Converge vSphere 8 to VMware vSphere Foundation 9.1.x

fabio1975, , , , , , Leave a comment

.

ATTENTION!!

This is a document that was created from a Home Lab.

My Home Lab:

vSphere 8u3i

One vCenter

Two ESXi hosts (Nested)

One NFS datastore (TrueNAS)

Official Documentation

Source Converge a vCenter Instance and ESX Hosts to vSphere Foundation

Verify upgrade path from Product Interoperability Matrix

Requirements

Prepare a temporary IP for vCenter

Prepare five FQDNs and register on DNS (with reverse) for:

1 VCF Operation

3 VCF Management Services

1 VCF License server

And ten IP addresses (minimum) for Management Services

.

UPGRADE STEP

• vCenter Upgrade
• Install VCF Installer
◦ Install VCF Operations
◦ Install VCF Management Services
• Upgrade ESXi
◦ Upgrade ESXi Hosts
◦ Upgrade vDS
◦ Upgrade VMware Tools
◦ Upgrade Virtual HW

.

vCenter Upgrade

You must deploy the new vCenter in the vSphere Cluster that you need to upgrade at VVF. In my test, I deployed the new vCenter in another vSphere infrastructure, and the VCF Installer reports an error.

The vCenter upgrade process is a classic vCenter upgrade.

.

Download vCenter 9.1 from the Broadcom Support Portal

Dedicate a temp IP address and FQDN name (need to register in DNS) for deployment

Mount the downloaded ISO on a bridge PC or Virtual Machine

Start the UI installer

 .

Select upgrade

 .

Start the deployment

.

Deploy the VCF Installer appliance.

I covered this installation in another Post; read this post:

Start a New vSphere Foundation Deployment by Using the VCF Installer Deployment Wizard – BIOLNX

Deploy VCF Operations

Log in to VCF Installer

Download bundles for the VCF Installer appliance (Read this post: Start a New vSphere Foundation Deployment by Using the VCF Installer Deployment Wizard – BIOLNX)

Use VCF Installer to deploy your vSphere Foundation platform.

.

.

Select I have an existing vCenter

Select the network infrastructure for the Management Services and Operations component in my Home Lab. I choose the network where the VM is deployed (otherwise, create a dedicated network; check the firewall configuration in the official documentation)

.

.

Dedicate IP address and FQDN (with reverse)

VVFOPUP.pollaio.lan 192.168.80.110

VVFMNGSUP01.pollaio.lan 192.168.80.111

VVFMNGSUP02.pollaio.lan 192.168.80.112

VVFMNGSUP03.pollaio.lan 192.168.80.113

VVFLICUP01 192.168.80.114

.

.

We enter the FQDN names of the objects; if entered correctly in the DNS (with the reverse), they have a green tick

.

In my case, if the new vCenter is not deployed in the cluster that we want upgrade, we see an error.

.

After vCenter migrating to the vSphere cluster object for the upgrade

.

Save the Password!!!!

Start the VCF Operation appliance installation

.

At the end of VCF operation Installation, we can log in to the VCF Operations UI

Now we can configure the License (See this post)

Register VCF Operations and Your License Server in Connected Mode – BIOLNX

.

Upgrade ESXi

Log in to vCenter and select the Lifecycle Manager

After some time, under Software Depot, the new ESXi version appears

Now we create a new Image; go to Image Library and select Create Image

 

Validate and save

.

Go to Inventory

Select the cluster and after updates

.

Now the upgrade will start if the cluster is correctly configured

Upgrade Virtual Distributed Switch

.

.

Next step

Upgrade VMware Tools

Upgrade Virtual Hardware

.

Converge vSphere 8 to VMware vSphere Foundation 9.1.x

Register VCF Operations and Your License Server in Connected Mode

fabio1975, , , , , , Leave a comment

In my previous post, I walked through the process of deploying VMware vSphere Foundation (VVF) in my Home Lab using the VCF Installer, from infrastructure preparation to the initial bring-up of the environment. [If you missed it, you can find it here:

Start a New vSphere Foundation Deployment by Using the VCF Installer Deployment Wizard – BIOLNX

With the deployment up and running, the next step is licensing the environment. In this post, I cover how I activated the VVF licenses, the options available, and a few gotchas I ran into along the way — useful if you’re following the same path in your own lab and want to move from a freshly deployed environment to a fully licensed one.

 

Log in to VCF Operations

From the navigation bar at the top, click Manage and in the left navigation pane, click Licensing -> Licenses & Registration

 

In the Register & License VCF Operations pane, click Continue

 

 

The Register and License VCF Operations workflow appears.
The first step of the procedure is complete because a license server is automatically deployed during a new VCF Operations 9.1 deployment and an upgrade to VCF Operations 9.1.

In the Select Connection Mode card, select
Start, and click Continue.

 

 

Navigate to the Registration section.

Get an activation code for your registration. In the Get Activation Code from VCF Business Services console card, click Start

 


The VCF Business Services console opens in a new tab.

 

 

Log in to the VCF Business Services console by using your Broadcom Support Portal credentials.

Select the Site ID to which you want to register this VCF Operations instance, and click
Next. If you have only one site, it is selected by default.

In the VCF Business Services console, оn the Register & License VCF Operations page, navigate to the Registration part of the registration workflow.

In the Name VCF Operations pane, click Start, enter a unique display name for your
VCF Operations instance, and click Save

The FQDN is only saved if you do not enter another display name. If you change the FQDN with another display name, the connectivity between
VCF Operations
and the VCF Business Services console is not impacted. You can change the display name at any time after the registration.

In the Generate Activation Code card, click Start

 

.

A dialog box with the activation code appears.

 

 

Click Copy (and save the info into a notepad file) Verify that you copied the code, and click Finish

Navigate to the VCF Operations instance, and upload the activation code. In VCF Operations, in the Enter Activation Code card, click Start

 


A dialogue box appears.

In the text field, paste the activation code, and click Activate

 

 

 

In the Add Licenses from VCF Business Services console card, click Start

 

 

The VCF Business Services console opens in a new tab.

In the VCF Business Services console, add licenses to your license servers.

 

To complete the registration process, you must first add licenses to each license server.

In the Add Licenses section of the registration workflow, in the card for the respective license server, click Start
On the Allocate Licenses page, enter a display name for the license server.

If you want to split the default license or change a license’s capacity before assigning it, click the vertical ellipsis next to the license. To split the default license, select it from the list and click Create. Enter a name and license capacity for the split license. To change the capacity of a split license, enter the capacity for the license in the New Capacity column. Click Save.

Select licenses from the table to add to the license server, and click Confirm.
To license your environment, you must add at least one primary license to the license servers. You can add licenses during the registration process, or at any time after that.

 

   

 

Download the license file in the VCF Operations instance.

Navigate to the Licenses page.

In the Add Licenses to License Servers section, in the Download card, click
Download.

 

 

On the Register and License VCF Operations page, click Finish

 

 

 

Now we can assign the license to vCenter. Select Assign Primary License after checking the vCenter instance to assign the license.

 

 

 

Select the license to assign and click Assign

 

 

 

Now the assigned license Core Count and Host Count are Green (if you have sufficient licenses to assign)

 

 

 

From vCenter, by accessing from the vSphere client, we can show the license status under Administration -> License -> Version 9+ License

 

 

 

.

Register VCF Operations and Your License Server in Connected Mode

Start a New vSphere Foundation Deployment by Using the VCF Installer Deployment Wizard

fabio1975, , , , , , , Leave a comment

For a long time, I wanted to get my hands on VMware vSphere Foundation (VVF) and understand closely how the deployment process has changed with the introduction of the VCF Installer. Thanks to a few days off and a desire to experiment, I decided to dedicate my Home Lab to this project, retracing the entire installation process step by step, from preparing the infrastructure to the first boot of the environment.

In this post, I tell you how I set up the deployment, what hardware and network resources I used, the configuration choices made along the way and, of course, the difficulties encountered (and how I solved them) during the installation via VCF Installer. The goal is to share a practical experience useful to those who want to approach VVF starting from a laboratory environment, without the complexity (and costs) of an enterprise deployment.

In this first post, we will see the installation; in the next posts, we will install/activate the licenses and install the Log component

.

Being a home lab, my environment will consist of nested ESXi Hosts; here are some details:

Physical HW

ESXi Nested

Two VMs where I install my ESXi to 9.1

Check the Machine Certificate for each ESXi; the certificate needs to trust the ESXi FQDN name.

Storage 

As NFS, I created a TrueNAS VM that resides on SSD disks

Network of ESXI nested:

–One connected to my physical network cards of the server where the port group (VM Network) is present, where I will put the Management and Workload VM part of my ESXi servers
–One that is not connected to physical network cards and where I create a port group for the vMotion part
–One not connected to physical network cards and where I create a port group (NFS) for the NFS part (where, in addition to ESXi, I attach a network card for my TrueNAS)

.

Required resources

.

.

.

.

.

.

As you can see, we have, in addition to the vCenter add-ons, which are:

License Server

A part of VCF Operations. Provides secure and integrated license management for your platform.

vCenter

To say that we all know him well

VCF Operation

VMware Cloud Foundation Operations® (formerly VMware Aria Operations) or VCF Operations helps your organisation build, manage, operate, and secure your private cloud infrastructure by deploying and maintaining its fleet-level components, providing visibility and enhanced performance across the workload and infrastructure stack, and helping your organisation stay compliant with regulatory standards and organisational guidelines.

VCF Management Services

VCF 9.1 introduces VCF management services to provide a unified architecture for centralised lifecycle and operational functionalities. The VCF services runtime instance of the first VCF Instance hosts the fleet-level VCF management services components that perform global operations and the instance-level components for that VCF Instance. Every VCF Instance has a VCF services runtime instance that hosts the instance-level VCF management services that run local tasks. This foundation allows for a unified architecture, simplified lifecycle management, and streamlined backup and recovery of all hosted components.

For the VVF in management servers, we have:

Fleet lifecycle

Log management (to be installed in DAY+1)

SDDC lifecycle

Software depot

Telemetry

VCF services runtime

More details: Components in VCF and vSphere Foundation

.

.

.

.

The steps we’ll take are:

1-Installing ESXi (we won’t cover it in this post)
2-Deploying the VCF installer
3-Configuring the DEPOT
4-Deploying VVF

VCF installer installation

.

Log in to Broadcom Support Portal https://support.broadcom.com/ and Download VCF Installer

.

The next step is to deploy the OVA to ESXi or VMware Workstation

.

.

.

.

.

.

 Once the installation of the OVA is finished, access the URL with the IP or FQDN and log in with the admin@local account and password you set during the deployment

.

 

Configure Depot Connection and download the installation Binaries

.

.

.

.

.

Configuration of the repository for downloading the software for installation (vCenter, ESXi, etc.)

A token must be generated from the portal vcf.broadcom.com

To log in from the Support Portal, select Version 9. Licenses can be found

.

.

.

1.Log in to the VCF Business Services console (vcf.broadcom.com)

.

.

Go to the VCF Installer and create the ID of the depot to upload to the portal

.

.

.

Return to the portal and upload the depot ID to the page that opened

.

.

Copy the Activation code and enter it on the vcf installer screen

.

Let’s download the binaries of the VMware vSphere fountadion

.

.

Once the download is complete, we will see everything “Success”

.

Now I have two ESXi Hosts (in my case, nested vvfesxi01.pollaio.lan and vvfesxi02.pollaio.lan) at version 9.1.0, just installed with no particular configuration (No Storage and more)

Deploy VVF

Let’s proceed with the deployment, selecting “Deployment Wizard” from the VCF Installer

.

.

Let’s define the FQDNs for the various components (vCenter…), and I must obviously have already entered the association with the IP in my DNS (always remember the reverse of the DNS)

.

I run the validate all

.

.

.

Now let’s save and continue

.

Select the version of VVF and DNS, NTP server and DNS suffix

.

We add the ESXi hosts

.

Caution: Verify the certificates correctly on the ESXi hosts, and that the hostname is populated correctly

.

Let’s configure the network, where we will enter the configurations for the VVF management, vMotion and NFS part.

Pages: 1 2
Start a New vSphere Foundation Deployment by Using the VCF Installer Deployment Wizard

SaaS License Activation for Omnissa Horizon without EDGE Gateway

fabio1975, , , , Leave a comment

In the latest versions of Horizon, it is recommended to use the SaaS subscription, which requires the installation of an EDGE Gateway component generated by the Omnissa Connect portal under Horizon in the customer section.

This involves the need to install a Linux VM on our vSphere environment; not for everyone is this feasible:

–Need not have connections with Cloud services
–Resource savings (CPU, RAM and disk space)
–Test environments and any POCs
–Or, as in my case, I must test the new versions of Horizon

For this last point and since I need to install version 2606 as a test, I decided to explain how to do it… step by step.

Installed my connection server on a Windows Server 2025. The first thing to do is access the administration console and activate the license:

.

.

.

Verify that you have received the activation email or that you have a Horizon SaaS subscription and that you have access to the Connect Omnissa portal

So you must log in to the Omnissa Connect portal (by opening a TAB from the Browser you are using to access the Horizon console) and authenticate on connect.omnissa.com and keep the tab open.

.

.

Enter accounts, passwords and if necessary, do MFA

.

.

A new tab will automatically open with the login already made

.

Now run

The following message will appear

.

.

And on the Horizon console, the license status will be as follows

.

.

Two important points

–Mark your calendar to reactivate your license (in the same way) before 90 days have passed
–You can switch to a license via the EDGE Gateway by simply installing the EDGE Gateway (Follow the specific procedure)

.

.

.

.

SaaS License Activation for Omnissa Horizon without EDGE Gateway

App Volumes: VHD in-Guest vs Standard Mode

fabio1975, , , , , , , Leave a comment

Technical comparison and recommended use cases

.

.

INTRODUCTION

Omnissa App Volumes provides two distinct modes for delivering applications to Horizon users: the standard mode (VMDK/VMFS-based) and VHD in-guest mode, introduced to support non-persistent OS scenarios and advanced Instant Clone environments.

The choice between the two modes directly affects performance, scalability, and infrastructure requirements.

MODE COMPARISON

Standard Mode (VMDK)

• VMDK disk attach via vCenter API

• Mandatory needs a vSphere infrastructure as a prerequisite

• Limited support for multi-hypervisor environments

• Dependency on shared vSphere datastores

• Compatible with all Horizon desktop types

VHD in-Guest

• VHD mounted directly inside the guest OS

• Hypervisor-independent

• Compatible with Azure, AVD and physical environments

• VHD exposed via SMB share or UNC path

• Application packages and writable volumes are stored in a high-performance file share

• Compatible with all Horizon desktop types

TAKE NOTE! We can select the mode (VMDK or VHD) when installing the first App Volumes Manager. We can’t switch from VMDK to VHD mode, or from VHD to VMDK mode, after the first configuration.

VHD IN GUEST ARCHITECTURE

In this mode, the App Volumes Agent inside the guest mounts the VHD file from the configured UNC path using native Windows APIs. The AppStack content is then layered onto the filesystem via the App Volumes kernel filter driver, making applications available without extraction.

.

.

Note: In VHD in guest mode, the AppStack .vhd file must be reachable via UNC path from the guest. Network latency to the share directly affects mount times.

WHEN TO CHOOSE VHD IN-GUEST

1

Reducing vCenter dependency

Environments with restrictive policies on vCenter API access or multi-cloud architectures.

.

2

Physical desktops or RDSH

Scenarios where the workload runs on bare metal or RDS servers without vSphere hypervisor.

.

3

Azure Virtual Desktop (AVD) environments

Non-vSphere infrastructure; inability to attach VMDK via vCenter.

.

.

App Volumes: VHD in-Guest vs Standard Mode

Microsoft Azure Edge and Omnissa-Managed Enterprise App Registration

fabio1975, , , , , , , Leave a comment

My Initial Experience

During the preparation activities for deploying a new Horizon Cloud on Azure environment, I was reading the official documentation at

https://docs.omnissa.com/bundle/UsingManagingHorizonCloud/page/DeployingaMicrosoftAzureEdge.html

and discovered the presence of a new and recommended deployment method: the “Omnissa-managed” mode.

I immediately wanted to test it, but in my Omnissa Connect console, this option wasn’t yet available.

.

I contacted support and they informed me that the feature would be released soon, but if I wanted to use it immediately, they could enable it through a Feature Flag. Obviously, I couldn’t say no to that opportunity! Once they provided my ORG ID and enabled the flag, the new option appeared while I was creating the EDGE in the Primary Provider section.

This is my journey with the Omnissa-managed method, and I’d like to share what I learned about this game-changing approach.

.

.

Introduction

Horizon Cloud on Microsoft Azure is evolving, and Omnissa has introduced a significant security enhancement that every administrator should know about. The new Omnissa-managed Enterprise App registration method represents a paradigm shift in how organizations handle service principal credentials. If you’re planning a Horizon Cloud deployment on Azure, understanding the difference between this new approach and the traditional manual method could be crucial for your security posture.

The Security Challenge

Historically, deploying Horizon Edge in Horizon Cloud on Azure required organizations to create and manage their own Azure Enterprise Applications. This approach meant handling sensitive service principal secrets—credentials that need to be carefully managed, rotated, and protected. The more systems that have access to these secrets, the higher the security risk.

The traditional single-tenant deployment method (Manual Enterprise App registration) placed the responsibility of secret management squarely on the customer organization. While this approach continues to be supported, it introduces additional operational overhead and potential security vulnerabilities.

Enter Omnissa-Managed

Omnissa has introduced a new Enterprise App registration method that fundamentally changes who manages the service principal secrets.

Key Benefits

1. Enhanced Security

Organizations no longer need to provide their sensitive secrets key information to Omnissa or manage it themselves in the context of Horizon Cloud deployment. The credentials remain under Omnissa’s direct management, reducing the attack surface and potential points of compromise.

2. Simplified Administration

Say goodbye to manual Enterprise Application creation and complex permission configurations. With Omnissa-managed registration, the setup process is streamlined. Omnissa handles the heavy lifting—you focus on deployment.

3. Reduced Operational Overhead

No more worrying about secret rotation schedules, credential lifecycle management, or complex authentication flows. Omnissa manages these operational concerns, freeing your team for other critical tasks.

4. Enterprise-Grade Security

By centralizing secret management with Omnissa, organizations benefit from enterprise-grade security practices, regular audits, and dedicated security expertise that Omnissa brings to the table.

Manual Registration: Still Available

For organizations with specific requirements or legacy configurations, the traditional single-tenancy method remains available. This manual Enterprise App registration approach allows organizations to maintain full control over their authentication setup if needed. However, unless you have specific compliance or architectural reasons, the manual approach introduces unnecessary complexity.

The Recommendation

Omnissa-managed is the recommended method for all new Horizon Cloud deployments on Azure. Omnissa has taken the guesswork out of enterprise app management and elevated the security baseline for everyone using Horizon Cloud.

If you’re currently on the manual registration path, consider planning a migration to the Omnissa-managed approach. The transition offers immediate security benefits with reduced administrative overhead.

Getting Started

Ready to leverage Omnissa-managed registration for your deployment? The process is straightforward:

1.Initiate your Horizon Edge deployment in Omnissa Connect
2.Select the Omnissa-managed option during the Primary Provider setup

3.Link your Azure subscription using the consent flow (click Consent Link)

4.Authorize Omnissa to create the Enterprise Application

Insert Azure Subscription credentials (in my case Global Admin User)

Now we can see the new enterprise application with Omnissa Logo.

.

.

.

5.Assign necessary roles (Contributor or appropriate custom roles) to the subscription

First, verify the role assignment status in Omnissa Connect:

.

.

Get the Object ID from the Omnissa Enterprise App:

.

.

Go to your subscription and select IAM (Identity & Access Management):

.

Select add role assignment

Search Contributor in Previleged admnistrator Role

Select Member and ad the Enterprise Application Object ID or name

6.Refresh and verify the role assignment in Omnissa Connect

Return to the Omnissa Connect wizard. If the role is still showing as “Role not Assigned”

.

Go back to the previous step and return to refresh (Omnissa Engineer should add a refresh button)

.

.

.

At this point, you’re ready to choose whether your EDGE will be an AKS (Azure Kubernetes Service) or a Virtual Machine.

The Omnissa-managed Enterprise Application has been successfully created and configured with the naming convention omnissa-horizoncloud-app-1, marked with Omnissa’s branding for easy identification.

.

.

Conclusion

The shift to Omnissa-managed Enterprise App registration represents a meaningful step forward in cloud security practices. By removing the burden of service principal secret management from customer organizations, Omnissa enables secure, simplified, and scalable Horizon Cloud deployments on Microsoft Azure.

Whether you’re planning a new deployment or evaluating your current infrastructure, the Omnissa-managed method deserves your attention. It’s security and simplicity working in harmony—exactly what modern cloud deployments should be.

Microsoft Azure Edge and Omnissa-Managed Enterprise App Registration

Streamline Your Enterprise with Omnissa Connect and Microsoft Entra ID

fabio1975, , , , , , , Leave a comment

A guide to enterprise federation, single sign-on, and modern identity management

What is Omnissa Connect?

Omnissa Connect is a centralized platform service that provides IT administrators and users with a single sign-on (SSO) gateway to access and manage all Omnissa services, such as Workspace ONE and Horizon. It streamlines workflows by unifying access, identity management, and service onboarding into one intuitive interface.

Key features of Omnissa Connect include:

•Unified Identity: Single sign-on capabilities and seamless integration with third-party identity providers like Microsoft Entra ID and Okta through the Omnissa Identity Service
•Centralized Administration: IT owners can securely assign roles, set multi-factor authentication (MFA) policies, and manage OAuth applications or API tokens across the entire Omnissa ecosystem
•Subscription Management: Visibility into all Omnissa service subscriptions from a single location

What is Microsoft Entra ID?

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service. It’s the foundation that millions of organizations use to manage employee identities, secure access to applications, and protect their digital assets.

Entra ID is likely already at the heart of your organization if you use:

•Microsoft 365 (Office 365, Teams, SharePoint)
•Azure cloud services
•Dynamics 365 or other enterprise applications
•Single sign-on (SSO) solutions for SaaS applications

Why Integrate Omnissa Connect with Microsoft Entra ID?

Connecting Omnissa Connect with Microsoft Entra ID through enterprise federation creates a powerful identity ecosystem. Here’s what you gain:

Single Sign-On (SSO)

Your users log in once with their corporate credentials and automatically gain access to Omnissa Connect—no separate usernames or passwords to remember.

Automatic User Provisioning

When you add or remove users in Entra ID, they’re automatically synced to Omnissa Connect. No manual account creation, no forgotten deprovisioning, no stale user accounts cluttering your systems.

Centralized Security

Manage all user access, permissions, and security policies from one central location. Apply multi-factor authentication (MFA), enforce password policies, and monitor access across your entire organization from Entra ID.

Reduced IT Overhead

Your IT team spends less time managing separate identity systems, resetting passwords, and troubleshooting access issues. Everything is automated and synchronized.

Improved Compliance

Maintain detailed audit logs of who accessed what and when. Meet regulatory requirements for access control and identity management with confidence.

A Real-World Example

Before Federation:

Sarah joins your company. The IT team manually creates accounts in Omnissa Connect, Microsoft 365, and four other systems. Sarah has to memorize 5 different passwords. When Sarah leaves three years later, the team forgets to deactivate her Omnissa Connect account, leaving a security gap.

After Federation:

Sarah’s first day: HR adds her to Entra ID. Omnissa Connect automatically creates her account and grants the right permissions. She logs in with her corporate email and password—the same one she uses for everything else. On her last day: HR removes her from Entra ID. Within seconds, Omnissa Connect and all other connected systems automatically deactivate her access. No manual steps. No forgotten accounts. No security gaps.

Is This Right for Your Organization?

Enterprise federation between Omnissa Connect and Entra ID is ideal if your organization:

•Already uses Microsoft Entra ID or Azure Active Directory
•Wants to simplify identity management and reduce IT burden
•Has multiple employees and wants to automate user provisioning
•Needs strong security controls and audit capabilities
•Is undergoing digital transformation and standardizing on cloud-based identity solutions

What’s Involved?

Configuring enterprise federation requires several steps—from verifying your domain to setting up the connection between systems to testing everything works smoothly. The process typically involves:

•Domain verification to prove your organization owns the domain
•Creating and configuring an Enterprise Application in Microsoft Entra ID
•Setting up authentication protocols and user attribute mapping
•Testing the setup before activating federation for all users
•Notifying users and helping them transition to the new authentication method

The Complete Step-by-Step Guide

While this overview covers the benefits and concepts, implementing enterprise federation involves detailed technical configuration. The complete guide is a comprehensive document with in-depth instructions, detailed screenshots, and step-by-step walkthroughs for both Omnissa Connect and Microsoft Entra ID configuration. Due to its length and technical depth, I share it directly with clients and organizations ready to implement the solution.

The complete guide includes:

•Detailed screenshots and instructions for each configuration step
•Exact fields to fill in on both Omnissa Connect and Entra ID

.

Ready to streamline your organization’s identity management?

If your organization is ready to implement enterprise federation between Omnissa Connect and Microsoft Entra ID, I’m here to help. Whether you need guidance on setup, troubleshooting during configuration, or best practices for managing the transition, I can provide a complete, step-by-step implementation guide tailored to your needs.

Get in touch to request the full technical guide and start your journey toward simplified, centralized identity management.

.

📧 Contact me for the complete implementation guide

Let’s simplify your organization’s identity and access management together.

Streamline Your Enterprise with Omnissa Connect and Microsoft Entra ID

Horizon 2603 is here!

fabio1975, , , , , , , Leave a comment

A new version of Omnissa Horizon has just been released, and 2603 is not just another update — it’s an ESB (Extended Service Branch) release and marks an important transition point for many environments.

🔗 Release Notes:
https://docs.omnissa.com/bundle/horizon8-rnV2603/page/Horizon8-ReleaseNotes.html

First things first: end of support for vSphere 7

Let’s start with something critical:

Horizon 2603 ESB no longer supports vSphere 7.x

  • Horizon 2512 was the last release supporting vSphere 7
  • Starting from 2603, vSphere 8 is the required platform

This means one thing:
If you’re planning to move to this ESB, your vSphere upgrade is no longer optional — it’s mandatory

This is a key architectural checkpoint, especially for environments that have been delaying the jump to vSphere 8. (vSphere 7 is end of support)

Event Database + Integrated Authentication (finally!)

Now, let’s talk about one of my favorite new features.

Horizon 2603 introduces the ability to configure the Event Database on Microsoft SQL Server using Active Directory identities (Domain User with Integrated Authentication).

No more SQL authentication.

Why this matters:

  • Eliminates stored SQL credentials
  • Aligns with enterprise security best practices
  • Simplifies credential lifecycle management
  • Improves compliance and auditability

From a design perspective, this is a very welcome step toward a more secure-by-default architecture.

 Final thoughts

This release is not just about new features — it’s about setting a new baseline:

  • ✔️ ESB = long-term stability
  • ✔️ vSphere 8 as the standard
  • ✔️ Stronger security integration

If you were waiting for the “right moment” to modernize your Horizon platform… this is probably it.

 In the next posts, I’ll dive deeper into the other new features and changes introduced in Horizon 2603 — stay tuned 👀

Need help testing or upgrading?

If you’re planning to:

  • Test Horizon 2603
  • Upgrade your existing environment
  • Move from vSphere 7 to vSphere 8 or 9

Feel free to reach out — happy to help with assessments, design, and upgrade strategies.

Have you already started testing Horizon 2603?
Or are you still planning your vSphere 8 migration?

Let’s discuss 

Horizon 2603 is here!

UPDATE – Remote Assistance Issue After January 2026 Windows Updates

fabio1975Leave a comment

Following up on the issue “Remote Assistance can’t make the connection”, as already mentioned in last week’s KB, the root cause has now been clearly identified.

The problem is related to recent Microsoft updates released for Windows 11, which address the security vulnerability CVE-2026-20824.

More specifically, the issue is documented in the following KB:

Remote Assistance feature of Omnissa Horizon View Administrator console, not working after January 2026 Windows security update (KB5074109) (6001252)

Note: The solution to this issue is described at the end of this post.

When Does the Issue Occur?

A key point to understand is that the issue is triggered if the updates are installed on either side of the Remote Assistance session:

  • The target machine (the device receiving assistance)
  • The operator machine (the device providing assistance)

 This means that even if your VDI environment is not patched, the error will still occur if the support operator is using a Windows 11 machine updated after January 2026.

The result is the well-known error:

Expected Fix

A permanent fix is expected to be released soon with Omnissa Horizon version 2603 (I hope cool)

Current Workaround

At the moment, if you want to provide Remote Assistance without removing Windows updates, you must follow a manual (and somewhat cumbersome) process.

Steps for the End User (Receiving Assistance)

  1. Click on the Start (Windows) button
  2. Search for and open Remote Assistance
  3. Select “Invite someone you trust to help you”
  4. Click “Save this invitation as a file”
  5. Save the file and share it with the support operator
  6. A security code will be displayed — share this code as well

Steps for the Support Operator

  1. Open the received invitation file
  2. Enter the provided security code
  3. Click OK

Final Step

  • The end user will receive a prompt to approve the connection
  • Once approved, the Remote Assistance session will start

Final Considerations

This workaround allows you to continue providing support without uninstalling security updates, but it is clearly less efficient compared to the standard workflow within the Horizon console.

Until the official fix is released, it is important to:

  • Inform support teams about the behaviour
  • Adjust troubleshooting procedures accordingly
  • Plan for the upcoming Horizon upgrade

Update (April 2026)
The issue described in this article regarding Remote Assistance after the January 2026 Windows updates has been resolved starting from Horizon Agent 2603, with the introduction of a specific registry key.

✅ Solution for Horizon Agent 2603 and later

With Horizon Agent 2603, the issue can be resolved by configuring the following registry key:

HKLM\SOFTWARE\Omnissa\Horizon\RemoteAssistance\fEnableLHTicket

STRING with value set to 1

This key enables a new Remote Assistance user experience, changing the behaviour compared to previous versions.

🧑‍💻 New user experience

When this setting is enabled:

  • The Remote Assistance session follows a more modern workflow aligned with recent Microsoft security changes
  • End users receive clearer and more contextual notifications
  • Compatibility with the latest Windows security updates is ensured

With the key modified, when a Remote Assistance session is initiated, the VDI user will see a code displayed on their screen (similar to the image below) that they must communicate to the operator to allow the operator to connect.

Versions before 2603

For Horizon Agent versions earlier than 2603, the registry key is not available by default.

In this case:

  • You must open a support request with Omnissa
  • Support can provide a specific/custom Agent build
  • Only with that version will it be possible to enable the registry key

Recommendations

    • Plan to upgrade to Horizon Agent 2603 or later whenever possible
    • Validate the registry configuration within your environment before production rollout
    • Test the new user experience to understand the behavioral changes
UPDATE – Remote Assistance Issue After January 2026 Windows Updates

Checking Horizon Cloud Services Connectivity from Horizon Edge Gateway

fabio1975, , , , , , Leave a comment

It is important to remember that the Horizon Edge Gateway is not only used for enabling integration with Horizon Cloud Services, but it is also required in many environments for Horizon subscription licensing.

In modern deployments of Omnissa Horizon, subscription licenses are delivered through the Horizon Cloud control plane rather than through traditional license keys. To enable this mechanism, each Horizon pod must be connected to the cloud service using a Horizon Edge Gateway appliance.

When using subscription-based licensing:

• The Horizon Edge Gateway connects the Horizon pod to Horizon Cloud Services.
• The control plane synchronizes and delivers the Horizon license entitlement.
• No manual license key entry is required on the Connection Server.

For this reason, outbound connectivity to the Horizon Cloud endpoints is critical, not only for cloud services but also for maintaining a valid licensing state in subscription-based environments.

If the Edge Gateway cannot reach the required endpoints due to firewall restrictions, proxy configuration, or SSL inspection, administrators may experience issues such as:

• License synchronization failures
• Horizon services reporting licensing errors
• Problems during onboarding or control plane communication

In contrast, environments using term/perpetual license keys entered directly in the Horizon Console do not require a Horizon Edge Gateway, because licensing is handled locally within the pod.

 

Checking the connectivity

When deploying environments based on Omnissa Horizon integrated with Horizon Cloud Services (HCS), proper outbound connectivity from the Horizon Edge Gateway is critical.

This is the link for Port and Protocol Requirements for Deploying Horizon 8 Edge:

Port and Protocol Requirements for Deploying Horizon 8 Edge

In many enterprise environments, outbound communication toward the internet is tightly controlled through firewalls, proxies, or SSL inspection systems. While this is perfectly reasonable from a security perspective, it often introduces connectivity issues if the required endpoints are not properly allowed.

Even more commonly, the configuration works initially but breaks later because firewall rules are modified, security appliances are upgraded, or SSL inspection policies change over time.

For this reason, whenever issues arise with Horizon Cloud integration, the first thing to verify is whether the Edge Gateway can still reach the required Horizon Cloud Services endpoints.

Fortunately, the Edge Gateway provides a built-in diagnostic tool to help with exactly this scenario.

.

.

.

Using diagnostic.sh to Test Connectivity

The Horizon Edge Gateway includes a script called diagnostic.sh

This script performs a series of connectivity checks toward the Horizon Cloud Services endpoints required for proper operation.

The script validates:

• DNS resolution
• HTTPS connectivity
• Reachability of the required Horizon Cloud endpoints
• TLS handshake validation

This makes it extremely useful when troubleshooting issues caused by:

• Missing firewall rules
• SSL inspection interfering with TLS connections
• DNS resolution problems
• Proxy misconfigurations

.

Running the Diagnostic Script

Log in to the Horizon Edge Gateway via VM Web Console with the root account:

And run this command:

The script will test connectivity against multiple Horizon Cloud endpoints and return the results directly to the console.

A successful test typically shows results like:

If a problem exists, the script will clearly indicate which test failed.

.

Why This Check Is Important

Connectivity to Horizon Cloud Services is essential for several platform features, including:

• Edge Gateway registration
• Horizon control plane communication
• Monitoring and service updates
• Validate the Horizon License

Because firewall and security policies frequently evolve in enterprise environments, it’s a good practice to periodically validate connectivity using the diagnostic tool.

Running the diagnostic script can quickly confirm whether the issue is related to networking or to another component of the Horizon environment.

.

.

.

.

 Spoiler:

There may be proxy problems. For which proxy it is used, you can read this configuration file:

/opt/horizon/var/data/proxy.conf

.

.

.

Checking Horizon Cloud Services Connectivity from Horizon Edge Gateway