EnglishFrançaisDeutschEspañolItaliano日本語한국어NederlandsPortuguês (Brasil)中文 (简体)中文 (繁體, 台灣)
Skip to main content

July 24, 2026

Omnissa Identity Service Release Notes

Omnissa Identity Service | JUN 2026

Check for additions and updates to these release notes.

What's New in June 2026

Directory Migration for Workspace ONE UEM Customers with Omnissa Access Configured (Limited Availability): Support for AirWatch Provisioning App

Building on the March 2026 Limited Availability release of directory migration for Workspace ONE UEM deployments with Omnissa Access configured, Omnissa Identity Service now supports migrating an Omnissa Access directory that provisions users and groups to Workspace ONE UEM using the AirWatch Provisioning app.

This update removes the following previously-noted limitation: "Sync via Airwatch Provisioning Adapter from Omnissa Access to Workspace ONE UEM is not supported."

Key Information

Learn More

What's New in May 2026

Omnissa and Google Workspace Integration for New Environments

You can now connect Omnissa Identity Service directly to Google Workspace to automate user lifecycles and enable seamless federated authentication.

What’s Supported

  • Automated Provisioning (SCIM): Real-time, one-way sync from Google to Omnissa Identity Service. This automatically creates, updates, deletes, activates, and deactivates users to eliminate manual overhead and secure your perimeter.
  • Single Sign-On (SAML): Users log into Omnissa services instantly using their existing Google Workspace credentials.

Current Limitations

  • No Groups: Google Workspace does not support SCIM group provisioning, so sync is limited to individual users.
  • Protocols: Built strictly on SAML. OpenID Connect (OIDC) and Workspace ONE UEM Password Grant flows are not supported.
  • Migration to Google Workspace from your current Workspace ONE UEM and Omnissa Access integrations is not yet supported.

Setup Guides

What's New in March 2026

Migration to SCIM 2.0 for Workspace ONE UEM customers with Omnissa Access configured (Limited Availability)

Omnissa Identity Service now supports directory migration from on-premises Active Directory to cloud Identity Providers supporting SCIM 2.0 for existing customers with Workspace ONE UEM and Omnissa Access configured.

This feature allows organizations to centralize identity management, eliminate on-premises dependencies, and streamline user provisioning and authentication.

This feature has been added to the Limited Availability program. Use the Omnissa Beta Program to check requirements and apply.

Key Benefits for Workspace ONE UEM and Omnissa Access Customers

  • Cloud-Native Provisioning: Provision users and groups from your cloud IDP to Workspace ONE UEM using SCIM 2.0, replacing legacy Active Directory sync.
  • No On-Premises Components: Eliminate the need for AirWatch Cloud Connector and Omnissa Access Connector for authentication and user sync.
  • Centralized Management: Manage users and groups from Omnissa Connect, a unified web-based portal for all Omnissa services.
  • Federated Authentication: Enable seamless SSO into Omnissa services using your cloud IDP as the identity provider.

Migration Process

The migration process is guided by a wizard in Omnissa Connect and includes:

  • Completing prerequisites (such as IDP setup and attribute mapping)
  • Integrating your cloud IDP with Omnissa Identity Service
  • Comparing directory data between Workspace ONE UEM, Omnissa Access, and Omnissa Identity Service
  • Executing the migration in stages (authentication switch, provisioning cutover)

Minimum downtime is expected during the migration.

Unsupported Features and Limitations

Before migrating, review the following limitations:

  • No Rollback: Once provisioning is migrated to Omnissa Identity Service, rollback to Active Directory is not possible.

  • Immutable externalId: For Microsoft Entra ID, the externalId in Entra ID must match the original Active Directory value.

  • Feature Gaps- Workspace ONE UEM: Some Workspace ONE UEM features are not supported post-migration. See the Unsupported Features list for details.

  • Feature Gaps - Omnissa Access: Features that are not supported post-migration include the following.

    • Local users and administrators

    • Dynamic groups

    • Directory administrators (administrators are provisioned from Omnissa Connect)

    • Password (cloud deployment) and Password (Local Directory) authentication methods

    • People Search

      See the Unsupported Features list for more information.

  • Sync via Airwatch Provisioning Adapter from Omnissa Access to Workspace ONE UEM is not supported.

Learn More

For detailed setup instructions, prerequisites, and best practices, see the documentation:

What's New in January 2026

Okta and generic SCIM Identity Provider migration to Omnissa Identity Service (Limited Availability)

Omnissa Identity Service (OIS) now extends Workspace ONE UEM directory migration support beyond Microsoft Entra ID to include Okta and generic SCIM 2.0–compliant identity providers, enabling Workspace ONE UEM customers to modernize identity architectures using their existing cloud IDPs. This enhancement allows organizations to migrate away from on-premises Active Directory while preserving their preferred identity provider for user lifecycle management and authentication.

This feature is in Limited Availability. Use the Omnissa Beta Program to review requirements and apply for access.

Key Benefits for Workspace ONE UEM Customers

  • Cloud-Native Provisioning: Provision users and groups from Okta or a generic SCIM IDP into Workspace ONE UEM using SCIM 2.0, replacing legacy Active Directory–based synchronization.
  • No On-Premises Components: Eliminate the need for AirWatch Cloud Connector and other on-premises directory infrastructure.
  • Centralized Identity Management: Manage users, groups, and directory integrations from Omnissa Connect, a unified web-based portal for all Omnissa services.
  • Federated Authentication: Enable seamless single sign-on (SSO) into Omnissa services using Okta or a supported SCIM-based identity provider as the authentication source.

Migration Process

The migration experience is guided by a wizard in Omnissa Connect and follows a consistent framework across supported identity providers. The staged approach is designed to minimize disruption, with minimal expected downtime during the migration window.

Note: By default, an email notification is sent to users when they are provisioned into Workspace ONE UEM through Omnissa Identity Service. You can customize or disable this notification. For details, see Workspace ONE UEM Directory Services Configuration for information.

Unsupported Features and Limitations

Before migrating, review the following limitations:

  • Omnissa Access Integration: If any directories or identity providers are configured in Omnissa Access, migration is not supported. Migration scenarios involving Workspace ONE UEM plus Access will be supported in a future release.
  • No Rollback: Once provisioning is migrated to Omnissa Identity Service, rollback to the previous directory (Active Directory or legacy sync) is not supported.
  • Immutable External Identifier: The SCIM externalId provided by Okta or the generic IDP must remain immutable and must match the existing directory identifier in Workspace ONE UEM.
  • Feature Gaps: Some Workspace ONE UEM directory-dependent features are not supported post-migration. Review the Unsupported Features list before proceeding.

Learn More

For detailed setup instructions, prerequisites, and best practices, see the following documentation:

Ability to select common identifier during migration to Omnissa Identity Service

Omnissa Identity Service now supports using an attribute other than distinguishedName as the unique, common identifier to match existing Workspace ONE UEM users and groups with those synced from your cloud identity provider. You can select the common identifier during Step 1: Complete Directory Prerequisites of the migration process. This feature is available for all supported cloud identity providers.

What's New in December 2025

Support for Workspace ONE UEM Basic users in new environments

Omnissa Identity Service now supports Workspace ONE UEM Basic user accounts in Identity Service-integrated Workspace ONE UEM environments, extending the support to new organizations. Previously, Workspace ONE UEM Basic user accounts were supported only in migration environments.

To use this feature, enable the Basic user authentication for UEM option in Step 4: Select Authentication Protocol of the Omnissa Identity Service integration wizard. When this option is selected, federated users are authenticated by the third-party identity provider, while Basic users are authenticated by Workspace ONE UEM Basic user authentication.

For more information, see Configuring Authentication for Workspace ONE UEM Basic Users.

Extension of Platform SSO support in Workspace ONE environments with user sync through Identity Service (SCIM 2.0)

We are now extending support for Workspace ONE UEM to configure Platform SSO using Omnissa Access as an IdP for environments that sync users and groups via SCIM 2.0 with Identity Service.

Administrators use Workspace ONE UEM to configure and manage Platform SSO, deploying the necessary profiles and settings to Macs. Platform SSO extends single sign-on directly to the macOS login, meaning the user's IdP password becomes synchronized with their Mac password. It can facilitate the creation of local macOS user accounts directly from the IdP and can also synchronize IdP password policies and enforce them on the local password.

Note: Omnissa Identity Service must be integrated with a third-party identity provider that supports the OpenID Connect (OIDC) protocol.

See Configuring Apple macOS Platform Single Sign-On with Omnissa Access for more information.

Support for Horizon 8 SSO to Azure VMs joined to Entra ID

Horizon 8 has added support for Single Sign-On to Entra ID-joined desktops and applications when the Windows client is launched using Omnissa Identity Service and Workspace ONE Access. Users are synced from Entra ID and authenticate through Omnissa Access. They can launch their Horizon desktops and applications without needing to re-enter Entra ID credentials inside the desktop. This streamlines access for environments built on Entra ID and gives on-prem organizations a smoother path when delivering Azure-based Horizon resources. ​See SSO to Microsoft Entra ID joined desktops and applications through Workspace ONE Access in the Desktops and Applications in Omnissa Horizon 8 documentation.

What's new in November 2025

URL Migration Dashboard

As part of the migration from legacy domains to Omnissa domains, URLs are being updated in Omnissa Access and Omnissa Identity Service for customers in selected cloud regions. These changes require you to update your integrations with Identity Providers. A Migration dashboard is available in the Identity Service admin console for impacted regions to guide you through the migration process.

See KB article 6001062 for detailed information about the migration process and timeline.

Action Required:

  1. Review KB article 6001062.
  2. In the Identity Service console, select Migration Support to access the Migration dashboard.
  3. Follow the instructions in the dashboard to complete the migration. See the KB article for additional information.

IMPORTANT: We strongly encourage you to start migration as soon as possible. See KB article 6001062 for the cutover timeline.

What's New in September 2025

Omnissa Identity Service opens in new tab

You can now launch Omnissa Identity Service directly from the Omnissa Connect menu in a separate tab to manage end-user directory configurations and view details. In Omnissa Connect, select Identity Management > End User Management, then click Launch End User Management.

Horizon 8 App Support

Omnissa Identity Service now supports Omnissa Access integration with Horizon 8, enabling users to access virtual desktops and published applications:

  • Natively with Horizon Client
  • Through Workspace ONE Intelligent Hub

This integration is only supported with Horizon 8 pods that have True SSO enabled.

Additional attributes are required for the Omnissa Access integration with Horizon 8. For more information, see:

Note: If Okta is configured as the third-party identity provider in Omnissa Identity Service, Omnissa Access integration with Horizon 8 is not supported.

What's New in July 2025

Active Directory Migration to Microsoft Entra ID (Limited Availability)

Omnissa Identity Service (OIS) now supports directory migration from on-premises Active Directory to Microsoft Entra ID, enabling a modern, cloud-first identity architecture for Workspace ONE UEM customers. This feature allows organizations to centralize identity management, eliminate on-premises dependencies, and streamline user provisioning and authentication.

This feature is in Limited Availability. Use the Omnissa Beta Program to check requirements and apply.

Key Benefits for Workspace ONE UEM Customers

  • Cloud-Native Provisioning: Provision users and groups from Microsoft Entra ID to Workspace ONE UEM using SCIM 2.0, replacing legacy Active Directory sync.
  • No On-Premises Components: Eliminate the need for AirWatch Cloud Connector.
  • Centralized Management: Manage users and groups from Omnissa Connect, a unified web-based portal for all Omnissa services.
  • Federated Authentication: Enable seamless SSO into Omnissa services using Microsoft Entra ID as the identity provider.

Migration Process

The migration process is guided by a wizard in Omnissa Connect and includes:

  • Completing prerequisites (such as Entra ID setup and attribute mapping)
  • Integrating Microsoft Entra ID with Omnissa Identity Service
  • Comparing directory data between Workspace ONE UEM and Omnissa Identity Service
  • Executing the migration in stages (authentication switch, provisioning cutover)

Minimum downtime is expected during the migration.

Note: By default, an email notification is sent to users when they are provisioned to Workspace ONE UEM through Omnissa Identity Service. You can customize the email or turn off the notification. See Workspace ONE UEM Directory Services Configuration for information.

Unsupported Features and Limitations

Before migrating, review the following limitations:

  • Omnissa Access Integration: If any directories or identity providers are configured in Omnissa Access, migration is not supported. Workspace ONE UEM plus Access migration will be supported in a subsequent release.
  • No Rollback: Once provisioning is migrated to Omnissa Identity Service, rollback to Active Directory is not possible.
  • Immutable externalId: The externalId in Entra ID must match the original Active Directory value.
  • Feature Gaps: Some Workspace ONE UEM features are not supported post-migration. See the Unsupported Features list for details.

Learn More

For detailed setup instructions, prerequisites, and best practices, see the documentation:

User Notification Settings for Users Provisioned to Workspace ONE UEM

You can now configure whether end users receive an email notification when their accounts are provisioned in Workspace ONE UEM through Omnissa Identity Service. By default, a user activation email is sent upon provisioning. You can customize the email or turn off the notification. See Workspace ONE UEM Directory Services Configuration for information.

What's New in January 2025

  • Integration with Horizon Cloud Service Next-Gen
  • Move to Omnissa Connect

Integration with Horizon Cloud Service Next-Gen

Horizon Cloud can now leverage Omnissa Identity Service to integrate with Microsoft Entra ID to sync users and groups and configure federation for end users. Omnissa Identity Service is available as another identity provider option in Horizon Cloud Service next-gen, in addition to the existing identity provider options. The service is available for tenants with no previous Identity Management configuration in the Horizon Cloud Control Plane next-gen.

In the Omnissa Connect console, select End User Management, configure the integration with Entra ID, select Horizon, and add the necessary information to your Horizon Cloud Control Plane next-gen to complete the integration.

The following configuration is supported:

  • Microsoft Entra ID as the third-party identity provider integrated with Omnissa Identity Service
    Okta and generic SCIM 2.0 identity providers are not currently supported.
  • OpenID Connect as the authentication protocol
  • Enabling Intelligent Hub
    However, the Enforce Intelligent Hub setting, which forces users to access their apps through Intelligent Hub, is not currently supported.

For more information, see:

Move to Omnissa Connect

Omnissa Identity Service is now part of Omnissa Connect, a new web-based service that provides a centralized access point for all Omnissa services and solutions. In the Omnissa Connect console, select End User Management in the left pane to access and configure Omnissa Identity Service.

""

Your existing Omnissa Identity Service configuration has not changed with the move from Workspace ONE Cloud Admin Hub, the Workspace ONE Cloud console, to Omnissa Connect.

For more information, see:

What's New in December 2024

  • New provisioning app for Okta integration
  • New Status tab for provisioning errors

New provisioning app for Okta integration

We are excited to announce the availability of a new provisioning app, the Omnissa Identity Service app, in the Okta Integration Networks App catalog! The app makes it easier for you to set up user provisioning from Okta to Omnissa by including preconfigured settings.

To get started with your provisioning app, search for “Omnissa Identity Service” in the Okta App catalog, then select the app.

Read more about how to integrate Omnissa Identity Service with Okta in the Identity Service documentation.

New Status tab for provisioning errors

You can now use a new Status tab to monitor real-time provisioning errors. The tab displays information about the provisioning status from Omnissa Identity Service to the services that you selected to use with it (Workspace ONE UEM or Access), as well as error details for user, group, and membership objects.

We have also added an error banner on the Identity Service summary page that displays the total error count across downstream services.

For example:

What's New in September 2024

Password Grant Flows

When an Omnissa Workspace ONE® UEM tenant is integrated with Omnissa Identity Service, end users are redirected to your Identity Provider (IdP) for SAML authentication when enrolling or checking out devices. A SAML-redirection is not possible on the device or client in some authentication flows. The Password Grant Flow feature, when enabled, allows SCIM-provisioned users to authenticate against your IdP when SAML-redirection is not available. Additionally, it enables certain basic user authentication flows. See Support for Certain Workspace ONE UEM Username and Password-based Flows for details of these flows. Also see Configure Workspace ONE UEM Settings for Omnissa Identity Service for information on how to configure the new Password Grant setting.

What's New in April 2024

SAML Authentication Context for Generic Identity Provider Integrations

If you integrate a generic SAML 2.0 identity provider with Omnissa Identity Service and select SAML as the authentication protocol, you can now choose between the following authentication context types: unspecified, PasswordProtectedTransport, or a custom value.

The authentication context indicates how a user is authenticated at an identity provider. The identity provider includes the authentication context in an assertion at the request of a service provider or based on the configuration at the identity provider.

Note: You can change the authentication context for existing configurations.

What's New in February 2024

Ability to deactivate Omnissa Identity Service from the console

We've now made it possible for you to deactivate Omnissa Identity Service from the Workspace ONE Cloud console. After deactivating Omnissa Identity Service, you can set up directory provisioning and federated authentication from Workspace ONE UEM and Omnissa Access directly. You might need to deactivate Omnissa Identity Service in the following scenarios:

  • Your use cases are not supported by Omnissa Identity Service.
  • You want to sync users and groups directly from Active Directory.
  • You want to configure directory services and identity federation in Workspace ONE UEM or Omnissa Access, instead of the Workspace ONE Cloud service.

Here's how you do it: Deactivating Omnissa Identity Service

What's New in December 2023

  • Omnissa Identity Service public APIs
  • Token expiry notification for administrators

Omnissa Identity Service public APIs

We are happy to announce the release of Omnissa Identity Service public APIs, bringing the power of automation to your Workspace ONE Cloud integration with cloud identity providers that use the SCIM 2.0 protocol.

The following use cases are available for the API integration:

  • Configure a provisioned directory of users and groups using the System for Cross-domain Identity Management (SCIM 2.0) protocol.
  • Manage identity provider configuration for federated authentication into Omnissa products and services.
  • Leverage centralized user management and authentication for Omnissa Access and Workspace ONE UEM.

You can create an OAuth 2.0 client in the Workspace ONE console to get API access to get started.

To learn more about the new APIs, see Omnissa Identity Service APIs.

Note: The Omnissa Identity Service APIs are available to new Omnissa Access or Workspace ONE UEM customers, and to existing customers that have already onboarded Omnissa Identity Service.

Token expiry notification for administrators

We now send notifications to administrators when the secret token used for directory synchronization is about to expire or has expired. Notifications are sent to the administrator by email and also appear as a banner in the Workspace ONE Cloud console.

Administrators can opt out from receiving email notifications.

What's New in October 2023

New Flow for Okta Integration with Workspace ONE Cloud

We are excited to announce that a new Okta flow is now available in the Workspace ONE Cloud console to support integration with Okta! This flow makes it easier for you to provision users and groups from Okta to Workspace ONE Cloud and authenticate users using Okta. Prior to this release, Okta was tested and documented for the generic SCIM 2.0 Identity Provider flow.

Get familiar with the new flow by reading Integrating Omnissa Identity Service with Okta in the Omnissa Identity Service documentation.

Note: The Okta integration is available for new customers or customers that have already onboarded to Omnissa Identity Service.

What's New in June 2023

Audit events for provisioning to downstream products and services

Omnissa Identity Service introduces audit events to track successes and failures in pushing data from Workspace ONE Cloud to downstream products and services such as Workspace ONE UEM and Omnissa Access. Admins can use the audited information to identify, track, and debug provisioning-based issues. Audit events support filtering based on the object name, object type, downstream service, and errors. A detailed view of audit events provides error states.

See Viewing Audit Events for Omnissa Identity Service for more information.

What's New in April 2023

New provisioning app for Microsoft Entra ID integration

We are excited to announce the availability of a new provisioning app in the Microsoft Entra App Gallery! The app makes it easier for you to set up user provisioning from Microsoft Entra ID to Omnissa Identity Service by including preconfigured settings.

Read more about how to integrate Omnissa Identity Service with Microsoft Entra ID in the documentation.

Introducing Omnissa Identity Service - January 2023

We’re introducing a new service that makes user provisioning and identity federation easier for new customers of Omnissa Access and Workspace ONE UEM! You can now leverage Omnissa Identity Service to configure a provisioned directory of users and groups based on SCIM 2.0 in the Workspace ONE Cloud console. Omnissa Identity Service will then automatically provision the users and groups, as well as authentication settings, to your Workspace ONE UEM and Omnissa Access admin consoles.

While integrating with your third-party identity provider, you confirm the user attributes to synchronize into Omnissa Identity Service.

Take a look at some of the use cases:

  • Create and configure a provisioned directory of users and groups using the System for Cross-domain Identity Management (SCIM) 2.0 protocol.
  • Manage identity provider configuration for federated authentication into Omnissa products and services.
  • Leverage centralized user management and authentication across Omnissa products and services.

Currently, Omnissa Identity Service supports Workspace ONE UEM and Omnissa Access for centralized user management and authentication from the Workspace ONE Cloud console for newly-created environments.

Supported identity providers and directory sources:

  • Microsoft Entra ID, a cloud-based identity service in Microsoft Azure
  • Generic SCIM 2.0 identity source (tested for Okta)

Important:

  • Omnissa Identity Service is only available for new Workspace ONE Cloud environments.
  • Omnissa Identity Service is not available for Managed Services Provider customers at this time.

To get started with Omnissa Identity Service, log into your organization's Workspace ONE Cloud Admin Hub, the Workspace ONE Cloud console, and select Accounts > End User Management.

Click Get Started and use the wizard to set up the integration with your identity provider.

Known Issues

  • Unsupported features

    When Omnissa Identity Service is enabled, some features are not supported in Omnissa Access, Workspace ONE UEM, Omnissa Workspace ONE® Hub Services, and Omnissa Workspace ONE® Intelligent Hub and portal. See Configuring User Provisioning and Identity Federation with Omnissa Identity Service for more information.

  • After you select a service such as Omnissa Access or Workspace ONE UEM to use with Omnissa Identity Service and save your selection, you cannot deselect it.

    Solution : Contact Support to reset the selection.

  • Deleting a user in Microsoft Entra ID does not delete the user from Omnissa Identity Service

    When you delete a user in Microsoft Entra ID, the account is suspended for a specific period of time before being deleted. The user is deactivated in Omnissa Identity Service, too, for that period of time. In Microsoft Entra ID, the username of the deleted user is also modified, and the changes are reflected in Omnissa Identity Service. See How Microsoft Entra ID Users are Deleted for more information.

  • Deleting user and group attribute values in Microsoft Entra ID does not delete the values in Omnissa Identity Service

    In Microsoft Entra ID, when you delete a user or group attribute value that was already synced to Omnissa Identity Service, the value is not deleted in Omnissa Identity Service and downstream services. Microsoft Entra ID does not propagate null values.

    Solution : Instead of clearing the value completely, enter a space character.

  • Okta integration requires two apps

    When you integrate Omnissa Identity Service with Okta, you must create separate apps in the Okta Admin console for user provisioning and identity provider configuration. You cannot use the same app for provisioning and authentication.

  • Login_hint feature does not work

    When you integrate a third-party identity provider with Omnissa Identity Service using the OpenID Connect protocol, the login_hint feature does not work. If the relying party sends a login_hint, Omnissa Identity Service does not pass it to the identity provider.

  • Deleting an attribute mapping in Microsoft Entra ID or Okta does not remove the attribute from users in Omnissa Identity Service

    When you delete an attribute mapping from the provisioning app in Microsoft Entra ID or Okta, the changes are not propagated to Omnissa Identity Service. The attribute is not deleted for users in Omnissa Identity Service and downstream services.

Documentation

See Configuring User Provisioning and Identity Federation with Omnissa Identity Service in the Omnissa Identity Service documentation site.

Internationalization

Omnissa Identity Service is available in the following languages:

Czech

French

Polish

Simplified Chinese (China)

Danish

Italian

Portugese

Chinese (Taiwan)

German

Japanese

Russian

English

Korean

Swedish

Spanish

Dutch

Turkish

To view the documentation in your preferred language, select the language icon at the top-right of the page.

Localized Content for Omnissa Docs

See KB article 6000664: Announcing Omnissa Localization Support for information about localized content.

Support Contact Information

Contact Support at Omnissa Customer Connect when you need help with your Omnissa Identity Service environment. See How to file a Support Request in Customer Connect and via Cloud Services Portal.

Was this page helpful?

Provide feedback for this topic

Was this topic helpful?

Please do not include any personal or confidential information.

Generating link…