Requirements Checklist for Deploying a Horizon Cloud on OpenStack Edge

The purpose of this checklist is to inform you of the required elements for creating a Horizon Cloud on OpenStack Edge deployment using OpenStack (Customer deployment or Platform9 Private Cloud Director (PCD)) as your capacity provider and using the Horizon Control Plane.

Note: Horizon Cloud on OpenStack is currently available in Limited Availability (LA) mode only.

This checklist is for Horizon Cloud customer accounts that have never had a Horizon Cloud on OpenStack deployment in their tenant environment. Such tenants might be referred to as clean-slate environments or greenfield environments.

You must perform some items that follow before you deploy Horizon Cloud. You can defer some items until after the deployment is finished and running.

Ports and Protocols Requirements

Specific ports and protocols are required for deployment and ongoing operations of your Horizon Cloud environment. For details, see Port and Protocol Requirements for Horizon Cloud on OpenStack Edge.

Licensing for the Microsoft Windows Operating Systems

Horizon Cloud does not provide any guest operating system licensing required for use of Microsoft Windows operating systems that you use in the course of using the Horizon Cloud workflows. You must have valid and eligible Microsoft licenses that entitles you to create, perform workflows on, and operate the Windows-based desktop VMs and RDSH VMs that you choose to use in your Horizon Cloud environment. The required licensing depends on your intended use.

Unified Access Gateway Requirements

A cluster of Unified Access Gateway VMs is associated to a pool, which enables clients to have trusted Horizon Web Client connections to the VMs in that pool. You use the Horizon Universal Console to configure Horizon Cloud with the Unified Access Gateway.

For Horizon Cloud on OpenStack, you need a certificate or certificates for the Omnissa Unified Access Gateway (UAG) in PEM or PFX format that matches the FQDN.

The items below are required to configure Horizon Cloud with the Unified Access Gateway. For related networking information, see Configure Network Settings for Horizon Cloud on OpenStack Edge Deployments in Using and Managing Horizon Cloud.

User Identity and Machine Identity Requirements

Horizon Cloud differs from other environments in how it handles identity. In Horizon Cloud, the service makes a distinction between user identity and machine identity, and it relies on both types of identity when establishing a secure connection between a client and a remote desktop or application.

Note: You might be new to this distinction between user identity and machine identity if you are more familiar with environments that use a single identity provider to authenticate both user and machine identity, such as the first-generation Horizon Cloud environment or a Horizon 8 on-premises environment.

In Horizon Cloud, you must set up an identity configuration consisting of an identity provider to authenticate the user identity and an identity provider to authenticate the machine identity.

User Identity Requirements

Horizon Cloud requires you to register a user identity provider. The service uses this identity provider to authenticate client users attempting to access remote desktops and applications.

Horizon Cloud relies on an external identity provider and currently supports Microsoft Entra ID (Azure Active Directory) and Omnissa Workspace ONE Access. The identity provider that you configure with Horizon Cloud performs the authentication needed when users attempt to access their desktops.

For either Microsoft Entra ID or Workspace ONE Access, you must connect an on-premises Active Directory to the external identity provider.

For more information about configuring the identity provider of your choice, see Setting Up Your Identity Provider

Machine Identity Requirements

Horizon Cloud also requires you to register a machine identity provider. The service uses this identity provider to establish the machine identity of virtual machines that provide remote desktops and applications.

Through the machine identity provider, the service joins remote desktops and the virtual machine sources for remote applications to the trusted network domain that client users are entitled to access.

You must meet the following prerequisites:

• On-prem Active Directory is supported and required for machine identity. The VDI desktops will join this Active Directory Domain, so the domain controllers must be reachable from the network where the desktops are to be deployed.

• You must create a primary and auxiliary domain join accounts.

• You'll need an Active Directory domain join account that can be used by the system to perform Sysprep operations and join computers to the domain.

• Set your account password to Never Expire.

• Your account requires the following Active Directory permissions: Read All Properties, Reset Password, Create Computer Objects, Delete Computer Objects, Write All Properties.

For more information, see the Active Directory table row later in this topic.

API Minimum Requirements

This table lists the minimum and maximum required API versions and microversions for each service. Services without a microversion constraint require only the specified base API version. Services with no API version listed are registered but version details are not yet defined.

Supported Identity Configurations

Horizon Cloud requires you to register an identity configuration that consists of a user identity provider and a machine identity provider. Feature capabilities might vary depending on the particular identity providers included in the configuration.

Horizon Cloud supports the following identity configurations.

The following sections describe requirements for each supported user identity provider and machine identity provider.

User Identity Requirements

The preparatory information that follows outlines the requirements for the user identity provider that you choose to use in your identity configuration. Horizon Cloud supports Microsoft Entra ID and Workspace ONE Access as providers of user identity.

In addition to the requirements described in this section, see the Supported Identity Configurations section for information about feature considerations and the machine identity providers that you can use with each user identity provider. For an overview of how Horizon Cloud manages identity, see the Understanding User Identity and Machine Identity section.

• Microsoft Entra ID

  ☐	When Microsoft Entra ID Commercial or Microsoft Entra ID Government is your user identity provider, a user with Microsoft Entra ID Global Administrator privileges must do the following. Approve the requested permissions. Provide consent for the entire organization.

• Workspace ONE Access

  ☐	When Workspace ONE Access Access Cloud or Workspace ONE Access On Premises is your user identity provider, a user with Administrator privileges must do the following. Integrate the identity provider. Configure required pre-requisites for Horizon Cloud integration.

• Omnissa Identity Service

  ☐	When Omnissa Identity Service is your user identity provider, a user with Administrator privileges must do the following. Integrate the identity provider. Select Horizon Cloud to be used with Omnissa Identity Service.

Machine Identity Requirements

The preparatory information that follows outlines the requirements for the machine identity provider that you choose to use in your identity configuration. Horizon Cloud supports Microsoft Entra ID and Active Directory as providers of machine identity.

In addition to the requirements described in this section, see the Supported Identity Configurations section for information about feature considerations and the user identity providers that you can use with each machine identity provider. For an overview of how Horizon Cloud manages identity, see see the Understanding User Identity and Machine Identity section.

• Active Directory

  ☐	Active Directory server with line-of-sight to the Horizon Edge Gateway instances and desktop subnets. For example: An on-premises Active Directory server connected via VPN/Express Route An Active Directory server located in Microsoft Azure
  ☐	If you plan to connect your Active Directory using LDAPS, gather PEM-encoded root and intermediate CA certificates for your Active Directory domain. When you use the Horizon Universal Console to set up your Active Directory Domain, you are prompted at that time to upload the PEM-encoded root and intermediate CA certificates.
  ☐	Supported Microsoft Windows Active Directory Domain Services (AD DS) domain functional levels. Windows Server 2016 Windows Server 2012 R2 Windows Server 2012 Supported Microsoft Windows Active Directory Domain Services (AD DS) OS Versions. Windows Server 2022 Windows Server 2019 Windows Server 2016 Windows Server 2012 R
  ☐	Domain Bind Account Active Directory domain bind account (a standard user with read access) that has the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >. The account must have the following permissions: List Contents Read All Properties Read Permissions Read tokenGroupsGlobalAndUniversal (implied by Read All Properties) Set the account password to Never Expire to ensure continued access to log in to your Horizon Cloud environment. If you are familiar with the Horizon on-premises offering, the above permissions are the same set that are required for the Horizon on-premises offering's secondary credential accounts. Domain bind accounts are granted the default out-of-the-box read-access-related permissions typically granted to authenticated users in a Microsoft Active Directory deployment. However, if your organization's AD administrators have chosen to lock down read-access-related permissions for regular users, you must request those AD administrators preserve the authenticated users standard defaults for the domain bind accounts you will use for Horizon Cloud. Reference: Creating Active Directory Domain Bind and Domain Join Accounts
  ☐	Auxiliary Domain Bind Account Must be separate from the main domain bind account. The UI will prevent re-using the same account in both fields. Active Directory domain bind account (a standard user with read access) that has the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >. The account must have the following permissions: List Contents Read All Properties Read Permissions Read tokenGroupsGlobalAndUniversal (implied by Read All Properties) Set the account password to Never Expire to ensure continued access to log in to your Horizon Cloud environment. If you are familiar with the Horizon on-premises offering, the above permissions are the same set that are required for the Horizon on-premises offering's secondary credential accounts. Domain bind accounts are granted the default out-of-the-box read-access-related permissions typically granted to authenticated users in a Microsoft Active Directory deployment. However, if your organization's AD administrators have chosen to lock down read-access-related permissions for regular users, you must request those AD administrators preserve the authenticated users standard defaults for the domain bind accounts you will use for Horizon Cloud.
  ☐	Domain Join Account Active Directory domain join account which can be used by the system to perform Sysprep operations and join the virtual computers to the domain. Typically a new account that you create for this express purpose. (A domain join user account) The account must have the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >. The use of white spaces in the account's user name is currently unsupported. Set the account password to Never Expire to ensure continued ability for Horizon Cloud to perform the Sysprep operations and join the virtual computers to the domain. This account requires the following Active Directory permissions, applied to the Computers OU, or to the OU that you will enter into the console's Domain Join UI. Read All Properties - this object only Create Computer Objects - this object and all descendant objects Delete Computer Objects - this object and all descendant objects Write All Properties - Descendant Computer objects Reset Password - Descendant Computer objects Regarding the target Organizational Unit (OU) that you plan to use for pools, this account also requires the Active Directory permission named Write All Properties on all descendant objects of that target Organizational Unit (OU). For more details on creating and reusing domain join accounts, see Creating Active Directory Domain Bind and Domain Join Accounts. In Microsoft Active Directory, when you create a new OU, the system might automatically set the Prevent Accidental Deletion attribute which applies a Deny to the Delete All Child Objects permission for the newly created OU and all descendant objects. As a result, if you explicitly assigned the Delete Computer Objects permission to the domain join account, in the case of a newly created OU, Active Directory might have applied an override to that explicitly assigned Delete Computer Objects permission. Because clearing the Prevent Accidental Deletion flag might not automatically clear the Deny that Active Directory applied to the Delete All Child Objects permission, in the case of a newly added OU, you might have to verify and manually clear the Deny permission set for Delete All Child Objects in the OU and all child OUs before using the domain join account in the Horizon Cloud console.
  ☐	Optional Auxiliary Domain Join Account Active Directory domain join account which can be used by the system to perform Sysprep operations and join the virtual computers to the domain. Typically, a new account that you create for this express purpose (A domain join user account). The account must have the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >. The use of white spaces in the account's user name is currently unsupported. Set the account password to Never Expire to ensure continued ability for Horizon Cloud to perform the Sysprep operations and join the virtual computers to the domain. This account requires the following Active Directory permissions, applied to the Computers OU, or to the OU that you will enter into the console's Domain Join UI. Read All Properties - this object only Create Computer Objects - this object and all descendant objects Delete Computer Objects - this object and all descendant objects Write All Properties - Descendant Computer objects Reset Password - Descendant Computer objects Regarding the target Organizational Unit (OU) that you plan to use for pools, this account also requires the Active Directory permission named Write All Properties on all descendant objects of that target Organizational Unit (OU). In Microsoft Active Directory, when you create a new OU, the system might automatically set the Prevent Accidental Deletion attribute which applies a Deny to the Delete All Child Objects permission for the newly created OU and all descendant objects. As a result, if you explicitly assigned the Delete Computer Objects permission to the domain join account, in the case of a newly created OU, Active Directory might have applied an override to that explicitly assigned Delete Computer Objects permission. Because clearing the Prevent Accidental Deletion flag might not automatically clear the Deny that Active Directory applied to the Delete All Child Objects permission, in the case of a newly added OU, you might have to verify and manually clear the Deny permission set for Delete All Child Objects in the OU and all child OUs before using the domain join account in the Horizon Cloud console.
  ☐	Active Directory organizational unit (OU) or units (OUs) for virtual desktops and RDS session-based desktops or published applications or both. In Microsoft Active Directory, when you create a new OU, the system might automatically set the Prevent Accidental Deletion attribute which applies a Deny to the Delete All Child Objects permission for the newly created OU and all descendant objects. As a result, if you explicitly assigned the Delete Computer Objects permission to the domain join account, in the case of a newly created OU, Active Directory might have applied an override to that explicitly assigned Delete Computer Objects permission. Because clearing the Prevent Accidental Deletion flag might not automatically clear the Deny that Active Directory applied to the Delete All Child Objects permission, in the case of a newly added OU, you might have to verify and manually clear the Deny permission set for Delete All Child Objects in the OU and all child OUs before using the domain join account in the Horizon Cloud console.

  Networking and Load Balancing Requirements

  For networking and load balancing requirements, see Configure Network Settings for Horizon Cloud on OpenStack Edge Deployments in Using and Managing Horizon Cloud.