Enabling Horizon Cloud Entitlement On-Ramp to Access Horizon 8 and Horizon Cloud on Azure Desktops

The Horizon Cloud Entitlement On-Ramp global setting allows users to access both Horizon 8 and Horizon Cloud on Azure desktops with their credentials from a single Horizon Client, eliminating the need for multiple URLs, logout, or additional authentication to the cloud.

Prerequisites

• Verify that you have registered a supported identity provider (IdP) -- Microsoft Entra ID or Workspace One Access (on-premises/cloud) -- in your Horizon Cloud Service - next-gen tenant. The registered identity provider ensures end users can access their entitled resources securely.
• Verify that you are running Horizon Connection Server version 2312 or later.
• Verify that you have deployed the Horizon 8 Edge Gateway to connect your Horizon 8 pod to the Horizon Cloud Service - next-gen Control Plane.
• In the Horizon Universal Console, with Microsoft Azure as your capacity provider, create a pool, deploy desktop instances, and entitle users and groups.
• In Horizon Console, create Horizon 8 pools and assign entitlements for local or Cloud Pod Architecture.
• Verify that your end users are running one of the following clients:
  • Horizon Client for Windows 2312 or later
  • Horizon HTML Access 2406 or later. (Note: Starting with 2412, HTML Access is called Horizon Web Client). This support refers to the HTML Access client/Horizon Web Client installed on Horizon Connection Server.
  • Horizon Client for Linux 2412 or later

Note: Confirm that the portal URL you have set is directed to omnissahorizon.com.

How Horizon Cloud Entitlement On-Ramp Works

The Horizon Cloud Entitlement On-Ramp feature allows end users entitled to both Horizon 8 and Horizon Cloud on Azure desktops and applications to see both of them in a single Horizon Client session when connecting to Connection Server.

The identity provider configured in your Horizon Cloud Service next-gen is used to ensure that end users connecting to the Connection Server are authorized to their entitled desktops and applications in Horizon Cloud on Azure. Authentication only needs to be completed once in Horizon Client. You can use either Microsoft Entra ID or Workspace ONE Access (on-premises or cloud) as the identity provider (IdP) for your Horizon Cloud Service - next-gen tenant.

Note: If you use Workspace ONE Access as your identity provider, a connector is deployed to synchronize user accounts and group memberships with the Workspace ONE Access platform.

When a user connects to a Connection Server instance, the Connection Server instance validates that user's entitlements to any Horizon Cloud on Azure desktops and applications. Horizon Client then displays desktops and applications from both Horizon Cloud on Azure and Horizon 8 in the same desktop and application selector window. In this way, users can access their Horizon Cloud entitlements directly when connecting to the Connection Server or Unified Access Gateway FQDN. A separate URL for the Horizon Cloud Service - next-gen portal is no longer required.

Each Horizon 8 entitlement shown in the selector window may be either a local entitlement or global entitlement. Horizon 8 entitlements and Horizon Cloud entitlements appear as individual desktops and applications in the selector window and the user must select which resource to connect to. At this time, Horizon Cloud Entitlement On-Ramp does not support the capability to define a connection policy between Horizon 8 and Horizon Cloud on Azure entitlements.

Important: Take note of the following feature limitations:

• Currently, the following Horizon Clients support this feature. Support will be available for other Horizon clients in the future.
  • Horizon Client for Windows 2312 or later
  • Horizon HTML Access 2406 or later. (Note: Starting with 2412, HTML Access is called Horizon Web Client).
  • Horizon Client for Linux 2412 or later
• If you configure client restriction messages from both Horizon Console and Horizon Universal Console, these messages do not appear simultaneously on the client. Instead, the first message appears momentarily before being replaced with the second message.

Horizon Cloud Entitlement On-Ramp can be enabled at the Horizon 8 pod level and at the user level. By default, it is deactivated for all users. This feature must be activated by an administrator, as described in the next sections on this page.

Activate Horizon Cloud Entitlement On-Ramp in the Horizon Cloud Control Plane

Use the Horizon Universal Console to perform the first part of the feature activation process.

1. Log in to the Horizon Universal Console.

2. On the Home page, click Horizon Edges on the Horizon Edges tile.

3. In the Horizon Edges tab on the Capacity page, click on the name of a Horizon Edge with a Provider Type of Horizon 8 to its Horizon Edge details page.

4. In the Cloud Entitlement On-Ramp tile, click Enable.

   The Horizon Universal Console pushes the configuration to the Horizon Edge Gateway for a Horizon 8 deployment, where it in turn pushes the configuration to the Horizon Connection Server and activates the Horizon Cloud Entitlement On-Ramp feature in Horizon Console.

5. Proceed to the next section on this page to add user entitlements in Horizon Console.

Add Horizon Cloud Entitlement On-Ramp Entitlements in Horizon Console

After activating the Horizon Cloud Entitlement On-Ramp feature in the Horizon Cloud Control Plane, you must configure Cloud Entitlement On-Ramp entitlements in Horizon Console for applicable users and groups.

1. Log in to the Horizon Console.

2. In Global Settings, verify that the setting Cloud Entitlement On-Ramp is enabled.

   Note: If the setting does not appear enabled, check the network connectivity between the Horizon Edge Gateway, the Horizon Universal Console, and Horizon Connection Server.

3. Navigate to Users and Groups > Cloud Entitlement On-Ramp and click Add.

4. Add the users and groups that need access to Horizon Cloud on Azure desktops.