Ivanti UEM connector

The Ivanti UEM connector feeds the Portail ZAPP CMDB with the inventory of the machines managed by an Ivanti UEM server. That server is usually installed in your network and cannot be reached from outside: collection therefore goes through the Outpost agents installed on your premises, which query the Ivanti server and send back the result. The screens are reserved for administrators; the Ivanti UEM entry is in the Administration › Connectors and automation menu.

Ivanti UEM here means the console installed on your premises (Ivanti EPM, Endpoint Manager). For the Ivanti online platform, see the "Ivanti Neurons connector" page.

What is imported

For each machine of the chosen Ivanti query, the connector creates or updates, in the CMDB, a Computer (name, domain, operating system, processor, memory) with its Disks, Network Adapters and Installed software. The information actually returned depends on the column definition prepared in the Ivanti console (see below): a column missing from that definition is not imported.

A machine already known is not duplicated: if another source (for example the Intune connector) has already imported it, it is matched by its serial number, MAC addresses or name, and its fields are completed. For the serial number and the model, Ivanti UEM prevails over Intune, because it reads the hardware directly. The Ivanti connector does not fill in the Primary user.

Imported machines are found in the CMDB, type Computer.

Before creating a source

• In Portail ZAPP, an Outpost machine group (Administration › Connectors and automation › Outpost › Machine groups menu) contains the agent(s) that will run the collection. The agents must be able to reach the Ivanti server.
• In the Ivanti console, the Ivanti administrator has created a column definition (it sets the information returned: BIOS, processor, memory, storage, network, software…) and, preferably, a query that selects the machines to inventory.
• An Ivanti service account allowed to read the inventory; its password is stored in the Portail ZAPP Secrets vault. The source refers to this secret by its name, never by its value.

Creating a source

The Ivanti UEM sources page lists the sources with their name, slug, schedule and state. Click + New source and fill in:

• Name and Slug (short identifier; it can no longer be changed after creation);
• Machine group: the collection is triggered on every agent member of the group;
• MBSDK web service URL: the full address of the Ivanti web service, path included, for example https://ivanti.example.local/MBSDKService/MsgSDK.asmx — not just the server name;
• Ivanti service account and Secret (account password);
• Ivanti column definition name, exactly as written in the Ivanti console;
• Ivanti machine list filter: the name of the Ivanti query to inventory. You can type it, or click Load list to get the queries of the Ivanti server (fill in the machine group, address, account and secret first). If loading fails ("The agent did not respond in time.", "This machine group has no agent."…), the field keeps its value and stays editable; "No active agent in this machine group: its members are revoked, quarantined or archived." flags a group that has machines, but none active: reactivate one of them or add an active agent to the group;
• Ivanti timeout (seconds): 30 by default;
• Schedule (cron, optional): how often to collect, chosen with the builder. Without a schedule, the source is never triggered automatically.

Click Save.

Enabling, editing, deleting

• The button in the Enabled column enables or suspends the source and its scheduled collection.
• Edit opens the same form; clearing the schedule removes the scheduled collection.
• The bin deletes the source and its scheduled collection, after confirmation. Machines already imported stay in the CMDB.

How a collection runs

1. At the scheduled time, Portail ZAPP sends the collection request to each agent of the group, one after the other. Each agent runs its own collection, with no grouping between agents. An empty group produces no collection and is not an error.
2. The agents work in the background. Every 2 minutes, the IvantiInventoryPollCollection job picks up the finished collections and brings their machines into the CMDB. An unreadable machine does not prevent the others from being integrated.

Following the collections

The Edit page of a source shows its Source activity:

• Last scheduled trigger: start, status and, on failure, the explanation;
• Last collections: one line per agent and per collection (start, status, imported machines, errors), with the failure code and its explanation in your language.

Each scheduled source also creates a job in the Scheduler (Administration › Instance and operations › Scheduler), named Connector.IvantiUEM: followed by the source identifier. Its page lets you Trigger now a collection and shows the Execution history:

• Success: the collection requests have been sent to the group's agents. The result of the collections themselves shows in the source activity and in the CMDB, after the IvantiInventoryPollCollection job has run. Note: if the group no longer contains any agent (or has been deleted), the job also succeeds, without collecting anything — check the group if no machine arrives;
• Error: the collection could not start; the history gives the explanation (see "Troubleshooting").

The IvantiInventoryPollCollection job ends in PartialSuccess when a collection it picked up has failed: its history gives the cause. When several collections failed, it gives their number and the detail per source: open the activity of each source.

Troubleshooting

Each failure carries a stable code (used by the API and exports, followed by an English sentence) and an explanation in the user's language. The technical detail (agent message, Ivanti server response) is never displayed: it is written to the server log and to the agent log.

An up-to-date Outpost agent sends the code of the cause and the HTTP status itself: the explanation no longer depends on the text of its message. With an older agent, the cause is deduced from this text, as before.

A code missing from this table is shown as "Collection failed: code"; an unforeseen error is shown as "Unexpected error" with its type, the detail being in the server log.