Omnissa Release Notes

Omnissa Access | Hub Services | OCT 2026

Omnissa Access Connector 26.05 | 02 JUN 2026 | Build Access-Connector-Installer-376-26.05.exe

Check for additions and updates to these release notes.

What's New in October 2026

Device Self-Service Quick Actions in Intelligent Hub

Intelligent Hub now supports Quick Actions in FedRAMP environments. Hub Services administrators can make self-service device actions available for users, and users can run them from Intelligent Hub.

What's new:

• For administrators: In the Hub Services console, Quick Actions appear under Employee Self Service > Device Self Service > Add Action. You can add device actions and assign them to users.
• For end users: Users with assigned Quick Actions can find them in Intelligent Hub under Support > Managed Devices > device > Actions.
• Supported platforms: Intelligent Hub for Web, iOS, Android, Windows and macOS

For more information, see the Setting Up Hub Services to Support Workspace ONE Intelligent Hub guide.

June 2026

New Connector Version Available

A new version of the connector, Omnissa Access Connector 26.05, is now available. See the Omnissa Access Connector Release Notes for details.

April 2026

PKCE Support for OpenID Connect Applications

Omnissa Access now supports Proof Key for Code Exchange (PKCE) for OpenID Connect (OIDC) applications, improving the security of the OAuth 2.0 authorization code flow, especially for mobile and browser-based applications.

Administrators can now choose a client type when creating an OIDC application.

• For Public clients with no client secret, PKCE is always enforced.
• For Confidential clients that require a client secret, PKCE is optional.

The OIDC application details page indicates whether the associated OAuth 2.0 client is Public or Confidential.

Note that:

• If you enable PKCE on an existing Confidential client, all tokens for that OAuth 2.0 client are deleted to ensure a secure transition.
• PKCE is not supported for OIDC apps with SSF Integration enabled. These apps always use a Confidential client with a client secret.
• Omnissa Access supports only the S256 code challenge method for PKCE.

For more information, see Adding OpenID Connect Applications to Omnissa Access.

CORS Support for OAuth 2.0 and OIDC Endpoints

Omnissa Access now supports Cross Origin Resource Sharing (CORS) for OAuth 2.0 and OpenID Connect (OIDC) endpoints. This support enables browser-based applications such as single-page applications (SPAs), hosted on approved domains, to securely call Omnissa Access for tokens and user information directly from the browser.

Administrators can configure the allowed cross-origin domains in the Omnissa Access admin console.

The following Omnissa Access endpoints now support CORS when called from approved cross-origin domains:

Endpoint | Methods

/acs/authorize | GET, OPTIONS
/acs/token | POST, OPTIONS
/acs/userinfo | GET, POST, OPTIONS
/acs/openid/logout | GET, POST, OPTIONS
/acs/revoke | POST, OPTIONS
/acs/.well-known/openid-configuration | GET, OPTIONS
/acs/jwks | GET, OPTIONS

For more information, see Configuring Cross-Origin Resource Sharing in Omnissa Access.

March 2026

App Bundles

An App Bundle is a logical grouping or collection of component apps. Hub Services admins can now create an App Bundle for their App catalog users by grouping several apps delivered through various delivery mechanisms. For example, an App Bundle called Outlook might contain Microsoft 365 for Web, Outlook native app (for Windows), Boxer, and Outlook for Horizon as its component apps.

Catalog users can subsequently open an App Bundle to launch one of the component apps. Users can also select a default component app to auto-launch when the bundle is clicked.

In this release, App Bundles are supported on the Intelligent Hub web portal. This feature will be rolled out to Intelligent Hub apps in subsequent releases.

For more information, see Managing App Bundles in the Workspace ONE Intelligent Hub App Catalog.

December 2025

Hub Services integration with Omnissa Intelligence

The Hub Services integration with Omnissa Intelligence is now available for FedRAMP environments. This integration lets you collect analytics about users' interactions with Hub Services notifications, create workflows for notifications, and create and publish surveys.

For more information about this feature, see:

• Workspace ONE Hub Services Integration
• Integrate Hub Services with Omnissa Intelligence to Provide Notification Analytics and Automation Workflows

November 2025

TLS 1.3 Support for Access Certificate Authentication Service (CAS)

The Omnissa Access Certificate Authentication Service (CAS) now supports Transport Layer Security (TLS) 1.3. This update improves security and performance of CAS by removing session renegotiation and optimizing certificate-based authentication flows. CAS will continue to support TLS 1.2 by default. Administrators will now have the option to enable TLS 1.3 from the Omnissa Access console.

Note: If you select Use TLS 1.3 for SSL connections for either the Certificate (cloud deployment) or Mobile SSO (for Apple) authentication method, customers might need to update their proxy and firewall configurations and device profiles to support the new CAS hostnames. See KB article 6000726 for details.

September 2025

Certificate Migration Now Available

As part of the ongoing changes related to the establishment of Omnissa as a new company, certificates are being updated in Omnissa Access FedRAMP. These changes require you to update your integrations with both Omnissa and third-party products and services. A Migration dashboard is available in the admin console to guide you through the migration process.

KB article 6001062 provides detailed information about migration. All FedRAMP tenants belong to “Category 1 - Certificate Branding only (No URL Change)”. Migration is now available for that category.

Action Required:

1. Review the information for Category 1 in KB article 6001062.
2. In the Omnissa Access console, select Settings > Migration Support to access the Migration dashboard.
3. Follow the instructions in the dashboard to complete the migration. See the KB article for additional information.

IMPORTANT: We strongly encourage you to start migration as soon as possible. See KB article 6001062 for the cutover timeline.

Omnissa Access Connector 24.12.1.0 available

Omnissa Access connector version 24.12.1.0 is now available. You can perform a fresh installation of version 24.12.1.0, or upgrade from versions 23.09, 24.07, and 24.12.0.0. Version 24.12.1.0 is compatible with Omnissa Access Cloud, Omnissa Access FedRAMP, and Omnissa Access virtual appliance 24.12.1.0.

This version of the connector includes the following resolved issues.

Directory Sync service:

• HW-230769: Prevent directory sync failure when a deleted user continues to have group membership
• HW-215396: Allow manual override of domain controller auto-discovery in krb5.conf file
• HW-216294: During Active Directory password reset from Intelligent Hub, limit domain controller discovery retries
• HW-201638: Add safeguards check to photo sync
• HW-223982: Limit the number of directory sync alerts to 1,000

Virtual App service:

• HW-222985/HW-225845: Support the new Omnissa-based application partition names in Active Directory Lightweight Directory Services (LDS) introduced with Horizon 2503 (see KB article 6000797).

July 2025

Support for SIEM Integration

Omnissa Access now offers the ability to forward Access audit information to third-party Security Information and Event Management (SIEM) systems as Syslog events. Omnissa Access can forward audit events to SIEM and Syslog servers in the cloud or in customer data centers. This release includes native adapters for a Syslog server, Splunk, and CrowdStrike Next-Gen SIEM, with support for more SIEMs coming in a future release. The integration requires mutual TLS (mTLS) authentication between Access and the external system. See Integrating Omnissa Access with External SIEM Systems.

For FedRAMP environments, additional configuration might be required to connect to your SIEM system. Please contact support for assistance.

April 2025

Patch for Omnissa Access Connector 24.12

A patch is available for Omnissa Access Connector 24.12 to support the new application partition names in Active Directory Lightweight Directory Services (LDS) introduced with Horizon version 2503. See KB article 6000797 for more information.

The patch applies to Omnissa Access Connector 24.12, regardless of whether the connector is used with the on-premises Omnissa Access 24.12 virtual appliance or with Omnissa Access Cloud. You can download the patch from the Omnissa Access 24.12 page in Customer Connect.

February 2025

New Audit Events for FIDO2 token registration

New audit events are introduced to provide additional debugging information for the FIDO2 token registration process. Audit events capturing successful and failed token registration details are available with this change.

Updated FIDO2 login prompts

With the updated FIDO2 authentication screens, users are prompted with a simpler and cleaner FIDO2 login screen. The login prompt to select FIDO2 authenticators can be removed from the login process through a new configuration option. Administrators can also optionally remove FIDO2 registration links from the login screens and have users register FIDO2 exclusively through the Intelligent Hub self-service portal.

Ability to send Targeted Hub notifications via Email List

IT Communications teams can now send Hub notifications to a subset of users based on their email addresses, streamlining the process and removing the need to create or maintain User Groups or Smart Groups just for sending notifications. This new feature allows admins to provide an email list, using the new ‘Email Recipients’ Target Audience Type, while creating the notification through the Hub Services Admin console, compose the notification message, and send it directly to the specified recipients.

Ideal for one-time or ad-hoc communications, this feature saves time and reduces administrative effort. Admins need to make sure that they are providing a maximum of 50 email IDs which are valid and correctly formatted to send notifications using this functionality.

December 2024

Omnissa Access Connector 24.12

Omnissa Access connector version 24.12 is now available. Upgrade to version 24.12 is supported from versions 24.07.0.0 and 23.09.0.0.

See the Omnissa Access On Premises 24.12 Release Notes and Upgrading Omnissa Access Connector for information.

November 2024

Support for Custom Notification Expiry Dates

The Hub Services admin console now enables administrators to set custom expiry dates for notifications. Once the specified expiry date is reached, notifications are automatically removed from the end user's view in both the For You and History sections. This feature allows administrators to better manage the visibility of notifications, ensuring that employees only see the most current and relevant information. By automatically clearing outdated messages, this enhancement helps reduce clutter and improves the overall user experience.

September 2024

Notification Deletion Now Available for Hub Services Admins

The Hub Services admin console now includes the ability for admins to delete previously sent notifications. Admins with super admin role can utilize this feature to remove notifications that were sent in error, contained incorrect information, or were distributed with ill intent. This deletion functionality ensures that admins can quickly and effectively retract messages that should no longer be visible to end-users, thereby maintaining the accuracy and integrity of communication within the platform.

Workspace ONE Intelligent Hub App Now Visible in the Hub Services App Catalog

The Workspace ONE Intelligent Hub app, when assigned through Workspace ONE UEM, will now be displayed in the Hub Services app catalog. Previously, the Intelligent Hub app did not appear in the catalog, limiting visibility to end-users. With this update, users can manually trigger updates to the Hub app, which is especially useful if there are issues with auto-pushed updates.

If admins prefer to revert to the previous behavior where the Hub app is hidden from end-users, they can utilize the Exclude Apps functionality to remove it from view. For more details on that, refer to the documentation topic Selectively Exclude Apps From Users in Intelligent Hub Catalog.

Omnissa Access Connector 24.07

Omnissa Access connector 24.07 is compatible with Omnissa Access Cloud, Omnissa Access On-premise 24.07, and Omnissa Access for FedRAMP.

Resolved Issues for Connector 24.07

This connector release includes the following resolved issues:

• HW-200932: Resolved an issue where Active Directory over IWA directory sync was failing with safeguard violations. A configurable option for comparing only attributes for updates during directory sync is now available.
• HW-200972: Prevent parallel sync if both People Search photo sync and directory sync are configured for the same time.
• HW-204691: Resolved an issue with directory sync exiting due to communication channel errors. A configurable parameter is available to set the number of hours after which scheduled sync starts automatically if the directory sync service exits due to unexpected communication channel errors.

July 2024

Granular Control for Self-Service Actions in Hub Services

Workspace ONE Hub Services admins now have greater flexibility and granular control when configuring actions available through Employee Self-Service (Support tab). Previously, actions were grouped into broad categories of critical and non-critical toggles in the Hub Services admin console, which limited admins to enabling or disabling entire groups of actions rather than specific individual actions. This lack of precision often led to less effective management and control over the available actions for end users.

With the new update, admins can now pick and choose specific actions they want to enable for end users, tailoring the self-service experience to better meet organizational needs and policies. For example, an admin can enable the Change Passcode action for a set of users or devices while keeping the Lock Device action disabled, thereby preventing unnecessary or potentially disruptive actions. This enhanced level of customization allows for more targeted and efficient management, improving both security and user experience by ensuring that only the necessary actions are accessible to end users.

Ability to Hide Apps from the App Catalog in Hub Services

The Hub Services admin console now allows admins to selectively hide apps from end users' view. This feature is particularly useful in scenarios where apps need to be assigned to specific devices, but admins want to manage their visibility in the catalog. By hiding these apps, admins can prevent user actions such as app updates or unintentional interactions, ensuring that app management remains centralized and controlled. This added flexibility allows for better oversight and maintenance, aligning app availability with organizational policies and strategies.

User Self-management of FIDO2 Keys in Hub Services

Workspace ONE Intelligent Hub web portal users can now manage their FIDO2 keys, configured in Omnissa Access for authentication, directly from the Hub web portal. Previously, only admins managed users' FIDO keys through the Omnissa Access admin console, which created a significant barrier to FIDO2 adoption. This limitation often resulted in end users having to submit support tickets for simple self-management tasks, such as replacing a FIDO2 key and customers had to deal with large volumes of such tickets.

With this enhancement, end users can fully manage their FIDO2 keys independently. They can view all registered keys, register new keys, and delete any previously registered keys. This newfound autonomy not only streamlines the user experience but also reduces the administrative burden, enabling smoother and more efficient authentication management.

Support Workspace ONE Content URLs/Deep Links in Hub Helpful links in Hub Services

Hub Services admins can now configure a Workspace ONE Content application URL or deep link as a helpful link in the Support tab, enhancing the usability of the Helpful Links section.

May 2024

Device Enrollment Terms of Use support in Workspace ONE Intelligent Hub

Workspace ONE Intelligent Hub app users can now view and act on updates to the Terms of Use (TOU) for any of their enrolled devices directly within the Intelligent Hub app. Previously, this functionality was only available through the Self-Service Portal (SSP), requiring users to log in separately, often delaying critical actions on TOU updates. By integrating this feature into the Intelligent Hub app, we streamline it into the regular employee workflow, allowing for more immediate responses to TOU updates.

This functionality is currently available on Hub Web and Windows. Workspace ONE UEM version 24.2.0.8 and later supports this feature.

Application Terms of Use support in Workspace ONE Intelligent Hub

Users of the Hub native applications (i.e. Hub iOS, Android and Windows) can now view and act on updates to the Terms of Use (TOU) associated with any applications installed on their devices. Previously, Intelligent Hub prompted users for TOU action (acceptance or rejection) only during the initial app installation via the Hub catalog, with no way to address subsequent TOU updates. This new feature enables users to stay updated and respond to TOU changes at any time.

This functionality is currently available on Windows on all Intelligent Hub app versions. For iOS and Android, please refer to the iOS and Android Hub release notes for the Intelligent Hub version which adds support for this feature.

Workspace ONE UEM version 24.2.0.8 and later supports this feature.

NOTE: This was the last significant parity gap between the Hub Services app catalog and the legacy UEM app catalog, which is already scheduled for end-of-life See KB article 95774.

Increase in limit for Workspace ONE Intelligent Hub Employee Self-Service Helpful Links from 10 to 20

Hub Services admins can now configure up to 20 Helpful Links in the Employee Self-Service section of the Hub admin console, doubling the previous limit of 10 links. This increased capacity allows admins (UEM and Horizon) to provide more self-service content, such as knowledge bases (KBs), for end users in the Intelligent Hub Self-Support tab.

Support for Entra ID MFA as additional authentication method in Omnissa Access

Omnissa Access now enables integration with Microsoft Entra ID MFA as an additional authentication method. Users can log in to Omnissa Access using their existing authentication methods, and then be prompted for Entra ID MFA without an additional Entra ID login prompt. This feature simplifies the user experience while adding the feature-rich Entra MFA capabilities to Omnissa Access authentication.

January 2024

Support for PKCE and OAuth 2.0 Public Clients

PKCE (Proof Key for Code Exchange) is an extension to OAuth 2.0 Authorization Code flow that helps in securing OAuth tokens from CSRF and code injection attacks. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. A communication path not protected by TLS is susceptible to this attack and an attacker can gain access to the authorization code and use it to obtain the access token.

PKCE extension utilizes a dynamically created cryptographically random key to ensure proof of possession by the client. Omnissa Access supports enabling PKCE for OAuth 2.0 public clients and clients participating in Authorization Code flow. Along with PKCE support, Omnissa Access now supports creation of OAuth 2.0 public clients. Public clients are useful for applications running in a browser or on a mobile device that cannot keep their registered client secret safe.

PKCE is enabled by default and is mandatory for all public clients created in Omnissa Access.

User Choice of Authentication

We are excited to announce the availability of User Choice of Authentication functionality with Omnissa Access. With this new feature, users have the flexibility to choose from a set of authentication options presented to them for their second factor authentication.

This feature is particularly valuable in scenarios where users might not have access to their second factor authentication option, such as a smartphone for receiving push notifications. In such cases, users can seamlessly opt for an alternative method from the presented choices to successfully complete the login sequence.

Administrators configure policies to control the availability of various authentication choices for specific authentication requirements. Further, conditional access parameters such as network range, device specifications, device management state or user groups can be configured to secure and customize authentication experience for end users.

This feature is available only with Omnissa Access SaaS.

December 2023

Support for Duo v4 SDK with Duo Universal Prompt

Omnissa Access now supports Duo v4 SDK. Duo v4 supports the new Duo Universal Prompt that provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements. Omnissa Access users are automatically migrated from traditional Duo prompt to Duo Universal Prompt after this support is rolled out. No admin action is required to enable this change.

Support for Horizon Client and App Launch from Shortcuts

Omnissa Access now provides an ability to relaunch Horizon published virtual desktops and apps from shortcuts using launch URLs. Prior to this release, when launching a shortcut pointing to the Horizon Client or app, users were directed to a blank screen that blocks the client or app launch. With this update, the app information and a launch option is provided to the user.

October 2023

Omnissa Access Connector 23.09

The Omnissa Access connector version 23.09 is compatible with Omnissa Access Cloud, Omnissa Access On-premise 23.09, and Omnissa Access for FedRAMP.

Resolved Issues for Connector 23.09

The following is a list of Connector resolved issues.

• HW-180874: The Default Launch Client setting for Horizon virtual apps collections is ignored
• HW-170798: Unable to sync Horizon Enterprise virtual apps collections when using a connection via a proxy
• HW-174051: Updating a virtual apps collection resets the network range
• HW-172671: Citrix App launch fails on Firefox browser
• HW-171435: Citrix App launch fails when the first connector in the virtual apps collection is down
• HW-170576: Unable to sync virtual apps collections when using a connection via a proxy
• HW-174269: Omnissa Access Connector 22.09.1 fails to install when the domain name has a '_' character
• HW-181989: Saving or syncing a Horizon virtual apps collection when a Horizon server is down removes existing metadata
• HW-170576: When a proxy is configured, the Virtual App service is unable to fetch metadata from a Horizon Cloud Service Single-Pod Broker setup

August 2023

Announcing General Availability of Mobile SSO for Apple Device Authentication in Omnissa Access

We are excited to announce the general availability of the Mobile SSO for Apple device authentication method - the next generation Mobile SSO feature in Omnissa Access.

As part of the iOS 13 SDK and MDM spec, Apple introduced a new cross-platform SSO extension that offered a native SSO approach using standard federation protocols. Mobile SSO for Apple devices in Omnissa Access leverages this native SSO Extension SDK in Apple.

In addition to providing seamless SSO across iOS and iPadOS devices, Mobile SSO for Apple authentication method in Omnissa Access offers configurable biometric authentication that allows using the platform's built-in biometric authenticators such as TouchID, FaceID or Passcode for additional authentications before accessing applications.

The Mobile SSO for Apple authentication method features the ability to limit Single Sign-On to selected apps. The solution uses certificate based authentication to Omnissa Access and supports Workspace ONE Shared iOS devices Check-In Check-Out use cases.

NOTE: The Workspace ONE Intelligent Hub app must be installed in the devices participating in SSO.

Mobile SSO for Apple is a replacement for Mobile SSO for iOS that's available with Omnissa Access today. Both solutions can however co-exist as part of migration configuration. A gradual migration from Mobile SSO for iOS to Mobile SSO for Apple is recommended. See the How to Migrate from Omnissa Access Mobile (for iOS) to Mobile SSO (for Apple Authentication Method article.

This feature is available only in the Omnissa Access Cloud environment.

Limit Devices in Staging Accounts from Viewing Other Devices

For devices that are enrolled in a staging account, the Workspace ONE Intelligent Hub app’s Support tab will no longer list all devices enrolled in that staging account. Instead, the Support tab will only reflect the current device to prevent any malicious user(s) from taking action on all the other managed devices shown on the Support tab for that account.

Note: This requires Workspace ONE UEM version 23.06 or later.

Improved Search Experience on Hub Web

The Search Bar in the Hub Web portal has been moved to a more prominent location. App and People Search can now be performed easily and no longer requires end users to navigate to the Apps or People tabs to perform search.

Add Hub Deep Links and Workspace ONE Web Deep Links in as Helpful Links in the Support Tab

Self Service Helpful links have been updated to support Workspace ONE Intelligent Hub and Workspace ONE Web apps' deep linking capabilities. This allows admins to setup helpful links that can seamlessly take their users to other parts of the Hub app using wsonehub://{deeplink} or launch web pages in a Web app using awb(s)://{url}.

Support for Windows 11 devices in Omnissa Access Policy Rules

Omnissa Access now recognizes Windows 11 devices for enrollment and conditional access. Prior to this support, access policies with device type set to Windows 10 were not applied to Windows 11 devices. With this update, the Windows 10+ device type rules will be used for Windows 10 and Windows 11 devices. This functionality is supported across all Windows 11 devices, including desktops and mobile devices.

Additional Self-Service Capabilities in the Support Tab

Workspace ONE Intelligent Hub Web now allows users to take actions such as Clear Passcode and Make Noise from the Support tab. These actions are enabled by default and can be managed by the admin from the Hub Services Console (Employee Self-Service > Device Self-Service > Non-Critical Actions).

Original source

We are excited to share the new release of Workspace ONE UEM version 2607! Read on to learn about the new features and improvements in this release.

What's New in this Release

Admin Experience

Full-Page Omni App experience now available in Workspace ONE UEM Console

Workspace ONE UEM now supports a full-page view of the Omni app within the Workspace ONE UEM Console, enabling a richer and more complete user experience beyond the previously available embedded view. Navigation to the full-page Omni app is role-based, ensuring only administrators with the appropriate Omni permissions granted in Omnissa Connect can access the page. For more information, see Accessing Omni from the UEM Console.

New and Refreshed Device List View

Experience a brand new device list view redesigned to improve admin efficiency. Administrators can opt in to the new experience at their own pace and switch back to the legacy console at any time. For more details, see KB article.

Android Management

SCEP-Based Certificate Distribution for Wi-Fi Authentication (Custom DPC)

The Custom DPC SCEP profile payload introduced in Workspace ONE UEM 2506 allows organizations to distribute user certificates more securely to Android devices by through on-device key generation. These certificates can now be used for certificate-based authentication into WPA2 Enterprise WiFi networks. You can now select SCEP profile payloads in the Identity Certificate field in Custom DPC WiFi profile payloads. Requires Workspace ONE Intelligent Hub 26.02.

New security policies (Custom DPC Restriction Profile)

You can now set the following policies on Android devices enrolled in Custom DPC mode. Requires Workspace ONE Intelligent Hub 26.04.

• Allow Private Spaces (Android 15+): You can now prevent users from enabling Private Spaces in the personal profile on Corporate Owned Personally Enabled devices.
• Allow Wi-Fi Sharing (Android 13+): You can now prevent users from sharing credentials of WiFi networks configured by your organization. This only restricts sharing for WiFi networks configured through WiFi profile payloads
• Allow USB Data Signaling (Android 12+): You can now completely disable data transmission via USB, allowing only charging. Supported on corporate-owned devices only (Work Managed and Corporate Owned Personally Enabled).

Freestyle Orchestrator

macOS communication pipeline upgraded from UDS to gRPC

Admins now have more consistent workflow executions with our replacement of the communication pipeline between the workflow engine and macOS Intelligent Hub. This ensures that workflow step statuses are sent reliably so that execution can proceed to the next step. This change is in now in General Availability and will require Workspace ONE Intelligent Hub for macOS version 26.08.

iOS Management

New Credentials Asset in Declarative Device Management

Administrators can now create and deploy Credentials assets such as Username and Password to iOS and macOS devices directly from Profiles > List View > Profile > Declaration > Assets. This asset enables IT to securely provision username and password credentials to managed devices so that DDM configurations can silently perform authentication without requiring manual user input.

Unified Apple OS Update Management: iOS and macOS now managed from a single view

Workspace ONE UEM makes it easier to manage Apple devices' OS updates. It brings together the macOS and iOS update workflows into a single, DDM-based interface. The following enhancements have been made:

• The OS update management page now presents macOS and iOS updates in a single Apple view, eliminating the need for administrators to navigate between separate platform pages. The Update column has been renamed to Platform for clarity, and filters have been improved for consistency with the rest of the Workspace ONE product. When an OS update is assigned to an Organization Group, it now properly inherits down to child OGs.
• Administrators can create new assignments directly from this unified view. On the Deployment page, both Imperative and Declarative deployment options are presented, with Declarative set as the default.
• A new Auto Update button is available at the top of the Device Updates list view. Administrators can configure Auto Update to apply the latest Major or Minor OS version using the using the Software Update Enforcement Declarative Configuration, with the system automatically selecting the latest compatible version. For more information, see OS Management.

VPP Apps in Freestyle Workflows

With this Limited Availability feature, the Install App action in Freestyle Workflows now supports VPP apps for iOS. Administrators can select from their purchased app catalogue when building a workflow step. Licenses must be allocated to the target smart group with an On Demand Assignment before deployment via workflow.To have this feature enabled for your environment, contact your account team.

macOS Management

macOS Registered Mode management in Workspace ONE UEM

Workspace ONE now introduces Registered Mode support for macOS, enabling organisations to extend Workspace ONE capabilities — including Digital Experience Management (DEX) — to Mac devices managed by third-party MDM solutions. Workspace ONE services on macOS are now available without requiring full MDM enrolment, providing a flexible, low-friction path to adoption.

Administrators can enable Registered Mode for macOS from Groups & Settings > All Settings > Devices & Users > General > Enrollment > Management Mode. The configuration supports scoping by Organisation Groups and Smart Groups, allowing targeted deployments across mixed-management fleets. In Registered Mode, macOS devices receive Hub-delivered resources, including applications, sensors, and scripts. Custom profiles are not supported in this release, as Registered Mode is designed for app-level and lightweight management rather than full device configuration. For more information, see Registered Mode.

Data Assets support in Declarative Device Management

Workspace ONE UEM now supports DDM Data Assets for macOS. Administrators can create and deploy Data Assets directly from Profiles > List View > Profile > Declaration > Assets. Data Assets let you upload arbitrary data files to the UEM Console and deploy them to devices automatically. These files can then be referenced by applicable DDM Configurations, such as Services Configuration Files and Services Background Tasks declarations.

New Credentials Asset in Declarative Device Management

Administrators can now create and deploy Credentials assets such as Username and Password to iOS and macOS devices directly from Profiles > List View > Profile > Declaration > Assets. This asset enables IT to securely provision username and password credentials to managed devices so that DDM configurations can silently perform authentication without requiring manual user input.

Unified Apple OS Update Management: macOS and iOS now managed from a single view

Workspace ONE UEM makes it easier to manage Apple devices' OS updates. It brings together the macOS and iOS update workflows into a single, DDM-based interface. The following enhancements have been made:

• The OS update management page now presents macOS and iOS updates in a single Apple view, eliminating the need for administrators to navigate between separate platform pages. The Update column has been renamed to Platform for clarity, and filters have been improved for consistency with the rest of the Workspace ONE product. When an OS update is assigned to an Organization Group, it now properly inherits down to child OGs.
• Administrators can create new assignments directly from this unified view. On the Deployment page, both Imperative and Declarative deployment options are presented, with Declarative set as the default.
• A new Auto Update button is available at the top of the Device Updates list view. Administrators can configure Auto Update to apply the latest Major or Minor OS version using the Software Update Enforcement Declarative Configuration, with the system automatically selecting the latest compatible version. For more information, see macOS Update Management.

Printer Management

Next-Generation Printer Management: A Brand New MQTT-Based Platform

Printer management just got a major upgrade. Workspace ONE UEM now includes a brand new, native platform for managing mobile printers, starting with Zebra devices, built on MQTT (Message Queuing Telemetry Transport), the modern, lightweight protocol that has become the industry standard for industrial IoT communication.

This is a complete break from the legacy connector model. Printers now enroll, configure, and report health data directly through the Workspace ONE UEM Console alongside all your other managed endpoints. Everything is handled in one place, without relying on OEM-specific tools or creating yet another separate management workflow. IT teams can push configurations and firmware updates, monitor printer health and availability in real time, set automated alerts, and access full fleet-wide analytics all in the UEM Console.

And this is just the beginning. By building on MQTT, Workspace ONE is establishing a powerful, scalable foundation for managing a much broader ecosystem of connected frontline and IoT devices. For more details, see MQTT Printer and IoT Device Management.

Resource Management

Pause resource delivery with Freeze Mode to simplify device troubleshooting

Administrators can now activate Freeze Mode directly from the Device Details page to temporarily pause resource delivery on a device. When enabled, Freeze Mode blocks the installation and removal of directly assigned apps, profiles, and workflows delivered through the Modern SaaS architecture, allowing administrators to investigate resource delivery issues without interference from ongoing actions. Admin-initiated actions from the console remain unaffected during this period. Once Freeze Mode is deactivated, all blocked actions resume automatically. This feature is supported on iOS and Android devices. For more information, see Freeze Mode.

Relay Server support extended to internal applications for Windows

Relay Server support is now extended to internal applications on Windows devices. Previously limited to Product Provisioning, Relay Servers can now be used to deliver internal applications, enabling organizations to improve delivery speed and reduce internet bandwidth consumption in low-bandwidth or offline environments. Administrators can enable relay server delivery per app directly from the Internal Apps configuration screen under Deployment Options using a new toggle. Apps are only seeded to relay servers when explicitly marked for relay-based delivery.

User Management

UUID-Based APIs for custom user group membership management

Workspace ONE UEM has two new REST APIs for adding and removing users from user groups. The new APIs accept EnrollmentUserUUIDs as input, which removes the need for integer EnrollmentUserIDs and matches the UUID already returned by the existing group membership. Both APIs support batch operations with a documented upper limit on the number of users per request, skip invalid or non-member UUIDs without failing the entire batch, and trigger a console event for each membership change. The previous integer ID-based APIs for custom group membership management are now deprecated.

visonOS Management

Deploy and manage apps on Apple Vision Pro devices

Workspace ONE UEM now supports deploying and managing applications on enrolled Apple Vision Pro devices running visionOS. Administrators can sync visionOS applications from Apple Business Manager directly into UEM via Resources > Native Apps > Purchased > Sync Assets and assign them to device- or user-based smart groups for automated distribution. Custom in-house visionOS applications can also be uploaded as internal apps (.ipa format) via Resources > Native Apps > Add Application and assigned to smart groups for deployment to Apple Vision Pro devices. This enhancement is available on a Limited Availability basis. To have this feature enabled for your environment, contact your account team.

Windows Management

Step-Up Enrollment from Registered Mode to Hub Managed and Full MDM (OMA-DM)

Workspace ONE UEM now supports step-up enrollment support for Windows devices currently enrolled in Registered mode. Administrators can now upgrade these devices to either Intelligent Hub Managed or Full MDM (OMA-DM) management without requiring a device wipe or end-user re-enrollment. Devices seamlessly transition to the selected management mode and immediately gain access to the full set of corresponding management capabilities, including app deployment, profiles, baselines, sensors, scripts, and workflows.

To perform a step-up enrollment, navigate to Device Details > More Actions, and select one of the following options:

• Step-Up to Hub Managed
• Step-Up to OMA-DM Managed

For more information, see Enrolling Windows Devices into Workspace ONE UEM.

Step-Up Enrollment from Hub Managed to Full MDM (OMA-DM)

Devices already enrolled in Intelligent Hub Managed mode can now be stepped up to Full MDM management. When a step-up enrollment is triggered, the Intelligent Hub automatically initiates native OMA-DM enrollment on the device. This unlocks additional capabilities that require the native Windows MDM channel — including Microsoft CSP-based profiles and Autopilot support — while preserving the existing device record and all Hub-based management. No device wipe or end-user action is required.

To perform a step-up enrollment, navigate to Device Details > More Actions > Step-Up to OMA-DM Managed. For more information, see Enrolling Windows Devices into Workspace ONE UEM.

Bulk Step-Up enrollment using Device List View and APIs

Administrators can now perform step-up enrollment at scale. From the Device List View in the UEM console, select multiple Hub Registered or Hub Managed devices and trigger a bulk step-up to Full MDM management in a single action. Step-up is also available via UEM APIs, enabling automation and integration with existing IT workflows for large-scale fleet migrations. For more information, see Enrolling Windows Devices into Workspace ONE UEM.

Automatic Step-Up to OMADM on Enrollment User Sign-In

A new Auto Step-Up setting allows administrators to automatically transition eligible Hub Managed devices to Full MDM management without issuing individual step-up commands. When enabled at the organization group level, the Intelligent Hub automatically initiates OMA-DM enrollment upon user sign-in post-enrollment or after device reassignment, ensuring devices reach full management with zero admin intervention per device.

To enable automatic step-up to OMA-DM on user sign-in, navigate to All Settings > Devices & Users > General > Enrollment > Management Mode. Under the Windows section, select No OMA-DM Management > Intelligent Hub Managed and enable Auto Step-Up to OMA-DM on User Login. For more information, see Enrolling Windows Devices into Workspace ONE UEM.

Real-Time Onboarding Workflow Progress on the Post-Enrollment Onboarding Screen

The Post-Enrollment Onboarding (PEO) screen in Workspace ONE Intelligent Hub for Windows now displays real-time progress of Onboarding Workflows during device enrollment.

• Workflow step-by-step tracking: Tracks each resource (apps, profiles, scripts) with real-time in-progress, completed, or failed status updates.
• Progress bar indicator: A dynamic progress bar shows the overall completion percentage of the Onboarding Workflow.
• Failure visibility: Clearly indicates if a workflow step fails.
• Seamless transition: Automatically transitions to application installation progress once the workflow completes.

Previously, the PEO screen only showed application install and uninstall progress. This enhancement gives users full visibility into the device setup process, improving transparency and reducing help desk calls during enrollment. For more information, see Enrolling Windows Devices into Workspace ONE UEM.

Focused Enrollment: Lock Windows devices during post-enrollment onboarding

Focused Enrollment for Windows devices allows IT administrators to lock the device during the Post-Enrollment Onboarding (PEO) experience. When enabled, users are prevented from navigating away from the onboarding screen, ensuring that all critical setup steps such as profile configurations, security app installations, scripts, and workflow executions complete before the user accesses the device.

Key behaviors when Focused Enrollment is enabled:

• Get Started button control: The Get Started button on the PEO screen remains disabled until all onboarding steps are complete, preventing users from skipping mandatory setup.
• Keyboard input blocking: All keyboard shortcuts are blocked during onboarding, except the PEO Screen Exit Keystroke and CTRL+ALT+DEL, delivering a kiosk-like experience. Mouse and touch inputs are also blocked.
  Note: This feature is intended to guide end users through onboarding completion and prevent inadvertent bypassing of setup steps. It is not intended as a security enforcement mechanism.
• Task Manager disabled: Task Manager is automatically disabled during focused enrollment to prevent users from terminating the onboarding process. For more information, see Enrolling Windows Devices into Workspace ONE UEM.

Resolved Issues

[Extensive list of resolved issues across Admin Experience, Android Management, Common Services, Core Platform, Enrollment and Service Integrations, Freestyle Orchestrator, iOS Management, Launcher, macOS Management, Resource Management, Rugged Device Management, Tunnel, User Management, Windows Management, Patch Resolved Issues including Patch 1 to Patch 4]

Known Issues

We haven’t identified any notable known issues in this release. If you are facing any problems, feel free to reach out to our support team.

Release Availability

We strive to deliver high-quality products, and to ensure quality and seamless transitions, we roll out our products in phases. Each rollout may take up to four weeks to accomplish and is delivered in the following phases:

• Phase 1: Demo, Shared SaaS UATs, and Latest Mode UATs
• Phase 2: Shared SaaS environments
• Phase 3: Latest Mode environments

Getting Ready for Major OS Releases

To prepare for the upcoming software updates from major device vendors, read through the Getting Ready for Major OS releases section of the Omnissa Product Documentation.

Documentation

To learn more about Workspace ONE UEM, browse Workspace ONE UEM Documentation.

Localized Content for Omnissa Docs

For details on Omnissa's localization strategy, see the KB article: Announcing Omnissa Localization Support.

Support Contact Information

To receive support, access Omnissa Customer Connect. For information about filing a Support Request in Customer Connect and using Cloud Services Portal, see the KB article here.

Original source

Omnissa Workspace ONE Content for Android Release Notes detail the new features and enhancements in each release. This page contains a summary of the new capabilities, issues that have been resolved, and known issues that have been reported in each version.

Workspace ONE Content 26.09 - September 2026

New Features

Support for Workspace ONE Content in Android Desktop Mode on Android 16 and later devices.

Support for retaining downloaded content across users on multi-user devices.

Note

For information about new features and improvements on Workspace ONE UEM, see Workspace ONE UEM Documentation at Omnissa Docs.

Minimum Requirements

Android 9+

Workspace ONE UEM Console 2410+. For more information, see the Knowledge Base article Workspace ONE (WS1) UEM Console Release and End of General Support Matrix (2960922).

Resolved Issues

Note

The numbers included before the resolved issues are used for internal issue tracking.

• ASCL-181373: Delete option is grayed out.
• ASCL-181306: Cloud deletion option is not available when multiple files are selected.
• ASCL-181459: Change in PDF navigation behavior after the app is upgraded to v26.06.
• ASCL-181484: User is unable to open draft of PDF when Local Storage is disabled.

Known Issues

We have not identified any notable known issues in this release. If you are facing any problems, feel free to reach out to our support team.

Original source

Omnissa Workspace ONE Intelligent Hub for macOS Release Notes describe the new features and enhancements in each release. This page contains a summary of the new capabilities, issues that have been resolved, and known issues that have been reported in each version.

This version is now Generally Available. macOS Hub files will be progressively deployed across customer environments within the next 24 hours. No action is required; your environment will automatically receive the update during this period.

New Features

Enhanced Workflow Engine and Hub Communication through gRPC

Improved the communication channel between Intelligent Hub and the Workflow Engine, delivering enhanced reliability, performance, and security for on-device service coordination.

Support Contact Information from Hub Services

The Support tab now displays support contact information, including email addresses and phone numbers, sourced from Hub Services. This provides a centralized and consistent support experience across Hub.

Minimum Requirements

The following are the minimum requirements:

• macOS 12 (Monterey) or later.
• Workspace ONE UEM Console 2410 or later. For more information, see the Knowledge Base article Workspace ONE (WS1) UEM Console Release and End of General Support Matrix (2960922).
• Intelligent Hub 25.11 or later. For more information, see the Knowledge Base article Omnissa Workspace ONE Applications Policy (81271).

Download Instructions

We strongly recommend using Intelligent Hub for macOS version 24.11 or later on devices enrolled in Workspace ONE UEM 2410 or later. While Hub for macOS 24.07 series remains supported for backward compatibility, upgrading ensures optimal performance and feature availability.

• If automatic updates are enabled, the Intelligent Hub for macOS application will automatically update to version 26.08 without any disruption. Enable automatic update settings in the UEM Console at Settings > Devices and Users > Apple > Apple macOS > Intelligent Hub Settings.
• Alternately, download files for Intelligent Hub 26.08 for macOS by logging into Customer Connect.
• Workspace ONE Intelligent Hub 26.08 is also available at getwsone.com.

Resolved Issues

• HUBM-13674: macOS 27 process getting quarantined.
• HUBM-11834: Hub sync causes enrollment status to temporarily display as "Unenrolled".
• HUBM-11782: hubd crashes during periodic encryption status check.
• HUBM-11628: "You have new app(s) available" notification on "For You" page displays blank application tiles.

Known Issues

On macOS 27, Intelligent Hub 26.06 and earlier may fail to self-update because Hub Update, Health, and LogVault services cannot start. A fix is available in Hub 26.08. Refer to the workaround in KB article.

Original source

Omnissa Access helps you provide your users faster access to SaaS, web, and native mobile apps with multi-factor authentication, conditional access, and single sign-on. The Release Notes describe the new features, resolved issues, and known issues in this version of Omnissa Access.

Note: Omnissa Access 24.12.2.0 is an update release, resulting in abbreviated release notes. The contents of the Omnissa Access 24.12 Release Notes apply to this version too.

What's New

Omnissa Access 24.12.2.0 includes security-related updates and other product fixes.

• IMPORTANT - Upgrade-only release: Omnissa Access virtual appliance 24.12.2.0 is only available as an upgrade from the versions listed in the Upgrade section. A new installation of the Omnissa Access 24.12.2.0 virtual appliance is not supported.
• Certificate management improvements: Omnissa Access now performs additional validation checks when you upload SSL certificates. These include:
  • Validating the completeness and order of the certificate chain (server certificate, intermediate certificates, then root certificate)
  • Validating that the issuer of each certificate matches the subject of the certificate that issued it
• Improved log generation: Additional logs are now generated to help you troubleshoot your deployment. These include the analytics-.log and the access-control-.log.

Compatibility

Omnissa Access virtual appliance 24.12.2.0 is compatible with:

• Omnissa Access Connector 26.05 and 24.12.1.0
• Omnissa Access Desktop 24.12.1.0

Installation

• A new installation of the Omnissa Access 24.12.2.0 virtual appliance is not supported. You can only upgrade to version 24.12.2.0 from an existing installation. See the Upgrade section for the versions supported for upgrade.
• No license required: Omnissa Access 24.12.2.0 version does not require a license. The Settings > Appliance > License page has been removed from the Omnissa Access console.

Upgrade

Upgrading to Omnissa Access Virtual Appliance 24.12.2.0 (Photon Linux):

• Upgrade to Omnissa Access virtual appliance 24.12.2.0 is supported from the following versions:

  • 24.12.1.0 (including any patches applied)
  • 24.12.0.0
    Earlier versions must be upgraded to version 24.12.0.0 or 24.12.1.0 first, then upgraded to 24.12.2.0.

• Support for offline upgrade only: Online upgrade is not supported for the Omnissa Access virtual appliance in this release. You must use the offline upgrade process described in Upgrading Omnissa Access Offline.

• After upgrade, leave the Customer Experience Improvement Program:

  If you previously opted in to the Customer Experience Improvement Program, you must leave the program after upgrading the virtual appliance. The legacy Customer Experience Improvement Program collected information about your organization’s use of Omnissa products.

  1. In the Access admin console, select Settings > Appliance.
  2. Select the Customer Experience Improvement Program tab.
  3. Deselect the Join the Customer Experience Improvement Program option.

During the upgrade, all services are stopped; plan the upgrade with the expected downtime in mind.
See the Upgrading Omnissa Access guide for information about the upgrade process.

Resolved Issues

This release includes the following resolved issues:

• HW-248450: Authenticator App based two-factor authentication failure issue resolved
• HW-247911: TCP over TLS option in the syslog configuration in Omnissa Access fixed

Known Issues

This release has the following known issue:

• Unable to reset the lost root or sshuser password for the Omnissa Access virtual appliance

Solution: If you have lost the root or sshuser password to the Omnissa Access virtual appliance, try to reset the password using the Photon OS instructions. In those instructions, replace the following command:

/sbin/pam_tally2 --reset --user username

with

faillock --user username --reset

where username is either sshuser or root.

Documentation

• Omnissa Access documentation
• Omnissa Workspace ONE® Hub Services documentation

Localized Content

See KB article 6000664: Announcing Omnissa Localization Support for information about localized content.

Support Contact Information

Contact Support at Omnissa Customer Connect when you need help with your Omnissa Access environment. See How to file a Support Request in Customer Connect and via Cloud Services Portal.

Original source

Omnissa Workspace ONE Intelligent Hub for iOS Release Notes describe the new features and enhancements in each release. This page contains a summary of the new capabilities, issues that have been resolved, and known issues that have been reported in each version.

New Features

Cleaner Banners on Favorites and Catalog Tabs

The Rating prompt banner and pending EULA banners have been moved under a View All option on the Favorites and Catalog tabs. This reduces visual clutter on these screens while keeping important actions accessible when needed.

Improved “Last Updated” Timestamp Visibility

The Last updated timestamp displayed on app listings now uses an improved font weight and contrast, making it easier to read at a glance.

Pull-to-Refresh Improvements

The pull-to-refresh interaction has been enhanced to provide more accurate and timely content updates when users pull down to refresh their app lists and feeds.

Conditional Access registration status now visible in Hub

Conditional Access registration status is now shown in Support next to Enrollment and Compliance status.

Workspace ONE Mobile Threat Defense “Keep Alive” Notification Suppression

With this release, admins can now disable the MTD “Keep Alive” notifications that is shown to a user when they terminate the hub app via a Key-Value Pair (KVP) in the MTD configuration profile. This gives organizations more control over the end-user notification experience, particularly for large-scale BYOD deployments.

Minimum Requirements

• iOS 17+, iPadOS 17+
• Workspace ONE UEM Console 2206+

Download Instructions

• Prior Version is Installed: Direct end users to update the app when prompted. The application seamlessly updates over the existing application version without disrupting device's enterprise functionality.
• Prior Version is Not Installed: Direct end users to download it from the App Store.

Resolved Issues

The following bugs reported in prior releases have been resolved in Hub 26.06.

• HUBI-13263: The “Email Logs to Omnissa” option under Account → Support now correctly displays in the user’s selected locale. Previously, this string remained in English regardless of the device language setting.
• HUBI-13262: Rich text notifications now correctly respect the dynamic font size set in iOS Accessibility settings. Previously, increasing the system font size had no effect on rich text notification content.
• HUBI-13108: The “Last Seen” label in the Device Info section of the Support tab now displays correctly in Simplified Chinese. Previously, the translated placeholder string was shown instead of the formatted value.
• HUBI-12385: The Books detail view no longer snaps or jumps against the bottom navigation bar when the screen first loads.
• MTD-3272: Safe Browsing activated notification appears when Hub is terminated.

Known Issues

We haven’t identified any notable known issues in this release. If you are facing any problems, feel free to reach out to our support team.

Original source

Workspace ONE Email Notification Service 2 (ENS2) provides information on the new features and improvements in each release. This page includes a summary of the new features introduced, a list of our resolved issues, and known issues.

Workspace ONE Email Notification Service 2 version 26.09

New Features

Microsoft Graph API support for Office 365 mailboxes

ENS2 now uses the Microsoft Graph APIs to subscribe to Office 365 mailboxes and receive their change notifications. For on-premises Exchange mailboxes, ENS2 continues to use Exchange Web Services (EWS), and no changes are required.

This feature is disabled by default. To enable it, an Exchange Online administrator must first grant the required Microsoft Graph API permissions to the ENS application in Microsoft Azure, and then set the IsGraphEnabledForENS application configuration key to true for Omnissa Workspace ONE Boxer. For the steps to grant these permissions, see KB article.

Once Microsoft Graph subscription is enabled, users already subscribed through EWS must re-register their devices with ENS2 before notifications are delivered through Microsoft Graph.

End-to-end encryption of notifications

ENS2 encrypts the email details included in each notification; the content is decrypted only on the registered device. This feature is disabled by default. To enable it, set the EnableEnsNotificationEncryption application configuration key to true for Omnissa Workspace ONE Boxer.

Windows Server 2025 support

Windows Server 2025 is now officially supported.

Minimum Requirements

Email Client - For Android support, you must have ENS2 1.3.0.4 or later and Workspace ONE Boxer 5.2 or later.

Email Server - Exchange 2013 SP1, Exchange 2016, Exchange 2019 (for on-premises ENS2 version 1.7 and later), or Office 365. Office 365 mailboxes must use the modern authentication (OAuth), because the Microsoft Graph APIs do not support basic authentication.

Workspace ONE UEM console 2102 and later.

Resolved Issues

ENS-8665: Certificate-based authentication fails when the client certificate is signed by an intermediate certificate authority, because ENS does not send the complete certificate chain.

Known Issues

We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.

Original source

We're excited to share the new release of Workspace ONE UEM version 2604! Read on to learn about the new features and improvements in this release.

What's New in this Release

Admin Experience

New Workspace ONE UEM Console experience

Experience a redesigned Workspace ONE UEM console featuring a modern layout and intuitive navigation. This feature is now Generally Available and is enabled as the default console experience. The Organization Group picker is now prominently accessible in the console header, making it easier to switch context across your deployment. For more details, see KB Article.

Improved user detail visibility in Device List View

Administrators can now view accurate user details directly in the Device List View, even when encryption is enabled. Encrypted user detail fields (First Name, Email Address, etc.) previously displayed the placeholder text "Encrypted" and now show the correct user information, while the underlying data remains encrypted in the database.

Enhanced troubleshooting experience using Device Operations tab

The new Device Operations tab provides administrators a unified view of all device actions. This interface combines Legacy Commands and Modern stack actions into one consolidated timeline, allowing users to track operations from initiation to completion. By minimizing context switching, administrators can diagnose issues more quickly and efficiently. For more information, see Device Operations Tab.

Android Management

Mobile Network Slicing Support (Custom DPC)

Android 13+ supports mobile network slicing, enabling Custom DPC EMMs to configure how enterprise apps utilize carrier network resources. You can now assign network slices to specific applications or globally to all work applications. You may also restrict applications to only using the assigned network slice.

Enhanced Screen and Display Controls for Custom DPC

You now have more precise control over screen timeout and brightness, including the option to lock brightness at a fixed level on corporate-owned devices. Minimum OS version varies based on the device management mode:

• Work Managed mode on Android 9+
• Corporate Owned Personally Enabled (COPE) mode on Android 15+

For more information, see our Android Device Management documentation.

Certificate Management

Expanded Entrust Dynamic SCEP challenge support

Workspace ONE UEM now supports flexible parameter pass-through for Entrust Dynamic SCEP challenges, removing the previous three-parameter limitation (IGUsername, IGGroup, DeviceType). Administrators can now configure any parameters required by their Entrust certificate templates.

Key benefits:

• Prevents enrollment failures caused by missing Entrust-specific parameters
• Supports complex template configurations without predefined parameter restrictions

Freestyle Orchestrator

Streamline onboarding entitlements in Android workflows

Onboarding entitlements within workflows allow administrators to prioritize resources essential for onboarding that take precedence over other resource assignments. For more information, see Onboarding Workflows.

Upgrading the communication pipeline from UDS to gRPC for macOS

Administrators now have more consistent workflow executions with our replacement of the communication pipeline between the workflow engine and macOS intelligent hub. This ensures that workflow step statuses are sent reliably so that execution can proceed to the next step. This change is in Limited Availability and will require Workspace ONE Intelligent Hub for macOS version 26.04. To have this enabled for your environment, contact your Account team.

iOS Management

App preservation during MDM migration

The new Preserve Applications setting in ADE profile now provides enhanced control for preserving managed applications during MDM migration scenarios. Administrators can specify which apps must be preserved and available immediately after migration during the Setup Assistant phase—choosing to await all apps or selecting specific critical applications. This ensures essential apps are ready before devices reach end users, minimizing downtime and eliminating the need for manual app reinstallation. The enhancement streamlines migrations, reduces IT intervention, and delivers fully configured devices ready for immediate productive use. For more information, see App preservation during MDM migration.

DDM app status subscriptions for iOS

On supported iOS devices, app-related Declarative Device Management (DDM) status subscriptions are enabled automatically, so application state can flow through declarative reporting without additional admin setup.

Key features:

• Automatic enablement: App-related DDM status subscriptions activate automatically on compatible iOS devices with no manual setup required
• Real-time app inventory: Application state flows through declarative reporting, keeping managed app data current and aligned with device-reported information
• Enhanced visibility: Console displays more accurate, up-to-date information about installed applications as iOS surfaces it through DDM
• Improved troubleshooting: Reduced blind spots when auditing app deployments, verifying installations, or diagnosing assignment issues across your fleet.

Platform-based default ADE profiles for automated enrollment

Administrators can now configure separate default Automated Device Enrollment (ADE) profiles for iOS, macOS, tvOS, and visionOS. This makes mixed-fleet onboarding more predictable. Each platform can land on the right baseline profile automatically as devices sync, with less manual cleanup and fewer mismatched assignments when you expand ADE across your Apple estate.

Enhanced Apple App platform management - Universal App support

With this Limited Availability feature, the Workspace ONE UEM console now dynamically recognizes and manages supported platforms for apps imported from Apple Business Manager, replacing previous hardcoded logic. An admin can automatically sync and assign the same application for iOS, iPadOS, visionOS, macOS, and tvOS from ABM into the console without having to sync an app version for each individual operating system.

Key enhancements include:

• Dynamic platform detection: Automatically identifies supported platforms (iOS, iPadOS, visionOS, macOS, and tvOS) from Apple Business Manager metadata
• Flexible app assignment: Enhanced VPP app assignment page enables platform-specific deployment selection
• Universal app support: Streamlined deployment workflows for Universal Apps across all supported Apple devices

These updates ensure seamless app management, flexible deployment options, and alignment with organizational policies for Apple device ecosystems. For more information, see Universal Apps.

Automatic Apple OS version seeding

Workspace ONE UEM now automatically detects and seeds new Apple OS versions across all platforms (iOS, iPadOS, macOS, watchOS, and tvOS). When a new OS version is detected or when a device enrolls with an unseeded OS version, UEM automatically seeds it and makes it immediately available for use in Enrollment Restrictions, Smart Group Criteria, Compliance Policies, Add Device, and ADE/DEP profiles, without relying on manual seeding. Administrators receive a notification when a new Apple OS version is available.

Support for OS 26.4 MDM and DDM payload and key changes

UEM now includes Apple OS 26.4 updates for MDM payloads and DDM declarations. New 26.4 keys and declaration types appear in the Console as you roll out policies aligned with Apple’s current device management specifications.

Target policies and content by Apple device model

Smart Groups now allow you to filter by Apple device model, so you can assign configurations and apps to particular hardware types using the same model names found in Enrollment Restrictions. This update lets administrators deploy test builds to lab devices, apply camera policies only to supported models, or roll out updates by device generation, all without the need for manual device lists or error-prone naming.

Key features:

• Familiar model selection: Define audiences using the same clear Model names you already use in Enrollment Restrictions
• Multi-select capability: Multi-select option allows coverage of multiple models in a single group
• Dynamic membership: Group membership automatically updates based on device-reported models, ensuring accuracy as inventory changes
• Data quality protection: Devices without a reliable model value are excluded from model-based groups to prevent silent mis-application of criteria
• Rule compatibility: Model-based rules work alongside your other Smart Group rules

macOS Management

Simplified macOS application deployment and management

The Enterprise App Repository (EAR) for macOS eliminates manual app packaging and enables admins to deploy enterprise applications as easily as App Store apps—streamlining deployment and ongoing maintenance.

• Curated app catalog
  • Deploy enterprise apps directly from the repository without manual packaging
  • Add apps via Add > Enterprise App Repository > macOS to browse available applications
• Intelligent search & discovery
  • Search applications by name or vendor to quickly find what you need
  • Filter and browse the catalog efficiently
• Seamless upgrades
  • Apps with available updates will show the corresponding status in the Apps List View
  • Seamlessly update previously deployed apps, even if they were originally added manually

For more information, see Add macOS applications from the Enterprise App Repository.

Platform SSO with Automated Device Enrollment in macOS 26

With this feature, macOS 26 streamlines Platform Single Sign-On (PSSO) configuration by integrating it directly into Setup Assistant, enabling first-user account creation through Identity Provider authentication. This streamlined workflow delivers faster onboarding, improved security, and simplified deployment by replacing multi-step setup processes with one integrated flow.

How it works:

• During the Setup Assistant, users authenticate using their Identity Provider (such as Omnissa Access, Okta, Microsoft Entra ID, etc.).
• The Setup Assistant temporarily pauses while the Platform SSO application and necessary profiles are deployed to the device.
• macOS automatically completes the registration for Platform SSO.
• A new first-user account is created using the authenticated IdP credentials, which is then immediately registered with the Platform SSO frameworks.

Enhanced admin experience for macOS software distribution

Workspace ONE UEM now provides administrators with the ability to customize macOS application names using a new Display Name field. When adding macOS applications, admins can now assign custom display names for different versions of the same application while the parent application name remains unchanged. A future release of macOS Intelligent Hub will allow for this value to be displayed to users in the Hub Catalog. Additionally, the supported models and minimum OS fields have been removed from the macOS application workflow to streamline the app management process. This allows for applications to be deployed to macOS virtual machines. When adding new macOS applications, administrators will see an informational banner notifying them of these field removals to ensure awareness of the updated workflow.

Declarative Device Management Assets for macOS

Declarative Management for macOS now supports User Identity asset for eligible macOS devices. You can create a single User Identity asset, reuse it across declarative configurations, and manage it through the standard declarative profile workflow (add, edit, assign, and delete). That gives admins a consistent way to supply identity context for declarative scenarios without duplicating the same data across multiple declarations. For more information, see Declarative Device Management.

Enhanced Apple App platform management - Universal App support

With this Limited Availability feature, the Workspace ONE UEM console now dynamically recognizes and manages supported platforms for apps imported from Apple Business Manager, replacing previous hardcoded logic. Administrators can automatically sync and assign the same Application for iOS, iPadOS, visionOS, macOS, and tvOS from ABM into the console without having to sync an app version for each individual operating system.

Key enhancements include:

• Dynamic platform detection: Automatically identifies supported platforms (iOS, iPadOS, visionOS, macOS, and tvOS) from Apple Business Manager metadata
• Flexible app assignment: Enhanced VPP app assignment page enables platform-specific deployment selection
• Universal app support: Streamlined deployment workflows for Universal Apps across all supported Apple devices

These updates ensure seamless app management, flexible deployment options, and alignment with organizational policies for Apple device ecosystems. For more information, see Universal Apps.

Platform-based default ADE profiles for Automated Enrollment

Administrators can now configure separate default Automated Device Enrollment (ADE) profiles for iOS, macOS, tvOS, and visionOS. That makes mixed-fleet onboarding more predictable. Each platform can land on the right baseline profile automatically as devices sync, with less manual cleanup and fewer mismatched assignments when you expand ADE across your Apple estate.

Support for OS 26.4 MDM and DDM payload and key changes

UEM now includes Apple OS 26.4 updates for MDM payloads and DDM declarations. New 26.4 keys and declaration types appear in the Console as you roll out policies aligned with Apple’s current device management specifications.

Resource Management

Percentage based phased rollout for internal apps

Phased Deployment is now Generally Available for Internal apps. Additionally, you can now configure phases to target a specific percentage of your device pool. In the previous release, phased deployment required setting up specific Assignment Groups for each phase. This enhancement relieves you of the overhead of creating and maintaining custom Assignment Groups for each phase. It gives you greater flexibility and control over your rollout strategy. Moreover, for progressed phases, you’ll now see additional progression details captured at the moment the deployment has advanced. For more information, see Phased Deployment of Resources.

Vulnerability Defense

Vulnerability Defense integration with CrowdStrike

Workspace ONE UEM 2604 offers Limited Availability for Workspace ONE Vulnerability Defense, bringing seamless assessment, prioritization, and remediation directly into the Omnissa platform.

Key Capabilities

• CrowdStrike Falcon Integration: Seamlessly integrate Workspace ONE UEM with CrowdStrike Falcon Exposure Management to retrieve comprehensive vulnerability assessment data
• Automated Device Correlation: Automatically map CrowdStrike vulnerability data to your Windows devices in Workspace ONE UEM
• Risk-Based Prioritization: Access context-rich dashboards that enable rapid, data-driven prioritization of security risks
• Streamlined Remediation: Deploy remediations directly through Workspace ONE UEM's native app and OS management capabilities to address vulnerabilities and reduce organizational risk

Windows Management

Windows server management: Enroll and manage Windows servers using Intelligent Hub

Windows Server management is now Generally Available. This feature was previously available under Limited Availability and is now enabled by default for licensed tenants. Administrators can enroll and manage Windows Server 2016, 2019, 2022, and 2025 devices, including Server Core, using Workspace ONE Intelligent Hub. Management is Hub-based.

Supported capabilities include:

• Hub-managed profiles: ADMX-backed, DDUI-backed, Certificate (SCEP not supported), Custom Settings, and Managed Resources
• Security Baselines enforcement and remediation
• Granular Patch Management with scheduled maintenance windows, zero-day patching, deferral notifications, and per-device patch lifecycle logging
• Internal application deployment via SFD with assignment-level retention control on enterprise wipe or unassignment
• Sensors and Scripts for custom data collection and on-demand or scheduled actions
• Roles and Features Sampling for automatic inventory of installed server roles and features
• Freestyle Orchestrator workflows with sequenced execution and conditional logic
• Workspace ONE Assist for remote view, remote control, file transfer, and remote shell

For more information, see Windows Server Management.

Granular patch management with on-demand update deployment

Administrators can now deploy specific Windows updates, such as critical security KBs to targeted Windows desktops and servers outside of their standard Windows Update for Business ring configuration. This capability enables a rapid response to urgent security patches without disrupting established update schedules. For more information, see Granular Patch Management.

Unified App Sampling: Remove application uninstallation

Administrators can now remotely trigger the uninstallation of applications collected through Unified App Sampling. This enhancement lets you control apps that are not managed, are unwanted, or not allowed on devices from the Workspace ONE UEM Console or through the supported APIs. For more information, see Assign Applications to your Windows Device.

Resolved Issues

Admin Experience

• FCA-212233: Settings Summary XML export fails when the Organization Group (OG) name contains a comma (,).
• FCA-212663: Images vanish from custom message templates after they are saved.
• FCA-213345: Incorrect devices scoped for bulk actions in the Device List View when filters are applied on Tags, Smart Groups or User Groups.

Android Management

• AGGL-20077: Managed config keys do not update when adding new version of internal app.
• AGGL-20435: Newly enrolled Zebra devices are showing up with the wrong oeminfo.

Common Services

• CMSVC-20840: OEM and model IDs are silently ignored during SG creation.

Core Platform

• CRSVC-62551: Script trigger updates on console is not synced to device.
• CRSVC-73705: Enhanced SCEP auto-renewal logic to support user-based profiles where signed user & enrollment user are not the same.

Content Management

• CMCM-191789: Content app on iPad and Android, displays duplicate of same folders.

Enrollment and Service Integrations

• ESI-596: Allow admin users to access multiple UEM tenants when logging in via Omnissa Connect.

Freestyle Orchestrator

• FS-9815: macOS profile installation step in the workflow can hang indefinitely if Hub fails to report status.
• FS-9708: Onboarding workflows may stall during device enrollment due to a database concurrency issue on macOS.
• FS-8185: Scripts removed from device when unassigned from one workflow but still assigned to another on macOS.
• FS-9903: Workflow execution may fail on devices in positive UTC offset timezones on macOS.

iOS Management

• AAPP-21692: VPP apps are not receiving app settings, and users encounter an error stating, "no server has been configured for this app.""

Resource Management

• ARES-32876: Application removal protection triggered despite device threshold not being met within time window, causing false alarms.
• ARES-36784: Passcode not cleared from shared iOS devices when user logs out of it.
• ARES-37278: Incorrect app config delivered to newly enrolled devices assigned to future-dated Internal app assignments.
• ARES-19301: Profiles requiring WLAN MAC address lookup are delivered to iOS devices without the required value, resulting in authentication failures.

User Management

• UM-10208: Directory-type admin account is unable to modify roles while logged in at Partner-type OG.
• UM-10209: Inconsistent Full Name and Display name during OIS SCIM Provisioning.
• UM-10484: User Search option in Add Device Registration screen permits search for empty string.
• UM-10592: Admin Group Deletion Removes Roles from existing Admins.
• UM-11073: Enrollment to a child OG fails for basic users in OIS-enabled tenants.
• UM-11104: SSP authentication to a child OG fails for basic users in OIS-enabled tenants.

Windows Management

• AMST-44384: When ProfileDeliveryAtScaleFeatureFlag is enabled, nodes are absent from the profile syncML when resuming.
• AMST-46045: Apps installed on the Hololens are appearing as Not managed, which is preventing us from uninstalling them.

Patch Resolved Issues

Patch 1

• PPAT-21484: Fix Tunnel Exceptions during the profile publish.
• PPAT-21104: Set Multi Profile Support For Managed TunnelClients Phase1 FF to rollout.
• MACOS-7327: WS1 Assist - 'Remote Assist' button goes away/missing on Hub sync.
• FS-9894: For PO-enrolled devices, the onboarding status remains stuck at "Onboarding in Progress" when the assigned onboarding workflow includes internal apps as the last step.
• FCA-213532: Error occurs while filtering with tags in the device list view using "space" as a character.
• FCA-212413: Clicking "Other" in the Operating System breakdown chart from the Device Dashboard displays an error.
• CRSVC-74796: Accessing the "User Sync Failed" events in the console results in the error: "An error has occurred".
• ATL-28994: Seeding macOS Hub 26.04.0 to UEM 26.04 Patch1. For more information, see, Omnissa Workspace ONE Intelligent Hub for macOS Release Notes.
• ATL-28828: Seed Workspace ONE Intelligent Hub v26.04 for Windows. For more information, see Workspace ONE Intelligent Hub for Windows Release Notes.
• AMST-47028: Application removed from device even though "Keep App After Un-Assignment" option is enabled.
• AMST-46364: Multi User Checkout restrictions are not getting overwritten in child OG.
• ARES-37726: Devices not visible on Phase Deployment Tracking page of apps deleted previously from list view and added back later.

Patch 2

• RUGG-14306: Relay server content will not be pushed to FTP when RSCC is used in some cases.
• FCA-212480: Incorrect highlight colour appearing in drop-down menus resulting in readability issues.
• FCA-210931: Update Event Log to display username of admins which triggered bulk actions.
• CMEM-187318: CPU contention caused by [mobileEmailGateway].[AccountUser_Load].
• AGGL-20378: eSIM actions missing in Device Details and installing eSIM throws an error.

Patch 3

• UM-11153: Addressed scenario where child OG deletion can cause OIS fail to update UEM.
• RUGG-14288: Certificate renewal fails for Android devices published through Product provisioning profiles.
• PPAT-21400: Updated Tunnel pages Read-Only RBAC role permissions.
• PPAT-21355: ETag is not updated when the shift status after changes.
• FS-9924: Workflows and scripts fail to run on Brownfield macOS devices after upgrading to 2602 or 2604.
• FCA-213604: Resized upgrade banner to prevent messages from blocking user actions.
• FCA-212597: Enhanced RequireJS pages to prevent displaying version information.
• FCA-212214: Updated the default Read-Only Administrator role to include all read permissions.
• CRSVC-76143: Updated DeviceStatev3 API response to prevent duplicate Device UUID value reporting.
• CRSVC-75006: Azure token may not be revoked if device is deleted when offline.
• CRSVC-74767: Addressed scenario where optional profiles are not displayed in the Devices Profiles tab.
• CRSVC-71788: Certificate count in the Device Details > Summary does not match the data under Device Details > Certificates.
• ATL-29192: Update macOS Workflowd Package.
• ARES-38095: App and profile list cannot be exported from Device Details.
• AMST-47061: Aligned Windows CLI staging enrollment with AssignToLoggedOnUser to enforce allowed user group policies.

Patch 4

• RUGG-14484: Product Set remains stuck in processing state, preventing edits.
• PRNT-345: LA Availability for Printers & IoT Platform.
• MACOS-7103: Resolved an issue where newer application versions, deployed to lower OGs, were incorrectly inheriting and overwriting the Bundle Identifier schema.
• HUBW-22664: 2602 Bitlocker profiles being blocked in the onboarding workflow.
• FS-9911: Resolved an issue where Freestyle workflows did not re-execute on devices after unenrollment and re-enrollment.
• CRSVC-78779: Bitlocker profiles being blocked in the onboarding workflow.
• CRSVC-77709: Resource delivery may be blocked due to stale overrides created by Compliance Policy evaluation.
• CRSVC-74767: Addressed scenario where optional profiles aren't displayed in the devices Profiles tab.
• CRSVC-74427: "Profile Install Blocked" and "Profile Install Initialized" event logs do not display NotNow status reason details in the Troubleshooting page.
• ATL-29318: Updated macOS Workflowd Package.
• ATL-29287: Updated Software Distribution Agent Package to 26.4.1.
• ARES-38221: Resolved an issue where transitioning an application from Internal App to Product deployment within 24-hours caused unintended device uninstalls.
• ARES-37566: Installed devices not visible on Deployment Tracking view unless filtered.
• ARES-37354: Nested app configurations such as VPN settings fail to get saved.
• AMST-46952: Add event log support for Windows Update sample.
• AMST-46950: Enrollment Token Bulk Upload - Device friendly name in the uploaded sheet is not getting considered.
• AMST-44925: Unable to edit a Baseline if saved with empty values.
• AGGL-20567: Enhanced assignment rules response to resolve issues impacting assignment updates.
• AGGL-20483: Android Internal App upload intermittently failing.
• AGGL-20450: Improve Performance for Android App Catalog.
• AGGL-20442: Enterprise wipe from UEM consistently wipes / power‑washes Chrome OS device but does not deprovision it from Google Admin.
• AGGL-19985: Enrollment Date is Not Set on Chrome OS device.
• AAPP-22209: Improved Apple device release diagnostics by retaining API error responses and added event logs for key release states.
• AAPP-21843: Enhanced VPP integration synchronization to ensure proper cleanup when no licenses are returned.
• AAPP-21301: Intermittent ADE Sync Failures Due to Apple Rate Limiting (HTTP 429).

Patch 5

• AGGL-20730: Managed App Configs are Corrupted by Hierarchical Key.

Patch 6

• MACOS-7484: Support for macOS Registered Mode.
• FS-10219: A post install script issue may corrupt workflow binaries and prevent workflows from executing on macOS devices.
• FS-10111: Expired internal device credentials may cause workflows to be stuck in progress and prevent new workflows from executing on macOS devices.
• FS-9762: Event-based scripts execute more frequently than expected after device check-in on macOS.
• FS-8052: Missing search functionality on workflow details page device status table.
• FCA-214062: Fixed a display issue on the Freestyle Orchestrator page that blocked workflow naming and creation.
• FCA-213920: Self-Service Portal (SSP) language selection was unavailable when authenticating via Workspace ONE Access.
• FCA-213739: Authorization error message is being incorrectly shown on some console screens.
• ATL-29599: Seed - Machost 2604.7135 to release 2604.
• ATL-29537: Seed - Machost to canonical release PR2604-6.
• ATL-29407: Seed - Machost to canonical release PR2604-6.
• ATL-29400: Seed Workspace ONE Intelligent Hub v26.04.1 for Windows.
• ARES-36322: ADMX Profile gets corrupted by character-escaping issue.
• AMST-47802: Privilege Elevation feature is now part of Workspace ONE Advanced SKU.
• AMST-47787: Added execute/genericcommand API Endpoint to api/help page in production environments.
• AMST-47779: Manage inclusion of AllowOOBEUpdates node according to OS build version.
• AMST-47071: Newer version of Enterprise Repository Apps get assigned even though assignment carry over is cancelled.
• AMST-43186: New API version available for Application creation with multiple processor architectures.
• AAPP-22776: MAM API returning duplicate results.
• AAPP-22508: Device updates tab shows 'Not Available' for Apple OS Updates.
• AAPP-22155: Improve retry logic for VPP v2 calls.
• AAPP-21991: Unable to configure Network usage rules payload profile for iOS.
• AAPP-21422: Improvements to VPP v2 license management.
• ARES-32880: Multiple profile removal failure events displayed in troubleshooting logs of mobile devices for profiles deleted from UEM.

Patch 7

• UM-11206: User group memberships are updated when enrolling iOS or macOS devices even if Sync User Groups in real time is disabled.
• UM-11085: Child OG admin is unable to remove users from a Custom User Group.
• FCA-214069: Editing a profile for an extended period might trigger a session error, interrupting the edit before assignment.
• FCA-213533: OG picker placed incorrectly in the header on some pages in the console.
• FCA-213213: Inconsistent notification count is seen on different pages of the console when notifications are dismissed.
• CRSVC-75786: Enable feature that allows collection of all logs with one click.
• ARES-38601: VPN profile cannot be assigned to an application's Tunnel settings.
• ARES-38352: 'Platform' filter displayed twice on Profile List view.
• ARES-37842: Device cannot be rebooted from Devices List view.
• ARES-37341: Deployment metrics under 'View' on app and profile list hides upon hover.
• AAPP-21798: Improve handling of Apple's throttling limits for VPP v2 flows.

Patch 8

• AAPP-22654: VPP On-demand Applications intermittently getting re-installed on devices when the application is removed by an Admin in the console.
• AMST-45142: Fixed issue where Drop Ship Provisioning (DSP) at child OG was getting disabled when changes are made to Parent OG DSP configuration.
• AMST-46668: Filtering in Device Registration List View with Serial Number does not work.
• AMST-46946: Fixed issue in UEM console, where after selecting apps for inclusion in a provisioning package (PPKG), the "NEXT" button becomes greyed out and the app selection on the initial page is lost when navigating back to it.
• AAPP-20744: Actions and commands both are generated for iOS profiles.
• AAPP-21403: Return to Service option does not display Wi-Fi profiles.
• AAPP-22255: App sample save issues for web enrolled device which was DEP enrolled in past & never completed configuration al page is lost when navigating back to it.
• AMST-47153: Device Reassignment fails at child OG after overriding Multi-User Checkout restrictions.
• AMST-47763: Fixed issue with Enterprise App Repository config page crashing for the OneDrive app.
• AMST-47775: Fixed issue where profile removal fails on the device but removed from Workspace ONE UEM.
• AMST-47797: Fixed issue where Device List view incorrectly shows Windows devices as "Multi User" for the Windows User Mode column, though the device is enrolled as 'Single User'.
• ARES-37420: Internal app deployment metrics incorrect when fetched through API.
• ARES-37451: Geofencing profiles not delivered as expected in modern architecture enabled environments.
• FCA-213810: OG Picker dropdown is missing when an admin has access to only one OG.
• FCA-214005: Fixed a display issue where the Compliance Status tile appeared misaligned on the Baseline Dashboard.
• FCA-214150: Fixed an issue where dropdown menus in Profile and App Configuration pages were unresponsive in Firefox.
• FS-10101: Total Execution Count in the Freestyle Orchestrator overview has been reset.
• MACOS-7301: Onboarding and Focused Enrollment status is displayed in device details page even if Focused Enrollment is Disabled.

Patch 9

• VULN-1688: Re-registering a device in CrowdStrike can cause mapping issues.
• VULN-1504: Remediation Wizard - apps search does not filter by platform.
• VULN-1459: Incorrect Vuln Defense logo in nav menu.
• VULN-1458: Vulnerabilities list view - Filters reset does not work.
• VULN-1403: Filters and Search on Product Details page do not work.
• VULN-1401: Summary counts are incorrect across multiple pages.
• VULN-1397: Fallback logic for CVSS score resolution.
• VULN-1301: Vulnerabilities count discrepancy between Vulnerabilities list view and Device Details.
• UM-11243: User Management Service client is incorrectly invoked when feature flag is disabled.
• UM-10919: Device registration record creation fails due to incorrect handling of selected message template.
• RUGG-14521: Last Seen timestamp is incorrectly updated for devices belonging to smart groups assigned to a product upon product activation.
• MACOS-7325: Page error occurs when UEM Console Admin tries to edit the Mobility Profile.
• CRSVC-80819: Fixed an issue where an incorrect unauthorized error was displayed on some pages.
• ATL-29824: Seed Workspace ONE Intelligent Hub v26.04.2 for Windows.
• ARES-38439: Copying and editing profiles having passcode in payload causing issues.
• ARES-38239: Devices not visible in future phase on phased deployment tracking view if assigned to another app version.
• ARES-38099: Installed profile shown as removed in Intelligence.
• ARES-37991: Force removal of a few iOS apps failing from Device Details Apps tab.
• AMST-48196: Manage inclusion of AllowOOBEUpdates node only on supported OS build versions.
• AMST-48015: Domain Join Config ignores Base DN config if multiple domains are configured.
• AMST-47928: Intelligent Hub on Windows not updating post UEM upgrade to 2509.
• AAPP-22642: Sync ADE Devices isn't working.
• AAPP-21508: VPP Applications are intermittently failing to install on random Devices.

Patch 10

• VULN-1891: Remediation wizard may show incorrect app version.
• VULN-1489: Remediation wizard may show an error when recommendation is not available.
• FCA-213916: DLV Smart Group filter breaks for smart groups with large manually added device/user lists.
• FCA-213816: Unable to change Deployment Begins date when publishing an application.
• FCA-213597: Fixed visual inconsistencies where some console pages displayed updated UI styling while others retained the older design.
• ATL-29786: Seeding SFD 26.4.2 build to UEM 2604 release.
• ARES-38312: Profile save fails when assigned to devices with ownership type 'undefined'.
• ARES-37644: Incorrect installation status reported for some profiles in Device's Profile list.
• ARES-37362: User accepted counts for Terms of Use fails to load for Application type.
• ARES-36887: Some profile installation statuses reported to Intelligence are incorrect.
• ARES-34956: Uploading a static certificate in a Credential slot in the Credentials profile payload copies validity dates and thumbprint from another slot.
• AAPP-22395: Ability to turn off scheduled sample collection continuation on NotNow responses.
• AAPP-21467: Advanced Security Controls profile does not work as expected.
• AAPP-21462: VPP apps are not updating on many devices.

Patch 11

• VULN-1912: VMS - sort criticality rating by enum, not lexicographixally.
• VULN-1897: Remediation wizard for apps does not filter for recommended version.
• VULN-1412: Vulnerabilty Details page - Setup Remediation button is misaligned.
• SINST-176815: Revert .msi request-filter change — restore /agents access in patches 2602 #13 and 2604 #11.
• PPAT-22197: meta.gateway empty in managed Tunnel client-config response.
• PPAT-22044: Performance Improvement for Tunnel allowlist endpoint.
• LAUN-211: The Launcher Profile does not allow page changes for layout.
• FCA-214321: "Query" action button isn't enabled for Windows devices in NextGen App Device List.
• FCA-214156: Device version sorting is inconsistent across operating systems on the device dashboard.
• FCA-213816: Unable to change Deployment Begins date when publishing an application.
• FCA-213196: GetTenantUuidForOrganizationGroupAsync breaking behaviour after partner enablement.
• ARES-30925: Inconsistent color to status mapping in Deployment Tracking charts.
• AMST-48112: Dropship Provisioning auto enrollment PPKG certificate signing failure.
• AMST-48002: Admin_LocationGroupDelete fails on FK constraints — missing EARAppAutoUpdateConfig and DduiPayload cleanup.
• AGGL-20648: SCEP/Credentials profiles for Android are unable to proceed despite providing all mandatory fields.
• AAPP-23168: Reduce the VPP license pool count in VppV2Licenses_SyncByAdamID on license deletion.
• AAPP-22508: Device updates tab shows 'Not Available' for Apple OS Updates.
• AAPP-22155: Improve retry logic for VPP v2 calls.
• AAPP-21991: Unable to configure Network usage rules payload profile for iOS.
• AAPP-21422: Improvements to VPP v2 license management.
• ARES-32880: Multiple profile removal failure events displayed in troubleshooting logs of mobile devices for profiles deleted from UEM.

Patch 13

• SINST-176756: Updated service runtime to .NET 10 for improved performance, security, and long-term support - UEM & CP Services.
• FS-10300: After an interrupted workflow engine upgrade, Freestyle workflows on macOS devices may fail to execute because a stale database migration lock prevents the workflow engine from starting.
• FS-9932: Repeated profile installation attempts may occur if a response is missing during re-evaluation on macOS devices.
• FCA-213887: Read-Only administrator accounts and roles are not visible to console admins.
• CTRLP-14512: Improved authentication and authorization controls for service-to-service messaging.
• CMEM-187334: Optimize response payload for mem endpoint activesync/memconfigdevicepolicies.
• ATL-30384: Seed - Machost to canonical release PR2604-13.
• ARES-39062: 'Save Failed' error sometimes received while publishing app to thousands of devices and parallelly deleting devices from UEM.
• AMST-42947: Device Details - WNS Connected Last Seen timestamp is not show in Admin's selected timezone.
• AAPP-23362: Device List page crash after upgrade 26.2.0.10 → 26.4.0.6+.
• AAPP-22485: Unable to renew or clear the VPP sToken from the UEM Console because the option is grayed out.
• AAPP-21015: {DeviceFriendlyName} value not populated on Enrollment Message.
• AAPP-19323: Purchased apps showing inconsistent installation status.

Patch 14

• VULN-2214: While processing device vuln from crowdstrike ensure to check for AID by ignoring the CID prefix.
• VULN-1733: Vulnerability management performance optimization.
• RUGG-14610: Zebra OTA updates stop working and device update status not reflecting correctly.
• PPAT-22293: DTR-based traffic policy cannot be configured/updated for macOS from the profile UI.
• MACOS-7626: MacHub sends empty Application List sample during Hub Sync.
• FCA-214004: Lock device command not working when Notes Description is a required field.
• CMSVC-21034: Device List View shows an incorrect device count when filtering by smart group.
• CMSVC-21003: App assignment page fails to load in organization groups with a large number of smart groups.
• ATL-30314: Seed Workspace ONE Intelligent Hub v26.04.3 for Windows.
• ARES-39049: Product sent repeatedly to device if app configured to be installed through Product Provisioning is sideloaded by device.
• ARES-38920: Geofencing area change event is not delivering the right profiles in modern architecture enabled environments.
• ARES-37109: Error occurs while deleting retired apps from the console.
• AMST-48247: Cache CND URL for redirection while serving branch cache requests.
• AGGL-20938: Duplicated assigned Android app package names may cause FCM messages to fail.
• AGGL-20862: Hub 26.05 fails to install Wi-Fi profile on Android devices.
• AAPP-23784: Fix Apple sample commands error processing.
• AAPP-22963: ADE/DEP Settings tab is erroring out in several OGs, including the top OG.
• AAPP-21974: Unable to edit/create iOS VPN profile.

Patch 15

• FCA-215202: Fixed an issue where uploading an XML application configuration file failed in the App Configuration screen.
• FCA-215103: Fixed an issue where assigning internal applications failed with an error on certain console URL configurations.
• CRSVC-86520: Fixed an issue where onboarding workflows failed to advance to the next step after a profile was successfully applied on the device.
• ARES-39521: Infinite loading spinner appears while creating or editing assignments for a few apps in modern experience enabled environments.
• AGGL-21142: Allow Apple DEVICE ResourceTargets for iOS and visionOS system targets.
• AAPP-23761: MDM OS update commands - should not be sent to devices with OS version >=27.
• AAPP-23752: Support new ADE Setup Assistant, Restrictions, Extensible SSO, and Login Window keys introduced in OS 27.
• AAPP-22546: Support new and updated DDM configurations introduced in iOS 27 and macOS 27.
• AAPP-22309: Unable to create iOS VPN Profile with multiple VPN payloads.

Known Issue

• ARES-38094: App list cannot be exported from Device Details page for Windows devices.

Release Availability

We strive to deliver high-quality products, and to ensure quality and seamless transitions, we roll out our products in phases. Each rollout may take up to four weeks to accomplish and is delivered in the following phases:

• Phase 1: Demo, Shared SaaS UATs, and Latest Mode UATs
• Phase 2: Shared SaaS environments
• Phase 3: Latest Mode environments

Getting Ready for Major OS Releases

To prepare for the upcoming software updates from major device vendors, read through the Getting Ready for Major OS releases section of the Omnissa Product Documentation.

Documentation

To learn more about Workspace ONE UEM, browse Workspace ONE UEM Documentation.

Localized Content for Omnissa Docs

For details on Omnissa's localization strategy, see the KB article: Announcing Omnissa Localization Support.

Support Contact Information

To receive support, access Omnissa Customer Connect. For information about filing a Support Request in Customer Connect and using Cloud Services Portal, see the KB article here.

Original source

Omnissa Workspace ONE Content Release Notes detail the new features and enhancements in each release. This page contains a summary of the new capabilities, issues that have been resolved, and known issues that have been reported in each version.

New Features

Workspace ONE Content for iOS has a new application bundle identifier (Bundle ID) as part of Omnissa's transition to the Omnissa enterprise account. This does not require any action for Apple Store deployments.

Allow users to securely access Workspace ONE Content file extensions from external applications when authentication is enabled for Content.

Minimum Requirements

iOS 16+

iPadOS 16+

Workspace ONE UEM Console 2410+

For more information, see WS1 UEM Console Release and End of General Support Matrix (2960922).

Resolved Issues

Note

The numbers included before the resolved issues are used for internal issue tracking.

ISCL-185168: Replacing default filename results in blank filename display.

ISCL-185114: App crashes on devices with <=3GB RAM while opening or searching PDF documents.

ISCL-185303: [iPad M4/M5] Unable to capture images using "Take photos or videos" option.

Known Issues

We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.

Original source

Unified Access Gateway 2506.1 | 22 SEP 2025

Check for additions and updates to these release notes.

Unified Access Gateway appliance helps enable secure remote access for virtual desktops, internal sites, applications, and file repositories users. To learn more, see Unified Access Gateway Documentation.

Omnissa Unified Access Gateway Release Notes provide information about the new features and enhancements in each release. This page contains a summary of the new capabilities, issues resolved, and known issues that are reported in each version.

What's New

Caution

This patch release addresses critical fixes for the edge services Tunnel, Content Gateway, and Secure Email Gateway on Unified Access Gateway (UAG). If your deployment uses any of these services, applying this patch is strongly recommended. If UAG is used only for other services (for example, Horizon), this patch can be safely skipped.

Content Gateway

In this release, we have made a few updates containing bug fixes and performance improvements with no new features.

Workspace ONE Tunnel

Compatibility with new certificate EKU requirements

Tunnel Server now supports third-party certificates that comply with the latest Extended Key Usage (EKU) requirements, including the removal of the Client Authentication EKU from publicly trusted TLS certificates.

• Ensures compatibility with certificates issued after October 2025, which may only include Server Authentication EKU.
• No impact to existing Tunnel Server functionality.
• Workspace ONE UEM support for uploading certificates with the latest Extended Key Usage (EKU) requirements is planned for a future release and will be available as a patch release for all supported Workspace UEM console versions.

Secure Email Gateway (SEG)

• Enhancements to support custom values in Certificate-based authentication (CBA).
• Support for Move files operation in Network file share (NFS) repository.

Before You Begin

• Compatibility Notes
  For more information about the compatibility of Unified Access Gateway with other products, see Product Interoperability Matrix.
• Install and Upgrade
  To download the Unified Access Gateway, see the Product Download page.
• Security Scan
  Owing to the OS update, special instructions are required to get accurate scan results of the operating system used by the Unified Access Gateway appliance. For more information, see Security scanning of Linux on Unified Access Gateway (UAG) version 2412 and beyond (6000738).

Resolved Issues

Note

The numbers included before the resolved issues are used for internal issue tracking.

Content Gateway

CONSVR-2756: Certificate-Based Authentication (CBA) failure for SharePoint On-Prem repository.

Secure Email Gateway

CMEM-187216: iOS native email client is unable to sync email through SEG when connected to Exchange Online.

Known Issues

Note

The numbers included before the known issues are used for internal issue tracking.

Workspace ONE Tunnel

UAG-12246: DNS resolution for host entries added under the UAG Tunnel configuration might not work as expected for Workspace ONE Tunnel.

Workaround

Step 1: Add the following KVPs in Workspace ONE UEM > Tunnel configuration.

dns_server_address_1 127.0.0.53

dns_server_port 53

Step 2: Restart the vpnd service.

systemctl restart vpnd

Documentation

Documentation for Unified Access Gateway is located at Omnissa Product Documentation.

Support Contact Information

To receive support, access Customer Connect.

For information about filing a Support Request in Customer Connect and using Cloud Services Portal, see the Knowledge Base (KB) article 6000005.

Localization

For details on Omnissa’s localization strategy, see Announcing Omnissa Localization Support.

Original source

Note: OCSP stapling is enabled by default starting with SEG version 2.26.

If required, you can disable OCSP stapling by adding the following key-value pairs (KVPs) in the SEG Custom Settings, located in the Advanced Configuration section of the Workspace ONE UEM console:

Key-Value Pair Type Value Djdk.tls.server.enableStatusRequestExtension Boolean False Djdk.tls.client.enableStatusRequestExtension Boolean False

Workspace ONE Secure Email Gateway 2.36.0

New Features

This release focuses on security and performance improvements with no new features.

Minimum Requirements

Workspace ONE UEM Console 2410 or later

Resolved Issues

We are always working to improve Workspace ONE Secure Email Gateway with every release. There are no major bug fixes to report.

Known Issues

We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.

Original source

Unified Access Gateway appliance helps enable secure remote access for virtual desktops, internal sites, applications, and file repositories users. To learn more, see Unified Access Gateway Documentation.

Omnissa Unified Access Gateway Release Notes provide information about the new features and enhancements in each release. This page contains a summary of the new capabilities, issues resolved, and known issues that are reported in each version.

What’s New

Caution

This patch release addresses critical fixes for the edge services Tunnel, Content Gateway, and Secure Email Gateway on Unified Access Gateway (UAG). If your deployment uses any of these services, applying this patch is strongly recommended. If UAG is used only for other services (for example, Horizon), this patch can be safely skipped.

Content Gateway

In this release, we have made a few updates containing bug fixes and performance improvements with no new features.

Workspace ONE Tunnel

Compatibility with new certificate EKU requirements

Tunnel Server now supports third-party certificates that comply with the latest Extended Key Usage (EKU) requirements, including the removal of the Client Authentication EKU from publicly trusted TLS certificates.

• Ensures compatibility with certificates issued after October 2025, which may only include Server Authentication EKU.
• No impact to existing Tunnel Server functionality.
• Workspace ONE UEM support for uploading certificates with the latest Extended Key Usage (EKU) requirements is planned for a future release and will be available as a patch release for all supported Workspace UEM console versions.

Secure Email Gateway (SEG)

• Enhancements to support custom values in Certificate-based authentication (CBA).
• Support for Move files operation in Network file share (NFS) repository.

Before You Begin

• Compatibility Notes

For more information about the compatibility of Unified Access Gateway with other products, see Product Interoperability Matrix.

• Install and Upgrade

To download the Unified Access Gateway, see the Product Download page.

• Security Scan

Owing to the OS update, special instructions are required to get accurate scan results of the operating system used by the Unified Access Gateway appliance. For more information, see Security scanning of Linux on Unified Access Gateway (UAG) version 2412 and beyond (6000738).

Resolved Issues

Note

The numbers included before the resolved issues are used for internal issue tracking.

Content Gateway

CONSVR-2756: Certificate-Based Authentication (CBA) failure for SharePoint On-Prem repository.

Secure Email Gateway

CMEM-187216: iOS native email client is unable to sync email through SEG when connected to Exchange Online.

Known Issues

Note

The numbers included before the known issues are used for internal issue tracking.

Workspace ONE Tunnel

UAG-12246: DNS resolution for host entries added under the UAG Tunnel configuration might not work as expected for Workspace ONE Tunnel.

Workaround

Step 1: Add the following KVPs in Workspace ONE UEM > Tunnel configuration.

dns_server_address_1 127.0.0.53

dns_server_port 53

Step 2: Restart the vpnd service.

systemctl restart vpnd

Documentation

Documentation for Unified Access Gateway is located at Omnissa Product Documentation.

Support Contact Information

To receive support, access Customer Connect.

For information about filing a Support Request in Customer Connect and using Cloud Services Portal, see the Knowledge Base (KB) article 6000005.

Localization

For details on Omnissa’s localization strategy, see Announcing Omnissa Localization Support.

Original source

Horizon Cloud is a multi-cloud Desktop as a Service deployment with thin edge infrastructure. The service provides you with a global view of your desktops and applications spanning on-premises and cloud environments. Regardless of the location of your desktop and application deployments, Horizon Cloud enables you to consistently manage and monitor them.

These Horizon Cloud release notes detail the new features and enhancements in each release. The release notes also provide other information about Horizon Cloud such as limitations, known issues, and support contact information.

Support for new features depends on your specific infrastructure and capacity providers.

August 25, 2026 - HAI Update

A new build of the Horizon Agents Installer (HAI) version 26.2.0-32351266467 is now available.

The following agent versions are included in the Horizon Agents Installer:

• Horizon Agent: 8.19.0-32343440112
• Dynamic Environment Manager Agent: 10.20.0.2448
• App Volumes Agent: 4.22.0.6190

Original source

Resolved Issues

The number included after each resolved issue is used by internal issue tracking system:

• MSIX application packages fail to attach to a different OS even when the Allow package delivery to any operating system, an advanced setting, is enabled and the following error can be seen in System Messages in the App Volumes Manager admin UI:

  MSIX Package _name_of_the_package locked to name_of_package_OS was not attached to name_of_the_computer because it is not allowed on User’s Machine’s OS_

  [AVM-33322]

• Administrator (Read Only) account can neither expand the + button of each application and package on their respective summary pages nor able to view their respective details in the App Volumes Manager admin UI though they are able to view the list of applications and packages on the summary pages. [AVM-33408]

• When replicating packages or AppStacks from a vSAN datastore, the replication fails to copy these files to the destination storage. In the App Volumes Manager log file, the packages and AppStacks meant for replication are skipped. [AVM-33446]

• App Volumes Manager FQDN is shown as Unknown in the CONFIGURATION > Managers > App Volumes Manager Servers page in the App Volumes Manager admin UI. [AVM-33399]

• Due to an internal issue in the LDAP Base field, accessing the AppStacks > Volumes (2.x) tab displays the App Volumes server error, and the tab is not accessible. This issue occurs when the LDAP Base field contains a value. [AVM-33108]

In the App Volumes Manager logs, the following error can be observed:

[2024-02-02 19:50:43 UTC] P4672R1802 ERROR Manager: Inspecting Array (195620) (from log block)
[ 0] "D:/CloudVolumes/Manager/vendor/bundle/ruby/3.2.0/gems/actionview-6.0.6.1/lib/action_view/helpers/translation_helper.rb:60:in \translate'" , [ 1] "D:/CloudVolumes/Manager/app/views/appstacks/index.html.erb:217:in`

The LDAP Base field is present in the Register Active Directory Domain page in the App Volumes Manager admin UI.

For a description about the LDAP Base field, see Register an Active Directory Domain topic in the Omnissa App Volumes Administration Guide.

• Unable to replicate packages if the folder structure provided in the Default Storage Path field in the CONFIGURATION > Storage tab of the App Volumes Admin UI (for example: /appvolumes/packages) is not present on the datastore during the replication of packages. [AVM-33431]

The following error is reported in the log:

ERROR RvSphere: Fault in folder_exists? #<Thread:0x000000010559b130 run> (exception NoMethodError): undefined method \include?’ for nil:NilClass`

• When accessing DocuSignPrintDriver, delivered as an application package, the printer becomes unavailable due to issues in registry virtualization. If trying to view the printer properties then the following DocuSignPrintDriver Printer Properties error message is displayed:

  The DocuSignPrintDriver printer driver is not installed on this computer. Some printer properties… . [AVA-23718]

• “new Microsoft Teams” application fails to launch when Profile-only or UIA+profile Writable Volume is attached to the agent computer.

  NOTE: When this issue occurs, no error message is displayed by the application. [AVA-23756]

• Microsoft Teams icon is not visible in the Start menu when delivered as an on-demand MSIX application package. [AVA-23761]

Known Issues

The number included after each known issue is used by internal issue tracking system:

• Published applications on demand fail to launch when App Volumes 2603.1 or earlier versions are used with Horizon 2606. [AVA-28403]

  Workaround: Upgrade to App Volumes 2603.2 and later.

  Resolved: This issue is now resolved in App Volumes 2603.2 and later.

• Applications such as Google Chrome Portable (installed per user) display a blank window or an Aw, Snap! error at first launch when using a UIA+profile Writable Volume. [AVA-27476]

• Horizon Agent 8.14 (2412) and 8.15 (2503) processes crash during a Horizon Client reconnect if the Horizon configuration includes an App Volumes package which contains Visual C++ x64 runtime version 14.36.32532.0 or earlier. [AVA-25969]

• App Volumes redirection of the search index from a folder on the system volume (C:\ProgramData\Microsoft\Search\Data) to a folder on the Writable Volume (C:\SnapVolumesTemp\writable\persistent\Search\Data) does not occur on Windows 10 with App Volumes 2312 and later and Windows 11 with any version of App Volumes. [AVA-24417]

  Typically in App Volumes configurations with a Writable Volume, if redirection is not already configured by DEM (Dynamic Environment Manager) or GPO (Group Policy Objects), App Volumes automatically redirects the OS search index from a folder on the system volume (C:\ProgramData\Microsoft\Search\Data) to a folder on the Writable Volume (C:\SnapVolumesTemp\writable\persistent\Search\Data).

• “new Microsoft Teams” which is installed in the base image, launched, and updated successfully by the user with a UIA+profile Writable Volume at the first login fails to launch at the second login onwards with the same UIA + Profile writable. This failure occurs because unexpected registry entries are captured in the Writable Volume. [AVA-24024]

  Workaround: Customize the base image by adding the following exclusions in custom\snapvol.cfg:

  exclude_registry=\REGISTRY\MACHINE\Software\Classes\PackagedCom

  exclude_registry=\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\ms-teams.exe

  exclude_registry=\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\ms-teamsupdate.exe

  When the user having the same Writable Volume logs into the agent computer which has the updated based image, new MS Teams launches successfully.

• Running the change logon command on an RDS host does not work when application packages or Writable Volumes are attached to the RDS host. Status of the RDS host machine is not updated in the Omnissa Horizon console. [AVA-23264]

  Workaround: Add the following in the custom snapvol.cfg file:

  exclude_registry_value_path=\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\WinStationsDisabled.

• An advertised shortcut launches the MSI installer when the shortcut is clicked. App Volumes agent does not allow the MSI installer to run when a corresponding application package having such an advertised shortcut is virtualized.

  The following error message is displayed:

  This action is not allowed for application . [AVA-21004]

  Workaround: When packaging the application, delete the advertised shortcut from the Start menu, and recreate another shortcut for the application’s executable.

• An OS junction point from a native folder that belongs to a banned list to a non-virtualized folder (such as %APPDATA% in configurations that do no use UIA+Profile Writable Volume or a Profile-only Writable Volume) does not work properly. Files written to the junction source do not appear in the junction target. [AVA-20343]

• In a multi-session environment, the error associated with the Microsoft Office application is also visible to users who are not assigned this application package. While the application does not behave as expected for the users assigned to this package, the error has no effect on users who are not assigned to the package. [AVA-20264]

• Applications cannot write large string values (several hundred thousand characters) to the registry. [3034063]

• When a Writable Volume and FSLogix Office Container are deployed together in a VDI, the FSLogix Office Container VHD is not created on an SMB file share. This issue occurs only when the Cloud Cache feature is enabled. [2791414]

  Workaround: Deactivate the Cloud Cache feature of FSLogix Office Container.

• Sometimes, the applications that are packaged using App Volumes versions older than 2.18.2 have many redundant firewall rules. These rules can impact the end-user login time on agent computers where the application package is deployed. This issue is fixed in App Volumes 2.18.2 and later. [2624048]

  Workaround: If you are migrating an application package created in an App Volumes version earlier than 2.18.2 with such an issue, repackage the application after migrating to the target version.

• When a remote printer is defined on a UIA+Profile Writable Volume and the printer is attached to its print server through a USB interface, the printer definition on the Writable Volume might get deleted on the next non-persistent logon. [2845852]

  Workaround:

  On the system volume, add the following two scripts to %SVAgent%\Config\Custom\uia_plus_profile :

  OnPreLoadApp.bat: sc config spooler start= disabled net stop spooler

  OnPostEnableApp.bat: sc config spooler start= auto net start spooler

  If you already have the same script names on the Writable Volume, add the spooler commands to the scripts.

  When a script is present on a Writable Volume and in the system volume at %SVAgent%\Config\Custom\uia_plus_profile , App Volumes agent runs the script present on the Writable Volume and ignores the script on the system volume. To ensure that the App Volumes agent runs both scripts, you can add the following to the script on the Writable Volume:

  if exist "%SVAgent%\Config\Custom\uia_plus_profile\%~nx0" ("%SVAgent%\Config\Custom\uia_plus_profile\%~nx0")

• A Writable Volume move or copy operation might fail when bulk operations are performed on many volumes. [2115593]

  Workaround: Retry the move or copy operation.

App Volumes Documentation

• For information about how to install, deploy, and upgrade Omnissa App Volumes, see Omnissa App Volumes Installation Guide.
• For information about how to configure and use Omnissa App Volumes, see Omnissa App Volumes Administration Guide.

Omnissa App Volumes documentation is available at Omnissa Product Documentation.

Internationalization

App Volumes content is available only in English.

Support Contact Information

To receive support, access Customer Connect.

To file a Support Request in Customer Connect and via Cloud Services Portal, see How to file a Support Request in Customer Connect and via Cloud Services Portal -6000005.

Original source

With Horizon Client for Android, users can connect to and use remote desktops and published applications using an Android phone or tablet. Horizon Client for Android also supports Samsung Dex and Zebra devices.

IMPORTANT NOTICE: Changes to Support Lifecycle Dates

Effective with Horizon Client version 2606, the End of Availability (EOA), End of General Support (EOGS), and End of Technical Guidance (EOTG) milestones for this client changed from the previous policy to the policy shown below.

Note: The support policy for versions before 2606 remains unchanged.

Milestone Previous Policy Policy from 2606 Onwards EOA / EOGS GA + 36 months GA + 18 months EOTG EOGS + 12 months EOGS + 12 months (unchanged)

What’s New

Horizon Client for Android 2606 is released along with Horizon 8 2606.

• Blast Networking - Open SSL 3.5 Upgrade

Horizon components have been updated to use OpenSSL 3.5, replacing the previous OpenSSL 3.0.x libraries which are approaching end of life. This includes the Blast Secure Gateway (BSG) for both Connection Server and Unified Access Gateway (UAG).

Before You Begin

• Horizon Client for Android is supported with the following deployment types:
  • Horizon 8 version 2006 and later
  • Horizon Cloud in Microsoft Azure
  • Horizon Cloud Service - next-gen
• Horizon Client for Android requires the Android 14, 15, or 16 operating systems.
• When you install Horizon Client for Android, you are prompted to let the app read phone status and identity. This prompt relates to the RSA soft-token integration feature. The prompt is requesting permission to read the state of the phone. This permission does not allow the app to make a phone call or send a message. You can safely grant this permission.
• Install and upgrade Horizon Client for Android just as you do any other Android app. For example, you can get the latest version of the app from Google Play or the Amazon Appstore for Android. For a link to the Horizon Client app in one of these stores, go to the Horizon Client Downloads page.

Resolved Issues

There are no resolved issues in this release.

Known Issues

The following sections describe known issues related to the operation and performance of Horizon Client for Android.

For known issues specific to the use of Horizon Client in a Horizon Cloud Service - next-gen environment, see the Horizon Cloud Service - next-gen Release Notes.

• Android Dex multi-monitor mode does not work

  Applications are unable to display windows on both the Device screen and the Dex screen at the same time. This occurs on all Android 14 phones with the latest updates.

  Workaround: None.

• User input displays on suggestion bar of keyboard when using Horizon Screen Keyboard to enter letters or numbers in the password input box of the Windows Lock screen.

  Workaround: There are two ways to address this issue.

  • Disable Predictive Text on mobile device settings, or
  • Switch to Direct Touch mode and enable Windows Native Touch Gestures in Client Settings. Wait for the Windows keyboard to automatically pop up and then use the Windows keyboard for password input.

• When the Samsung DeX “New” view mode is selected, the Android taskbar will only display the Horizon client main window.

  When this problem occurs no remote session window displays on the taskbar. Any minimized session windows cannot be restored and are therefore inaccessible.

  Workaround: None.

• On certain Android devices, when you use the client drive redirection feature to copy, rename, or create files on a redirected external SD card, you receive the error “You need permission to perform this action.”

  This problem occurs if the Android device prevents third-party apps from getting automatic permission to put files on an external SD card.

  Workaround: None.

• If you use a NAT64 network that is shared from a macOS 10.14 or later system, internet access is not available on an Android device and Horizon Client for Android cannot connect to a server.

  Workaround: Use an earlier macOS version to share the NAT64 network, for example, use macOS version 10.11.6.

• When you connect to a remote desktop with the High Quality Mode option enabled, if you change the resolution from the Auto-fit resolution option to another resolution in the Horizon Client settings, and then change the resolution back to the Auto-fit resolution option, Horizon Client uses the wrong resolution.

  Workaround: Log off and reconnect to the remote desktop.

• When you use the Horizon Blast display protocol to connect to a remote desktop or published application with a non-English input method, you might not be able to enter certain symbols.

  Workaround: Use the local input buffer, or connect to the remote desktop or published application with the PCoIP display protocol.

• On some Android devices, certain keys introduce white spaces when you connect to a remote desktop and input text with Horizon Client.

  Workaround: Turn off predictive text for the keyboard in the Android Settings app.

• The Unity Touch sidebar cannot show changes in the All Programs menu for new software that you install during that same session.

  Workaround: To see items for new software that you recently installed, disconnect from the desktop and then connect again.

• Because an Android device does not have a persistent ID, the device’s MAC address is used to generate an ID for the license. If a device’s MAC address cannot be detected, its SIM is used instead. If neither the MAC address nor SIM can be detected, a random ID is generated for the device. In certain circumstances, this process can result in multiple licenses being issued to the same device.

  Workaround: An administrator can remove the inactive licenses.

Documentation

Horizon Client for Android documentation is in the Omnissa Product Documentation portal.

Localized Content for Omnissa Docs

For details on Omnissa’s localization strategy, see Announcing Omnissa Localization Support.

Support Contact Information

To receive support and learn more about support policies, see Omnissa Customer Connect.

For information on filing a support request in Customer Connect and via Cloud Services Portal, see KB 6000005.

Original source