Limited Availability: Configure Horizon Agent, Horizon Console, Permissions, and Features

Configure Horizon Agent for macOS

After installation, modify Horizon Agent configuration settings.

Horizon Agent Configuration File

Horizon Agent for macOS stores its configuration at:

/private/etc/omnissa/horizonagent-config.txt

Edit this file to adjust agent settings. Restart the Horizon Agent service after making changes for them to take effect.

Restart the Horizon Agent Service

To restart the Horizon Agent service:

sudo launchctl stop com.omnissa.horizon.coreagent
sudo launchctl start com.omnissa.horizon.coreagent

To check the current status of the agent service:

sudo launchctl list | grep omnissa

Configure Blast Settings

Horizon Agent for macOS uses Horizon Blast Extreme exclusively. PCoIP is not supported.

Note: Group Policy is a Windows-only mechanism and is not applied on macOS. Do not configure Blast protocol settings through Horizon Agent group policy settings on a Mac Agent machine.

Blast protocol settings for macOS — including codec preferences, encoder behavior, frame rate, and bandwidth — are configured through the Horizon Agent configuration file. The Blast configuration entries used for Horizon Agent for macOS are the same entries used for Horizon Agent for Linux. For the list of Blast configuration options and example values tuned for different network types, see Example Blast Settings for Linux Desktops.

Configure Display Settings

Horizon Agent for macOS supports up to 2 monitors. Horizon Client and Horizon Agent negotiate display resolution and multi-monitor behavior during session establishment. No additional agent-side configuration is required for standard multi-monitor operation.

Configure macOS Privacy and Security Permissions for Horizon Agent

macOS requires explicit user or administrator approval for privacy and security permissions that Horizon Agent requires for remote session functionality.

The following privacy and security permissions must be configured on the Mac Agent machine. Each permission must be granted to the corresponding Horizon Agent application.

Approve Permissions Manually on Unmanaged Devices

On machines that are not enrolled in an MDM solution, the macOS user must manually approve each permission:

1. Open System Settings > Privacy & Security.
2. For each permission category in the table above, locate the Omnissa Horizon Agent entry and enable the toggle.
3. When prompted, click Quit & Reopen to restart the agent process.
4. Repeat for each permission.

Note: Without these permissions, Horizon Agent cannot function. Users will be prompted to approve permissions during their first Horizon login session if they are not pre-configured.

In production environments enrolled in Workspace ONE UEM, Jamf, or Microsoft Intune, administrators can pre-configure and push all required permissions through MDM profiles before users connect. This approach eliminates manual user approval prompts entirely. For configuration steps, see Manage macOS Permissions with MDM.

Configure macOS Machines in Horizon Console

Add physical macOS machines to Horizon Console and assign them to a manual desktop pool before making them available to end users

Add Physical macOS Machines

1. In Horizon Console, navigate to Settings > Registered Machines > Others to view the registered macOS machine.
2. Alternatively, the same details are also available under Inventory > Machines > Others.
3. Confirm the machine appears with the expected status after registration.

Create a Manual Desktop Pool

Horizon Agent for macOS requires a manual desktop pool. Automated and instant-clone pools are not supported:

1. In Horizon Console, navigate to Inventory > Desktop Pools.

2. Click Add.

3. Select Manual Desktop Pool.

4. Select Others as the machine source.

5. Configure pool settings, including the Remote Display Protocol (select Horizon Blast).

6. Select the macOS machine registered with the broker.

   Note: PCoIP is not supported for macOS desktops. Connections using PCoIP will fail.

7. Complete the pool creation wizard.

Entitle Users and Groups

1. In Horizon Console, navigate to the desktop pool you created.
2. Click Entitlements > Add Entitlement.
3. Add Active Directory users or groups that should have access to the macOS desktops.

Note: SSO is not supported for macOS desktops. After the entitled AD user connects, they must authenticate again at the macOS session using the local account credentials on the target machine.

Manage macOS Permissions with MDM

Horizon Agent for macOS requires several macOS privacy and security permissions to function. Omnissa recommends that administrators deploy these permissions through Mobile Device Management (MDM) to eliminate manual user approval prompts in production environments.

Workspace ONE UEM is the recommended MDM platform for Omnissa Horizon deployments. Jamf Pro and Microsoft Intune can also deploy the required Privacy Preferences Policy Control (PPPC) profiles.

Required Permissions Overview

Grant the following permissions to the Horizon Agent process:

Access Settings

The Access value is not Allow for all permissions. Use the following:

Note: Apple blocks silent allow for Screen Capture and Listen Event. These permissions must be set to Only Allow Standard User to Set System Service so the user is prompted at first use.

Deploy the Required Permissions through Workspace ONE UEM

Procedure

1. Log in to the Workspace ONE UEM Console.

2. Navigate to Resources > Profiles & Baselines > Profiles.

3. Click Add > Add Profile > macOS.

4. Select Device Profile.

5. On the General payload, enter a profile name, for example, Horizon Agent Privacy.

6. Add the Privacy Preferences Policy Control (PPPC) payload.

7. Add an app entry for each permission, using the correct bundle identifier from the table above.

   • For Identifier, enter the bundle identifier that corresponds to the permission: com.omnissa.horizon.blastworker for Accessibility and Input Monitoring, com.omnissa.horizon.agent for Screen and System Audio Recording, or com.omnissa.horizon.jre for Input Monitoring.

   • For Identifier Type, select bundleID.

   • For Code Requirement, enter the code signing requirement for the corresponding Horizon Agent binary. To retrieve this value, run the codesign command against each binary on a reference machine where Horizon Agent is already installed. See Retrieving Code Signing Requirements.

   • For Service, select the appropriate service: ScreenCapture, Accessibility, or ListenEvent.

   • For Access, set the value according to the Access Settings table above. Select Allow for Accessibility. Select Only Allow Standard User to Set System Service for Screen Capture and Listen Event.

8. Assign the profile to the device smart group that contains your enrolled macOS machines.

9. Publish the profile.

After the profile is deployed, the user launches a VDI session from Horizon Client. On first launch only, macOS prompts the user to approve each of the following permissions:

• BlastWorker for Input Monitoring
• HorizonJRE for Input Monitoring
• CaptureAgent for Screen and System Audio Recording

The user clicks Allow on each prompt. No further action is required in System Settings. macOS displays these prompts automatically the first time the agent requests each permission.

Retrieving Code Signing Requirements

The codesign command must be run against each individual binary, not the top-level .app:

codesign --display -r - /path/to/BlastWorker
codesign --display -r - /path/to/CaptureAgent
codesign --display -r - /path/to/HorizonJRE

Deploy with Jamf Pro

Jamf Pro deploys PPPC profiles through its Privacy Preferences Policy Control payload. Use the same configuration fields, bundle identifier values, and access settings described above. Refer to Jamf Pro documentation for the specific steps to create and deploy a configuration profile.

Deploy with Microsoft Intune

Microsoft Intune can deploy custom configuration profiles to macOS devices using property list (plist) payloads. Use the com.apple.TCC.configuration-profile-policy payload key to configure privacy preferences. Refer to Microsoft Intune documentation for the specific steps.

Validate the Configuration

After deploying MDM profiles, validate the configuration:

1. Enroll a test macOS machine in your MDM solution.
2. Apply the PPPC profile.
3. Open a Horizon Client session to the macOS desktop.
4. Confirm the following:
   • The remote session displays without a Screen Recording permission prompt.
   • Keyboard and mouse input work without an Accessibility permission prompt.
   • Permissions persist after logout and re-login.
5. Document the expected behavior difference between a UEM-managed machine and an unmanaged machine for your deployment records.

Use Horizon Features on macOS

Clipboard Redirection

Clipboard redirection is a feature that allows users to copy and paste data between their local device and a remote desktop session.

Agent-Side Configuration

Clipboard redirection settings are read from the Horizon Agent configuration file. The agent searches the following locations in order of precedence, and the first value found is applied:

1. /Users/<user>/Library/Preferences/Omnissa Horizon Agent/config
2. /Users/<user>/.omnissa/config
3. /usr/lib/omnissa/config
4. /etc/omnissa/config

Specify each configuration entry on a separate line using the following format:

Identifier.SettingName=Value

Supported Clipboard Settings

• Clipboard.Direction

  Controls the permitted direction of clipboard redirection between the client and the Horizon Agent.
  
  Example:
  
  ```
  Clipboard.Direction=1
  ```
  
  | Value | Description |
  |---|---|
  | 0 | Disabled (disables clipboard redirection) |
  | 1 | Bidirectional (Client ↔ Agent) |
  | 2 | Client to Agent only (Default) |
  | 3 | Agent to Client only |
  

• mksvchan.clipboardSize

  Defines the maximum clipboard payload size that clipboard redirection can transfer.
  
  Example:
  
  ```
  mksvchan.clipboardSize=4096
  ```
  
  This example allows clipboard transfers of up to 4096 KB (4 MB).
  

Audio Redirection

Horizon Agent for macOS supports only audio output (speakers and headphones) redirection in remote sessions.

Multi-Monitor Support

Horizon Agent for macOS supports up to 2 monitors simultaneously. Horizon Client and Horizon Agent negotiate monitor layout at session startup. No additional agent-side configuration is required for standard multi-monitor operation.