Service Integration

VMware Workspace ONE® UEM

X

X

X

Workspace ONE Access™

X

X

X

AirWatch Cloud Connector

X

X

X

Workspace ONE Access Connector

X

X

Adaptive management

X

Device enrollment

X

X

Native mobile apps

X

X

X

SaaS apps

X

X

X

Unified app catalog

X

X

X

Mobile email management

X

Mobile content management

X

DLP restrictions

X

X

Secure browsing

X

Mobile SSO

X

X

X

Conditional access

X

X

VMware Horizon® or VMware Horizon® Cloud Service™

X

VMware Unified Access Gateway™

X

Adaptive management

Adaptive management enables applications such as WebEx and Concur to be used with mobile SSO across all platforms without device enrollment. Other applications, such as HR sites, ADP, or Salesforce, require device enrollment to have a high degree of control over the device.

Users are encouraged to download the Workspace ONE app from a public app store.

Applications that are deemed to have a higher risk to user or company data are set to require management in the VMware Workspace ONE® UEM device profile.

Active Directory – cloud password authentication

Workspace ONE Access is configured with a policy to use the cloud password from the built-in identity provider and authenticate through the Workspace ONE Access Connector to the Active Directory account.

Email access

Users are provided appropriate documentation on how to configure their device for native or third-party email client access.

If users choose to install Workspace ONE Boxer, their email configuration is automatically pushed to the device. Typically, users are provided with the Exchange ActiveSync Server address (outlook.office365.com) and their email address and password.

Enrollment

Enrollment is completed through the Workspace ONE application. If a user attempts to access an application that has been deployed as one that requires management in Workspace ONE UEM, the enrollment process is initiated.

After enrollment in Workspace ONE, end users have all applications available to them. They can also use mobile SSO after they have enrolled because they have a device profile. This profile deploys the appropriate payloads to authenticate using the appropriate SSO technology.

Additional compliance information is passed to Workspace ONE Access. If the device is no longer in compliance, the user loses access to the applications provided by Workspace ONE Access.

Device enrollment

All devices in the Enterprise Productivity service are required to enroll using the Workspace ONE Intelligent Hub. These devices are likely to have valuable enterprise data on them and so require a higher level of control and security.

Email restrictions

Native and third-party email apps are blocked, and all users use Workspace ONE Boxer for increased security.

Content access

VMware Workspace ONE® Content is pushed to the device and configured for secure access to corporate repositories.

Secure browsing

VMware Workspace ONE® Web is pushed to the device to ensure that links to intranet sites are always opened in a secure browser.

Email access

Email and content are delivered from Microsoft Office 365, so federation with the Microsoft Office 365 service is enabled to allow SSO to the Office service and native mobile Microsoft Office 365 apps.

Data loss prevention

DLP components are enabled within Workspace ONE Content and Workspace ONE Boxer to prevent the use of unapproved applications, ensuring that data cannot be inadvertently or purposely copied and pasted into other apps.

Federation to Microsoft Office 365

Workspace ONE Access uses the Microsoft Federated Identity approach to authenticate login requests to the Microsoft Office 365 service.

For information about this configuration, see the following resources:

• The Workspace ONE Access and Microsoft Azure with Office 365 Integration video
• Configure Office 365 as a Federated Domain for Single Sign-On and Changing Office 365 Parameters to Workspace in Workspace ONE Access Integration with Office 365

Enable federation in the Microsoft Office 365 or Microsoft Azure AD portals

Sync Active Directory user accounts through the Microsoft Azure AD or Microsoft Office 365 portal.

Use PowerShell scripting to configure the Microsoft Office 365 service to authenticate through Workspace ONE as a federated identity provider. A set of PowerShell scripts with appropriate parameters and signing certificates establish trust between Microsoft Office 365 and Workspace ONE Access.

Note: An important criterion to make Microsoft Office 365 integration work is ensuring that the attribute ObjectGUID is synced from AD to the Workspace ONE Access service.

Configure Microsoft Office 365 apps in Workspace ONE Access

Using the templates in the Cloud Application Catalog, configure the Microsoft Office 365, WS-fed based template to allow authentication against Workspace ONE Access for Microsoft Office 365-based apps and resources, such as email, SharePoint Online, Skype for Business, and other Microsoft Services.

Email integration with Microsoft Office 365 through PowerShell

Workspace ONE UEM issues commands through PowerShell to Exchange in Microsoft Office 365. Devices communicate directly with Exchange ActiveSync in the Microsoft Office 365 service.

For full configuration information, see Integrating PowerShell with Workspace ONE.

PowerShell Roles in Office 365

PowerShell requires specific roles to be established in the Microsoft Office 365 administration portal for Exchange. These roles enable the execution of PowerShell cmdlets from Workspace ONE UEM to the Microsoft Office 365 service.

Blocking and quarantine rules

To prevent unauthorized devices from connecting to the Exchange server, you can block or quarantine devices until they have enrolled. PowerShell commands are used to set the appropriate policy. These rules are not needed for environments where enrollment is not required.

Email compliance policies

Compliance policies for email include a range of options for controlling managed and unmanaged devices:

• Must the device be enrolled to perform email sync?
• Which email clients are allowed to sync email?
• Is device encryption required for email sync?
• Are jail-broken or otherwise compromised devices allowed?

ActiveSync profiles for email clients

To enable email sync, you must configure the Exchange ActiveSync payload for the device profiles. The hostname for Microsoft Office 365 is typically outlook.office365.com.

The domain, username, and email address are configured with lookup values. Make sure that these values are available in the directory and are properly mapped from AD through the AirWatch Cloud Connector (ACC).

Content integration with Microsoft Office 365

Integration is established through the Workspace ONE UEM Console under the Content node.

From here, you configure templates for the SharePoint libraries in Microsoft Office 365, to sync to the mobile devices.

For more information see Corporate File Servers.

Office 365 SharePoint document libraries

Use https://portal.office.com to log in to Microsoft Office 365 and create SharePoint sites with document libraries containing content.

Content templates in Workspace ONE UEM for automatic deployment

To create these templates:

In the Workspace ONE UEM Console, access the Content node, select Templates, and then select Automatic.

• Configure SharePoint Office 365 as the repository type.
• Configure the Link field with the path to the SharePoint document library. For example, https://<domain>.sharepoint.com/Sales_Material/Shared%20Documents
• Enable Allow Write if read/write access is needed.
• If content is synced, choose Allow Offline Viewing.
• If content is used with other apps, select Allow Open in Third Party Apps.
• Review other security settings per your enterprise policy.
• Assign appropriate groups to the repository.

For more information, see the Enable End-User Access to Corporate File Server Content section in Corporate File Servers.

Workspace ONE Content

To ensure access to content, require that Workspace ONE Content be automatically deployed to groups who use SharePoint.

DLP configuration on a global basis

You can set DLP configuration on a global basis, platform basis, or per application deployment.

For DLP settings to take effect, the application must be built with the VMware Workspace ONE® Software Development Kit (SDK), or, for an internal application, DLP settings must be supported through app wrapping.

Workspace ONE Boxer, Workspace ONE Content, and Workspace ONE Web are built using the Workspace ONE SDK and honor the settings chosen.

SDK profile defaults for iOS or Android

SDK profiles allow global configuration of DLP settings that are applied to applications on the platform for which the profile is defined. Policy settings include enabling or disabling:

• Printing
• Composing email
• Location services
• Data backup
• Camera
• Watermarking
• Ability to open documents in certain apps
• Copy and paste in and out
• Third-party keyboards

Custom policies for Workspace ONE Content and Workspace ONE Boxer

Workspace ONE Content can use the default policies defined in the SDK profile, or defaults can be overridden by enabling custom policies. Requiring MDM (mobile device management) enrollment ensures that content is accessed only by enrolled devices.

Email compliance policies

When configuring Workspace ONE Content policies, verify that the email compliance policies match corporate standards, including whether devices must be enrolled in device management to receive email.

Workspace ONE UEM compliance

Create a compliance policy for the appropriate platforms through the Workspace ONE UEM Console. Criteria for evaluation can include jail-broken or rooted devices, devices that have not checked in to the Workspace ONE UEM environment in a certain period of time, or the installation of denylisted applications.

The policy can include an escalation of notifications as actions, starting with an email notification to the user, followed by an email notification to an administrator, and ultimately blocked access to email if the device is not remediated in time.

Workspace ONE Access compliance

Workspace ONE Access compliance checking is enabled through policy configuration. Policies include device compliance with the Workspace ONE UEM authentication adapter and other authentication methods, such as a password.

You can use the policies in conjunction with network ranges, OS platforms, or specific applications, allowing varying requirements to evaluate whether an application can launch based on the location of the user, which device they are using, and how they are authenticating.

Workspace ONE Access Connector

The connector component of Workspace ONE Access is installed and runs as a service on a Windows server.

The connector integrates with your enterprise directory to sync users and groups to the Workspace ONE Access service and to provide authentication.

Horizon entitlements

Entitlements are enabled through the Workspace ONE Access catalog by connecting to Horizon pods or Horizon Cloud tenants that expose user-entitled apps and desktops.

The Horizon-based services that facilitate these entitlements are described separately, in the following sections of this guide: Horizon 8 Use Case Service Integration and Horizon Cloud on Microsoft Azure - first-gen Use Case Service Integration.

VMware Unified Access Gateway

This component enables external VMware Horizon® Client™ devices to securely access Horizon resources for virtual apps and desktops.

Workspace ONE Access Connector deployment

The connector can be deployed either on-premises or in any data center that has a line of sight to Active Directory domain controllers. Instructions for deploying the connector are given in Installing VMware Workspace ONE Access Connector 22.09.

Directory sync

After the connector is deployed, directory synchronization is performed to sync Active Directory users and groups with the Workspace ONE Access service. For more information, see Directory Integration with VMware Workspace ONE Access.

Access to Horizon desktops and applications in the Workspace ONE app catalog

To make Horizon resources available in the Workspace ONE app, you create one or more virtual apps collections in the Workspace ONE Access administration console. The collections contain the configuration information for the Horizon pods, as well as sync settings.

See Providing Access to VMware Horizon Desktops and Applications in Workspace ONE Access and Using SAML Authentication for VMware Workspace ONE Access Integration.

User entitlements for apps and desktops are made available through the Horizon configuration and automatically appear in the Workspace ONE app and in a web browser.

Access to Horizon from external devices

To access the resources made available through Horizon, you must establish a means of access from Internet-based devices.

You can configure Unified Access Gateway and optionally True SSO to allow egress and provide connectivity to the Horizon pods.

See Deployment with Horizon and Horizon Cloud with On-Premises Infrastructure in the Unified Access Gateway documentation.

Access to Horizon Cloud desktops and applications in the Workspace ONE app catalog

To make Horizon Cloud resources available in the Workspace ONE app, you create one or more virtual apps collections in the Workspace ONE Access administration console. The collections contain the configuration information for the Horizon Cloud tenants, as well as sync settings.

See Integrating the Environment's Horizon Cloud Pods in Microsoft Azure with Workspace ONE Access and Providing Access to VMware Horizon Cloud Service Desktops and Applications in Workspace ONE Access.

User entitlements for apps and desktops are made available through the Horizon Cloud configuration and automatically appear in the Workspace ONE app and in a web browser.

Access to Horizon Cloud from external devices

To access the resources made available through Horizon Cloud, you must establish a means of access from Internet-based devices.

You can configure Unified Access Gateway along with True SSO to allow egress and provide connectivity to the Horizon Cloud pods.

Unified Access Gateway appliances can be automatically deployed in external or internal configurations.

See Add a Gateway Configuration to a Deployed Horizon Cloud Pod.

Horizon Client native app

When Horizon resources are used in Workspace ONE, the resources appear on the Launcher page of the app, but the resources launch using the Horizon Client native mobile app.

Windows 11 or 10 instant clone

X

X

X

RDSH instant clone

X

X

Linux instant clone

X

VMware App Volumes™ package

X

X

X

X

X

App Volumes writable volume

X

X

VMware Dynamic Environment Manager™

X

X

X

X

X

Smart Policies

X

X

X

X

X

X

Application blocking

X

X

X

X

Folder redirection

X

X

X

X

X

GPO

X

X

X

X

X

Virtual printing

X

X

X

X

X

ThinApp Packages

X

X

X

X

X

SaaS apps

X

X

X

Unified Access Gateway

X

X

X

X

X

X

True SSO

X

X

X

X

X

vGPU

X

X

VMware NSX® Firewall

Optional

Windows Server golden image VM

Build a Windows Server VM using the guidelines in Manually Creating Optimized Windows Images for VMware Horizon VMs.

Automated RDSH farm

Create a Horizon 8 RDSH automated farm using the prepared golden image VM. See Creating and Managing Farms.

For details on the specific settings to use, see the Horizon Installation and Configuration section in Horizon Configuration.

Overview

Create packages as required to address the use cases.

With RDSH instant clones, App Volumes saves us from needing to install the same apps on each node. We assign the package containing the core software programs so that each RDSH instant-clone server has the same software program set for publishing.

Packaging machine

Because the packages are created for an RDSH server, each package should be captured on the same operating system to ensure that applications are compatible with the OS that they are being attached to.

Core applications

Create a package to contain all core software programs to be delivered as RDSH-published apps. Follow the instructions in Working with Applications for details.

These package-delivered apps are published through RDSH.

Assign and entitle the packages to an Active Directory OU containing the RDSH server machine accounts—these are machine-based assignments. Note: OU-based assignments are not required but ensure that packages are available as soon as new hosts in an RDSH farm are provisioned.

Application pool

Use the Horizon 8 Administrator console to add an application pool and publish the desired applications. See Creating Application Pools.

Entitle the relevant user groups to the matching published applications.

Environment settings

Map the H: drive to the users’ home drive with Dynamic Environment Manager.

Map location-based printers with Dynamic Environment Manager, according to the IP address range.

Personalization – applications

Verify that Dynamic Environment Manager Flex configuration files are created and configured properly for each application that allows users to save preference settings.

Verify that each application that persists user settings across sessions has a Dynamic Environment Manager Flex configuration file.

If a Dynamic Environment Manager Flex configuration file does not exist, use the Application Profiler to create one and place it in the configuration share. See Introduction to VMware Dynamic Environment Manager Application Profiler to get started.

Folder redirection

Folder redirection is configured from Dynamic Environment Manager, which redirects user profile folders to a file share so that user data persists across sessions. See the Horizon Group Policies section in Horizon Configuration.

Smart Policies

Leverage Horizon Smart Policies to apply the Internal Horizon Smart Policy profile, which allows USB, copy and paste, client-drive redirection, and printing. See the Horizon Smart Policies section in Dynamic Environment Manager Configuration.

Windows Server golden image VM

Build a Windows Server VM using the guidelines in Manually Creating Optimized Windows Images for VMware Horizon VMs.

Prepare the golden image VM to use NVIDIA GRID vGPU.

See Configuring 3D Rendering Options for Instant-Clone Pools and the NVIDIA vGPU Deployment Guide for VMware Horizon 7.x on VMWARE 7.x vSphere 6.7.

Automated RDSH farm

Create a Horizon 8 RDSH automated farm using the prepared golden image VM. See Creating an Automated Instant-Clone Farm.

At farm creation, chose NVIDIA GRID vGPU as the 3D Renderer option. The clones will use the same graphics profile that was selected during golden image VM creation.

For details on the specific settings to use, see the RDS Farm Settings section in Horizon Configuration.

Application pool

Use the Horizon Administrator console to add an application pool and publish the desired applications. See Creating Application Pools.

Entitle the relevant user groups to the matching published applications.

Overview

With Horizon 8 Published Apps on Demand, App Volumes saves us from needing to install the apps into the RDSH farm and allows the farm to deliver many differing use cases and sets of applications.

We register the App Volumes Manager instance with the Horizon pod and associate it with target RDSH farms.

Application packages are attached to a target RDSH server in real-time, as a user requests the application.

Packaging machine

Create application packages as required to address the use cases.

Because the packages are created for an RDSH server, each package must be captured on the same operating system to ensure that applications are compatible with the OS that they are being attached to.

Integrate App Volumes with Horizon

1. Creating an Automated Instant-Clone Farm.
2. Register the App Volumes Managers in the Horizon Console.
3. Associate App Volumes Manager with a Farm.
4. Add Applications and entitle users.

Windows 11 or 10 golden image VM

Build a Windows 11 or 10 VM using the guidelines in Manually Creating Optimized Windows Images for VMware Horizon VMs.

Automated desktop pool

Create a Horizon 8 automated instant-clone desktop pool using the prepared golden image VM. See Create an Instant-Clone Desktop Pool.

Use the specific pool settings from Horizon Configuration.

Entitle users by adding the appropriate AD group or groups.

Core applications

Create a package to contain all core software programs. See the instructions in Working with Applications for details.

Assign and entitle the package to an AD group.

Departmental applications

Create a package for each department containing software programs unique to them.

Assign and entitle relevant user groups to their matching departmental package.

Smart Policies

Mobile knowledge worker:

• Internal location: Apply an internal Horizon Smart Policy.
• External location: Apply an external Horizon Smart Policy.

Contractors: Apply the restrictive zContractor Horizon Smart Policy at all times.

Note: Smart Policies are evaluated in alphabetical order. Adding the z character before Contractor places the policy name at the bottom of the sort group.

For examples, see the section Horizon Smart Policies in Dynamic Environment Manager Configuration.

Application blocking

Leverage application blocking in Dynamic Environment Manager to block the following program files:

Cmd.exe

Group policies

No specific group policies.

Core applications

Create a package to contain all core software programs. See the instructions in Working with Applications for details.

Assign and entitle the package to an AD group.

Departmental applications

Create a package for each department containing unique applications for that department.

Assign and entitle relevant user groups to their matching departmental package.

Writable volumes

Create writable volumes for each user (or for the user group) entitled to this desktop pool.

See Working with Writable Volumes.

We used the User-Installed Applications (UIA) template to create the writable volumes. This writable volume type can capture any user-installed application and persist the application across user sessions.

See Configuring Storage for more information about writable volume template options.

Smart Policies

Software developer:

• Internal location: Apply an internal Horizon Smart Policy.
• External location: Apply an external Horizon Smart Policy.

IT (power user):

• Internal location: Apply an internal Horizon Smart Policy.
• External location: Apply an external Horizon Smart Policy.

See the section Horizon Smart Policies in Dynamic Environment Manager Configuration.

Application blocking

No application blocking settings.

Group policies

No specific group policies.

Windows 11 or 10 golden image VM

Build a Windows 11 or 10 VM using the guidelines in Manually Creating Optimized Windows Images for VMware Horizon VMs.

Prepare the golden image VM to use NVIDIA GRID vGPU. See Configuring 3D Rendering Options for Instant-Clone Pools.

Automated desktop pool

Create a Horizon 8 automated instant-clone desktop pool using the prepared golden image VM. See Create an Instant-Clone Desktop Pool.

At pool creation, chose NVIDIA GRID vGPU as the 3D Renderer option. The clones will use the same graphics profile that was selected during golden image VM creation.

Use the specific pool settings from the Desktop Pool Settings section in Horizon Configuration.

Entitle users by adding the appropriate AD group or groups.

Smart Policies

Multimedia Designer:

• Internal location: Apply an internal Horizon Smart Policy.
• External location: Apply external Horizon Smart Policy.

For examples, see the section Horizon Smart Policies in Dynamic Environment Manager Configuration.

Application blocking

No application blocking settings.

Group policies

No specific group policies.

Linux golden image VM

Follow the instructions in Preparing a Linux Virtual Machine for Desktop Deployment.

Install applications

Install all required applications on the golden image VM.

Domain join

Follow the instructions in Setting Up Active Directory Integration and User Authentication Features for Linux Desktops.

3D rendering (optional)

Follow the instructions in Setting Up Graphics for Linux Desktops.

Horizon Agent

Follow the instructions in Installing Horizon Agent.

Configuration options (optional)

Follow the instructions in Setting Options in Configuration Files on a Linux Desktop.

Desktop pool

Follow the instructions in Creating and Managing Manual Linux Desktop Pools to create the desired type of desktop pool.

Linux golden image VM

Follow the instructions in Preparing a Linux Virtual Machine for Desktop Deployment.

Windows 10 clone

X

RDSH clone

X

X

VMware Dynamic Environment Manager

X

X

X

Smart Policies

X

X

X

Application blocking

X

X

Folder redirection

X

X

X

GPO

X

X

X

Virtual printing (ThinPrint)

X

X

X

ThinApp Packages

X

X

Unified Access Gateway

X

X

X

True SSO

X

X

GPU

X

Windows Server golden image VM

Build a Windows Server VM. See the latest VMware Horizon Cloud Service on Microsoft Azure Release Notes for a list of supported operating systems.

You can build the golden image VM automatically, by using an import process from the Azure Marketplace, or you can build the VM manually.

For details on creating and customizing a golden image VM, as well as publishing an image, see Creating Desktop Images and Your Horizon Cloud Pods in Microsoft Azure.

Automated RDSH farm

Create a Horizon Cloud on Microsoft Azure - first-gen automated RDSH server farm using the published image.

For details, see Farms in Horizon Cloud.

Overview

After the farm of RDSH servers is created, you add applications from the farm to the Horizon Cloud inventory. After the applications are in the inventory, remote application assignments can be created to entitle end users to the applications.

Adding and assigning applications

From the Horizon Cloud Inventory tab, add new applications. You can import applications automatically, by performing an auto-scan from farm operation, or you can add them manually.

After applications are added to the Horizon Cloud inventory, create application assignments to entitle users and groups to the applications.

See Applications in Your Horizon Cloud Inventory.

Environment settings

Map the H: drive to the user’s home drive with Dynamic Environment Manager.

Map location-based printers with Dynamic Environment Manager, according to the IP address range.

Personalization – applications

Verify that Dynamic Environment Manager Flex configuration files are created and configured properly for each application that allows users to save preference settings.

Verify that each application that persists user settings across sessions has a Dynamic Environment Manager Flex configuration file.

If a Dynamic Environment Manager Flex configuration file does not exist, download a configuration file template from the VMware Marketplace, or use the Application Profiler to create one and place it in the configuration share.

Folder redirection

Folder redirection is configured from Dynamic Environment Manager, which redirects user profile folders to a file share so that user data persists across sessions.

See Configure Folder Redirection.

Smart Policies

Leverage Horizon Smart Policies to apply the Internal Horizon Smart Policy profile, which allows USB, copy and paste, client-drive redirection, and printing.

See Using Smart Policies.

For policy examples, see the section Horizon Smart Policies in Dynamic Environment Manager Configuration.

Windows Server golden image VM

Build a Windows Server VM. See the latest VMware Horizon Cloud Service on Microsoft Azure Release Notes for a list of supported operating systems.
Note: Windows Server 2012 R2 limits the maximum number of sessions and is not recommended.

You can build the golden image VM automatically, by using an import process from the Azure Marketplace, or you can build the VM manually.

For details on creating and customizing a golden image VM, as well as publishing an image, see Creating Desktop Images and Your Horizon Cloud Pods in Microsoft Azure.

GPU enable golden image VM

If you create a golden image VM with a GPU, you must log in to the VM’s Windows operating system and install the supported NVIDIA graphics drivers to get the GPU capabilities of that VM. You install the drivers after the VM is created and after the Imported VMs page shows the agent-related status as active.

See Install the Appropriate GPU Driver in Your Imported GPU-Capable VM for details on creating and customizing a golden image VM with NVIDIA GPU.

Automated desktop pool

Create a Horizon Cloud on Microsoft Azure - first-gen automated RDSH server farm using the published image.

For details, see Farms in Horizon Cloud.

Smart Policies

For the multimedia designer use case:

• Internal location: Apply an internal Horizon Smart Policy.
• External location: Apply an external Horizon Smart Policy.

For more information, see Using Smart Policies.

Application blocking

Do not use application-blocking settings.

Windows 10 golden image VM

Build a Windows desktop VM. See the latest VMware Horizon Cloud Service on Microsoft Azure Release Notes for a list of supported operating systems.

You can build the golden image VM automatically, by using an import process from the Azure Marketplace, or you can build the VM manually.

For details on creating and customizing a golden image VM, as well as publishing an image, see Creating Desktop Images and Your Horizon Cloud Pods in Microsoft Azure.

Whether you create the VM automatically or manually, consider optimizing Windows to provide the best user experience. See Manually Creating Optimized Windows Images for VMware Horizon VMs.

Desktop assignment

Create a Horizon Cloud desktop assignment from the published image. See A Brief Introduction to Your Tenant's Desktop Assignments Based on Horizon Cloud Pods in Microsoft Azure.

Smart Policies

For the mobile knowledge worker use case:

• Internal location: Apply an internal Horizon Smart Policy.
• External location: Apply an external Horizon Smart Policy.

For the contractor use case: Apply the restrictive zContractor Horizon Smart Policy at all times.

Note: Smart Policies are evaluated in alphabetical order. Adding the z character before Contractor places the policy name at the bottom of the sort group. For examples, see the section Horizon Smart Policies in Dynamic Environment Manager Configuration.

Application blocking

Leverage application blocking in Dynamic Environment Manager to block executables such as Cmd.exe.

Workspace ONE UEM

X

X

Workspace ONE Access

X

X

Windows instant clone

X

X

RDSH instant clone

X

X

Windows full clone

X

App Volumes package

X

X

App Volumes writable volume

X

Dynamic Environment Manager

X

X

X

Folder redirection

X

X

X

Storage replication (active/active)

X

X

vSAN stretched cluster

X

Load balancing 

Verify both global and local load balancing are functional.

Golden image VM 

Build out a golden image VM image in Site 1 to meet requirements.

Replicate the golden image VM image to Site 2.

Create pools or farms 

For desktops, create identical desktop pools in both sites based on the golden image VM.

For RDSH-published applications: 

• Create RDSH server farms in both sites using the golden image VM. 
• Add application pools in both sites containing the required applications. 

Cloud Pod Architecture 

Set up and initialize Cloud Pod Architecture between the two sites.

• Create sites and assign the pods to their respective sites. 
• Create global entitlements. 
• Associate pools from both sites. 

See the Cloud Pod Architecture section in VMware Horizon Configuration for detail.

File shares 

Create three file shares on the file server in Site 1 and set the relevant permissions.

• Dynamic Environment Manager IT configuration 
• Dynamic Environment Manager user settings 
• Home file shares for redirected folders (optional) 

Set up DFS-Namespace following the guidance given in Environment Infrastructure Design.

User placement 

Decide where a given named user is initially placed (Site 1 or Site 2).

Map a user to a GPO that matches that placement from a Dynamic Environment Manager perspective.

Verify profile creation and functionality by performing a login with a user.

App Volumes installation 

Set up two App Volumes Managers in Site 1.

Set up two App Volumes Managers in Site 2.

See App Volumes Architecture for details.

Load balancing 

Configure local load balancing within each site with a virtual IP (VIP) for the local App Volumes Managers.

Point the App Volumes agent in the golden images to their respective VIP based on their site.

Multi-instance Management

Setup a source and target relationship between the App Volumes instance in Site 1 and Site2. Site 1 will be the source instance of App Volumes and Site 2 will be the first target instance.

1. Using the App Volumes admin console for the Site 1 instance, add the Site 2 instance as a target instance. See Register an App Volumes Instance as a Target.
2. Select to enable application package import, synchronize markers, and synchronize assignments.

Review the full instructions in Multi-Instance Configuration.

Storage groups 

Set up an App Volumes storage group in Site 1.

• Select all datastores to be used for packages. 
• Additionally, select one common datastore to be used to replicate packages between sites. NFS is a good choice for this datastore.
• Select to Automatically Replicate AppStacks and Packages.
• Do not select Automatically Import AppStacks and Packages.
• Mark the common datastore as non-attachable. 

Create another storage group for the App Volumes instance in Site 2 using the same settings but with the Site 2 datastores.

Packages

Working In the source App Volumes instance, Site 1.

• Create packages as required to address the use cases. Follow the instructions in Working with Applications.
• Place the packages in the local storage group to allow them to replicate to every datastore in the local storage group and also to the other site.
• Create user or group assignments to the applications.

Writable volumes (optional) 

Create a writable volume for each user who requires one. Follow the instructions in Working with Writable Volumes.

Place writable volumes on dedicated LUNs, which can later be configured to be protected using storage replication.

Load balancing 

Verify both global and local load balancing are functional.

Golden image VM 

Build out a golden image VM image in Site 1 to meet requirements.

Replicate the golden image VM image to Site 2.

Create pool or farm 

For desktops, create identical desktop pools in both sites based on the golden image VM.

For RDSH-published applications: 

• Create RDSH server farms in both sites using the golden image VM. 
• Add application pools in both sites containing the required applications. 

Cloud Pod Architecture 

Set up and initialize Cloud Pod Architecture between the two sites.

• Create sites and assign the pods to their respective sites. 
• Create global entitlements. 
• Associate pools from both sites. 

File shares

Create three file shares on the file server in Site 1 and set the relevant permissions.

• Dynamic Environment Manager IT configuration 
• Dynamic Environment Manager user settings 
• Home file shares for redirected folders (optional) 

Set up DFS-Namespace following the guidance given in Environment Infrastructure Design.

User placement 

Decide where a given named user is initially placed (Site 1 or Site 2).

Map a user to a GPO that matches that placement from a Dynamic Environment Manager perspective.

Verify profile creation and functionality by performing a login with a user.

Create a golden image VM 

Build a golden image VM in Site 1 to meet your requirements. Follow the instructions in Horizon Cloud on Microsoft Azure - first-gen Use Case Service Integration.

Build an equivalent golden image VM image in Site 2.

Create desktops assignments or farms 

For desktops, create identical desktop assignments in both sites based on the golden image VM.

For RDSH-published applications: 

• Create RDSH server farms in both sites using the golden image VM. 
• Add application pools in both sites containing the required applications. 

File shares 

1. Create the following three file shares on the file server in region 1 and set the relevant permissions:
   1. Dynamic Environment Manager IT configuration 
   2. Dynamic Environment Manager profile archive 
   3. Home file shares for redirected folders (optional) 
2. Set up three equivalent file shares in a separate location, such as region 2.
3. Configure DFS replication and namespaces.

Refer to the Multi-site Design section of Dynamic Environment Manager Architecture for considerations on setting up DFS-Replication and DFS-Namespace.

2023-07-26

• Added this Summary and Additional Resources section to list changelog, authors, and contributors within each design chapter.

2023-02-24

• Added new section on Horizon Published Apps on Demand Service.
• Updated for clarity; updated links and references.

2020-03-10

• Removed mention of Windows mandatory profiles. This feature does not work reliably when used with Windows 10 version 1809 and later.