ONE UEM.

Windows Patch Approval Status	Includes, Does Not Include, Equals, Starts With, Contains	Identifies if the applicable admin has approved the Windows patch for installation.
Windows Patch Approve Date	Before, After, Between, Not Between, Within, Not Within	The date the admin approved the Windows patch for installation.
Windows Patch Assignment Status	Includes, Does Not Include, Equals, Starts With, Contains	Identifies if the applicable admin has been assigned the Windows Patch for installation.
Windows Patch KB Description	Includes, Does Not Include, Equals, Starts With, Contains	The description of a patch reported by a device and created by Microsoft.
Windows Patch KB Number	Includes, Does Not Include, Equals, Starts With, Contains	The unique identification for a Knowledge Base article reported by a device and created by Microsoft.
Windows Patch KB Title	Includes, Does Not Include, Equals, Starts With, Contains	The title of a Knowledge Base article reported by a device and created by Microsoft.
Windows Patch Publish Date	Before, After, Between, Not Between, Within, Not Within	Lists the date that Microsoft published the patch.
Windows Patch Revision ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	The unique identification for a patch revision in Workspace ONE UEM.
Windows Patch Update Classification	Includes, Does Not Include, Equals, Starts With, Contains	The classification of a patch reported by a device and created by Microsoft.
Windows Patch Update ID	Includes, Does Not Include, Equals, Starts With, Contains	The unique identifier for each Windows Patch update.
Windows Patch Update Status	Includes, Does Not Include, Equals, Starts With, Contains	Indicates if a Windows patch is available for installation.
Windows Patch Update Type	Includes, Does Not Include, Equals, Starts With, Contains	The type of patch update reported by a device and created by Microsoft.

Profiles filters

Filter	Operator	Description
Event Received Time	Before, After, Between, Not Between, Within, Not Within	The time Workspace ONE received and processed the last updates to the profile record.
Managed Profile	Equals	This value is true or false. It helps admins understand if the profile is managed and assigned by Workspace ONE or if a profile is installed by the end user.
Profile Active Status	Equals	This value is true or false. It helps admins understand if the profile was deactivated or not by another admin. This scenario typically results in the profile getting removed from the device.
Profile Assigned Version	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	The integer version of the latest profile version published and assigned by the admin to the device. Use this filter in combination with the Profile Installed Version to determine if a device is missing the latest update.
Profile Assignment Type	Includes, Does Not Include, Equals, Starts With, Contains	This value is Auto or Optional. It determines if the profile gets deployed to the device automatically upon publishing or if the profile is made available to the user to be installed manually.
Profile Configuration Type	Includes, Does Not Include, Equals, Starts With, Contains	Describes the target entity of the profile when deployed. Helps admins know the kind of profile, which can include SDK, App Catalog, or Device.
Profile GUID	Includes, Does Not Include, Equals, Starts With, Contains	Represents a global unique identifier (GUID) for each profile generated by Workspace ONE Intelligence.
Profile ID	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	A unique identification for each profile generated by Workspace ONE UEM.
Profile Installation Status	Equals	This value is true or false. True means the profile is reported as installed.
Profile Installed Version	Equals, Not Equal To, Less Than, Less Than or Equal To, Greater Than, Greater Than or Equal To, Between, Not Between	Reports the current installed version of the profile. Use this filter with Profile Assigned Version to understand if the device is up to date.
Profile Name	Includes, Does Not Include, Equals, Starts With, Contains	Identifies the name the admin gave when configuring and publishing the profile.
Profile Payloads Installed	Contains All Of, Contains Any Of, Contains None Of, Contains	Represents comma separated lists of the payloads configured in the profile. For example, it represents whether the profile is configuring restrictions, certificates, email, wi-fi, or VPN.
Profile Status	Includes, Does Not Include, Equals, Starts With, Contains	This is a more detailed status of where the profile is in transit to the device.

Profile Status values

ConfirmedInstall – Profile install confirmed by Workspace ONE.
ConfirmedRemoval – Profile removal confirmed by Workspace ONE.
Corrupted – Profile not installed due to unknown error.
NotSupported – Profile can’t be installed because of an unsupported operating system.
PendingInformation – Profile not installed due to device processing.
PendingInstall – A command to install the profile is in transit to the device.
PendingRemoval – A command to remove the profile is in transit to the device.
UnconfirmedInstall – The profile installation command was queued and the command was acknowledged by the device. The profile status turns to Confirmed Installed once the sample from device reports it as installed.
UnconfirmedRemoval – The profile removal command was queued and the command was acknowledged by the device. The profile status turns to Confirmed Removal once the sample from the device reports it as uninstalled.