Omnissa Access FedRAMP Release Notes

Omnissa Access | Hub Services | JUN 2026 Omnissa Access Connector 26.05 | 02 JUN 2026 | Build Access-Connector-Installer-376-26.05.exe Check for additions and updates to these release notes.

What's New in June 2026

New Connector Version Available

A new version of the connector, Omnissa Access Connector 26.05, is now available. See the Omnissa Access Connector Release Notes for details.

April 2026

PKCE Support for OpenID Connect Applications

Omnissa Access now supports Proof Key for Code Exchange (PKCE) for OpenID Connect (OIDC) applications, improving the security of the OAuth 2.0 authorization code flow, especially for mobile and browser-based applications.

Administrators can now choose a client type when creating an OIDC application.

• For Public clients with no client secret, PKCE is always enforced.
• For Confidential clients that require a client secret, PKCE is optional.

The OIDC application details page indicates whether the associated OAuth 2.0 client is Public or Confidential.

Note that:

• If you enable PKCE on an existing Confidential client, all tokens for that OAuth 2.0 client are deleted to ensure a secure transition.
• PKCE is not supported for OIDC apps with SSF Integration enabled. These apps always use a Confidential client with a client secret.
• Omnissa Access supports only the S256 code challenge method for PKCE.

For more information, see Adding OpenID Connect Applications to Omnissa Access.

CORS Support for OAuth 2.0 and OIDC Endpoints

Omnissa Access now supports Cross Origin Resource Sharing (CORS) for OAuth 2.0 and OpenID Connect (OIDC) endpoints. This support enables browser-based applications such as single-page applications (SPAs), hosted on approved domains, to securely call Omnissa Access for tokens and user information directly from the browser.

Administrators can configure the allowed cross-origin domains in the Omnissa Access admin console.

The following Omnissa Access endpoints now support CORS when called from approved cross-origin domains:

For more information, see Configuring Cross-Origin Resource Sharing in Omnissa Access.

March 2026

App Bundles

An App Bundle is a logical grouping or collection of component apps. Hub Services admins can now create an App Bundle for their App catalog users by grouping several apps delivered through various delivery mechanisms. For example, an App Bundle called Outlook might contain Microsoft 365 for Web, Outlook native app (for Windows), Boxer, and Outlook for Horizon as its component apps.

Catalog users can subsequently open an App Bundle to launch one of the component apps. Users can also select a default component app to auto-launch when the bundle is clicked.

In this release, App Bundles are supported on the Intelligent Hub web portal. This feature will be rolled out to Intelligent Hub apps in subsequent releases.

For more information, see Managing App Bundles in the Workspace ONE Intelligent Hub App Catalog.

December 2025

Hub Services integration with Omnissa Intelligence

The Hub Services integration with Omnissa Intelligence is now available for FedRAMP environments. This integration lets you collect analytics about users' interactions with Hub Services notifications, create workflows for notifications, and create and publish surveys.

For more information about this feature, see:

• Workspace ONE Hub Services Integration
• Integrate Hub Services with Omnissa Intelligence to Provide Notification Analytics and Automation Workflows

November 2025

TLS 1.3 Support for Access Certificate Authentication Service (CAS)

The Omnissa Access Certificate Authentication Service (CAS) now supports Transport Layer Security (TLS) 1.3. This update improves security and performance of CAS by removing session renegotiation and optimizing certificate-based authentication flows. CAS will continue to support TLS 1.2 by default. Administrators will now have the option to enable TLS 1.3 from the Omnissa Access console.

Note: If you select Use TLS 1.3 for SSL connections for either the Certificate (cloud deployment) or Mobile SSO (for Apple) authentication method, customers might need to update their proxy and firewall configurations and device profiles to support the new CAS hostnames. See KB article 6000726 for details.

September 2025

Certificate Migration Now Available

As part of the ongoing changes related to the establishment of Omnissa as a new company, certificates are being updated in Omnissa Access FedRAMP. These changes require you to update your integrations with both Omnissa and third-party products and services. A Migration dashboard is available in the admin console to guide you through the migration process.

KB article 6001062 provides detailed information about migration. All FedRAMP tenants belong to “Category 1 - Certificate Branding only (No URL Change)”. Migration is now available for that category.

Action Required:

1. Review the information for Category 1 in KB article 6001062.
2. In the Omnissa Access console, select Settings > Migration Support to access the Migration dashboard.
3. Follow the instructions in the dashboard to complete the migration. See the KB article for additional information.

IMPORTANT: We strongly encourage you to start migration as soon as possible. See KB article 6001062 for the cutover timeline.

Omnissa Access Connector 24.12.1.0 available

Omnissa Access connector version 24.12.1.0 is now available. You can perform a fresh installation of version 24.12.1.0, or upgrade from versions 23.09, 24.07, and 24.12.0.0. Version 24.12.1.0 is compatible with Omnissa Access Cloud, Omnissa Access FedRAMP, and Omnissa Access virtual appliance 24.12.1.0.

This version of the connector includes the following resolved issues.

Directory Sync service:

• HW-230769: Prevent directory sync failure when a deleted user continues to have group membership
• HW-215396: Allow manual override of domain controller auto-discovery in krb5.conf file
• HW-216294: During Active Directory password reset from Intelligent Hub, limit domain controller discovery retries
• HW-201638: Add safeguards check to photo sync
• HW-223982: Limit the number of directory sync alerts to 1,000

Virtual App service:

• HW-222985/HW-225845: Support the new Omnissa-based application partition names in Active Directory Lightweight Directory Services (LDS) introduced with Horizon 2503 (see KB article 6000797).

July 2025

Support for SIEM Integration

Omnissa Access now offers the ability to forward Access audit information to third-party Security Information and Event Management (SIEM) systems as Syslog events. Omnissa Access can forward audit events to SIEM and Syslog servers in the cloud or in customer data centers. This release includes native adapters for a Syslog server, Splunk, and CrowdStrike Next-Gen SIEM, with support for more SIEMs coming in a future release. The integration requires mutual TLS (mTLS) authentication between Access and the external system. See Integrating Omnissa Access with External SIEM Systems.

For FedRAMP environments, additional configuration might be required to connect to your SIEM system. Please contact support for assistance.

April 2025

Patch for Omnissa Access Connector 24.12

A patch is available for Omnissa Access Connector 24.12 to support the new application partition names in Active Directory Lightweight Directory Services (LDS) introduced with Horizon version 2503. See KB article 6000797 for more information.

The patch applies to Omnissa Access Connector 24.12, regardless of whether the connector is used with the on-premises Omnissa Access 24.12 virtual appliance or with Omnissa Access Cloud. You can download the patch from the Omnissa Access 24.12 page in Customer Connect.

February 2025

New Audit Events for FIDO2 token registration

New audit events are introduced to provide additional debugging information for the FIDO2 token registration process. Audit events capturing successful and failed token registration details are available with this change.

Updated FIDO2 login prompts

With the updated FIDO2 authentication screens, users are prompted with a simpler and cleaner FIDO2 login screen. The login prompt to select FIDO2 authenticators can be removed from the login process through a new configuration option. Administrators can also optionally remove FIDO2 registration links from the login screens and have users register FIDO2 exclusively through the Intelligent Hub self-service portal.

Ability to send Targeted Hub notifications via Email List

IT Communications teams can now send Hub notifications to a subset of users based on their email addresses, streamlining the process and removing the need to create or maintain User Groups or Smart Groups just for sending notifications. This new feature allows admins to provide an email list, using the new ‘Email Recipients’ Target Audience Type, while creating the notification through the Hub Services Admin console, compose the notification message, and send it directly to the specified recipients.

Ideal for one-time or ad-hoc communications, this feature saves time and reduces administrative effort. Admins need to make sure that they are providing a maximum of 50 email IDs which are valid and correctly formatted to send notifications using this functionality.

December 2024

Omnissa Access Connector 24.12

Omnissa Access connector version 24.12 is now available. Upgrade to version 24.12 is supported from versions 24.07.0.0 and 23.09.0.0.

See the Omnissa Access On Premises 24.12 Release Notes and Upgrading Omnissa Access Connector for information.

November 2024

Support for Custom Notification Expiry Dates

The Hub Services admin console now enables administrators to set custom expiry dates for notifications. Once the specified expiry date is reached, notifications are automatically removed from the end user's view in both the For You and History sections. This feature allows administrators to better manage the visibility of notifications, ensuring that employees only see the most current and relevant information. By automatically clearing outdated messages, this enhancement helps reduce clutter and improves the overall user experience.

September 2024

Notification Deletion Now Available for Hub Services Admins

The Hub Services admin console now includes the ability for admins to delete previously sent notifications. Admins with super admin role can utilize this feature to remove notifications that were sent in error, contained incorrect information, or were distributed with ill intent. This deletion functionality ensures that admins can quickly and effectively retract messages that should no longer be visible to end-users, thereby maintaining the accuracy and integrity of communication within the platform.

Workspace ONE Intelligent Hub App Now Visible in the Hub Services App Catalog

The Workspace ONE Intelligent Hub app, when assigned through Workspace ONE UEM, will now be displayed in the Hub Services app catalog. Previously, the Intelligent Hub app did not appear in the catalog, limiting visibility to end-users. With this update, users can manually trigger updates to the Hub app, which is especially useful if there are issues with auto-pushed updates.

If admins prefer to revert to the previous behavior where the Hub app is hidden from end-users, they can utilize the Exclude Apps functionality to remove it from view. For more details on that, refer to the documentation topic Selectively Exclude Apps From Users in Intelligent Hub Catalog.

Omnissa Access Connector 24.07

Omnissa Access connector 24.07 is compatible with Omnissa Access Cloud, Omnissa Access On-premise 24.07, and Omnissa Access for FedRAMP.

Resolved Issues for Connector 24.07

This connector release includes the following resolved issues:

• HW-200932: Resolved an issue where Active Directory over IWA directory sync was failing with safeguard violations. A configurable option for comparing only attributes for updates during directory sync is now available.
• HW-200972: Prevent parallel sync if both People Search photo sync and directory sync are configured for the same time.
• HW-204691: Resolved an issue with directory sync exiting due to communication channel errors. A configurable parameter is available to set the number of hours after which scheduled sync starts automatically if the directory sync service exits due to unexpected communication channel errors.

July 2024

Granular Control for Self-Service Actions in Hub Services

Workspace ONE Hub Services admins now have greater flexibility and granular control when configuring actions available through Employee Self-Service (Support tab). Previously, actions were grouped into broad categories of critical and non-critical toggles in the Hub Services admin console, which limited admins to enabling or disabling entire groups of actions rather than specific individual actions. This lack of precision often led to less effective management and control over the available actions for end users.

With the new update, admins can now pick and choose specific actions they want to enable for end users, tailoring the self-service experience to better meet organizational needs and policies. For example, an admin can enable the Change Passcode action for a set of users or devices while keeping the Lock Device action disabled, thereby preventing unnecessary or potentially disruptive actions. This enhanced level of customization allows for more targeted and efficient management, improving both security and user experience by ensuring that only the necessary actions are accessible to end users.

Ability to Hide Apps from the App Catalog in Hub Services

The Hub Services admin console now allows admins to selectively hide apps from end users' view. This feature is particularly useful in scenarios where apps need to be assigned to specific devices, but admins want to manage their visibility in the catalog. By hiding these apps, admins can prevent user actions such as app updates or unintentional interactions, ensuring that app management remains centralized and controlled. This added flexibility allows for better oversight and maintenance, aligning app availability with organizational policies and strategies.

User Self-management of FIDO2 Keys in Hub Services

Workspace ONE Intelligent Hub web portal users can now manage their FIDO2 keys, configured in Omnissa Access for authentication, directly from the Hub web portal. Previously, only admins managed users' FIDO keys through the Omnissa Access admin console, which created a significant barrier to FIDO2 adoption. This limitation often resulted in end users having to submit support tickets for simple self-management tasks, such as replacing a FIDO2 key and customers had to deal with large volumes of such tickets.

With this enhancement, end users can fully manage their FIDO2 keys independently. They can view all registered keys, register new keys, and delete any previously registered keys. This newfound autonomy not only streamlines the user experience but also reduces the administrative burden, enabling smoother and more efficient authentication management.

Support Workspace ONE Content URLs/Deep Links in Hub Helpful links in Hub Services

Hub Services admins can now configure a Workspace ONE Content application URL or deep link as a helpful link in the Support tab, enhancing the usability of the Helpful Links section.

May 2024

Device Enrollment Terms of Use support in Workspace ONE Intelligent Hub

Workspace ONE Intelligent Hub app users can now view and act on updates to the Terms of Use (TOU) for any of their enrolled devices directly within the Intelligent Hub app. Previously, this functionality was only available through the Self-Service Portal (SSP), requiring users to log in separately, often delaying critical actions on TOU updates. By integrating this feature into the Intelligent Hub app, we streamline it into the regular employee workflow, allowing for more immediate responses to TOU updates.

This functionality is currently available on Hub Web and Windows. Workspace ONE UEM version 24.2.0.8 and later supports this feature.

Application Terms of Use support in Workspace ONE Intelligent Hub

Users of the Hub native applications (i.e. Hub iOS, Android and Windows) can now view and act on updates to the Terms of Use (TOU) associated with any applications installed on their devices. Previously, Intelligent Hub prompted users for TOU action (acceptance or rejection) only during the initial app installation via the Hub catalog, with no way to address subsequent TOU updates. This new feature enables users to stay updated and respond to TOU changes at any time.

This functionality is currently available on Windows on all Intelligent Hub app versions. For iOS and Android, please refer to the iOS and Android Hub release notes for the Intelligent Hub version which adds support for this feature.

Workspace ONE UEM version 24.2.0.8 and later supports this feature.

NOTE: This was the last significant parity gap between the Hub Services app catalog and the legacy UEM app catalog, which is already scheduled for end-of-life See KB article 95774

Increase in limit for Workspace ONE Intelligent Hub Employee Self-Service Helpful Links from 10 to 20

Hub Services admins can now configure up to 20 Helpful Links in the Employee Self-Service section of the Hub admin console, doubling the previous limit of 10 links. This increased capacity allows admins (UEM and Horizon) to provide more self-service content, such as knowledge bases (KBs), for end users in the Intelligent Hub Self-Support tab.

Support for Entra ID MFA as additional authentication method in Omnissa Access

Omnissa Access now enables integration with Microsoft Entra ID MFA as an additional authentication method. Users can log in to Omnissa Access using their existing authentication methods, and then be prompted for Entra ID MFA without an additional Entra ID login prompt. This feature simplifies the user experience while adding the feature-rich Entra MFA capabilities to Omnissa Access authentication.

January 2024

Support for PKCE and OAuth 2.0 Public Clients

PKCE (Proof Key for Code Exchange) is an extension to OAuth 2.0 Authorization Code flow that helps in securing OAuth tokens from CSRF and code injection attacks. OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. A communication path not protected by TLS is susceptible to this attack and an attacker can gain access to the authorization code and use it to obtain the access token.

PKCE extension utilizes a dynamically created cryptographically random key to ensure proof of possession by the client. Omnissa Access supports enabling PKCE for OAuth 2.0 public clients and clients participating in Authorization Code flow. Along with PKCE support, Omnissa Access now supports creation of OAuth 2.0 public clients. Public clients are useful for applications running in a browser or on a mobile device that cannot keep their registered client secret safe.

PKCE is enabled by default and is mandatory for all public clients created in Omnissa Access.

User Choice of Authentication

We are excited to announce the availability of User Choice of Authentication functionality with Omnissa Access. With this new feature, users have the flexibility to choose from a set of authentication options presented to them for their second factor authentication.

This feature is particularly valuable in scenarios where users might not have access to their second factor authentication option, such as a smartphone for receiving push notifications. In such cases, users can seamlessly opt for an alternative method from the presented choices to successfully complete the login sequence.

Administrators configure policies to control the availability of various authentication choices for specific authentication requirements. Further, conditional access parameters such as network range, device specifications, device management state or user groups can be configured to secure and customize authentication experience for end users.

This feature is available only with Omnissa Access SaaS.

December 2023

Support for Duo v4 SDK with Duo Universal Prompt

Omnissa Access now supports Duo v4 SDK. Duo v4 supports the new Duo Universal Prompt that provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements. Omnissa Access users are automatically migrated from traditional Duo prompt to Duo Universal Prompt after this support is rolled out. No admin action is required to enable this change.

Support for Horizon Client and App Launch from Shortcuts

Omnissa Access now provides an ability to relaunch Horizon published virtual desktops and apps from shortcuts using launch URLs. Prior to this release, when launching a shortcut pointing to the Horizon Client or app, users were directed to a blank screen that blocks the client or app launch. With this update, the app information and a launch option is provided to the user.

October 2023

Omnissa Access Connector 23.09

The Omnissa Access connector version 23.09 is compatible with Omnissa Access Cloud, Omnissa Access On-premise 23.09, and Omnissa Access for FedRAMP.

Resolved Issues for Connector 23.09

The following is a list of Connector resolved issues.

• HW-180874: The Default Launch Client setting for Horizon virtual apps collections is ignored

• HW-170798: Unable to sync Horizon Enterprise virtual apps collections when using a connection via a proxy

• HW-174051: Updating a virtual apps collection resets the network range

• HW-172671: Citrix App launch fails on Firefox browser

• HW-171435: Citrix App launch fails when the first connector in the virtual apps collection is down

• HW-170576: Unable to sync virtual apps collections when using a connection via a proxy

• HW-174269: Omnissa Access Connector 22.09.1 fails to install when the domain name has a '_' character

• HW-181989: Saving or syncing a Horizon virtual apps collection when a Horizon server is down removes existing metadata

• HW-170576: When a proxy is configured, the Virtual App service is unable to fetch metadata from a Horizon Cloud Service Single-Pod Broker setup

August 2023

Announcing General Availability of Mobile SSO for Apple Device Authentication in Omnissa Access

We are excited to announce the general availability of the Mobile SSO for Apple device authentication method - the next generation Mobile SSO feature in Omnissa Access.

As part of the iOS 13 SDK and MDM spec, Apple introduced a new cross-platform SSO extension that offered a native SSO approach using standard federation protocols. Mobile SSO for Apple devices in Omnissa Access leverages this native SSO Extension SDK in Apple.

In addition to providing seamless SSO across iOS and iPadOS devices, Mobile SSO for Apple authentication method in Omnissa Access offers configurable biometric authentication that allows using the platform's built-in biometric authenticators such as TouchID, FaceID or Passcode for additional authentications before accessing applications.

The Mobile SSO for Apple authentication method features the ability to limit Single Sign-On to selected apps. The solution uses certificate based authentication to Omnissa Access and supports Workspace ONE Shared iOS devices Check-In Check-Out use cases.

NOTE : The Workspace ONE Intelligent Hub app must be installed in the devices participating in SSO.

Mobile SSO for Apple is a replacement for Mobile SSO for iOS that's available with Omnissa Access today. Both solutions can however co-exist as part of migration configuration. A gradual migration from Mobile SSO for iOS to Mobile SSO for Apple is recommended. See the How to Migrate from Omnissa Access Mobile (for iOS) to Mobile SSO (for Apple Authentication Method article.

This feature is available only in the Omnissa Access Cloud environment.

Limit Devices in Staging Accounts from Viewing Other Devices

For devices that are enrolled in a staging account, the Workspace ONE Intelligent Hub app’s Support tab will no longer list all devices enrolled in that staging account. Instead, the Support tab will only reflect the current device to prevent any malicious user(s) from taking action on all the other managed devices shown on the Support tab for that account.

Note: This requires Workspace ONE UEM version 23.06 or later.

Improved Search Experience on Hub Web

The Search Bar in the Hub Web portal has been moved to a more prominent location. App and People Search can now be performed easily and no longer requires end users to navigate to the Apps or People tabs to perform search.

Add Hub Deep Links and Workspace ONE Web Deep Links in as Helpful Links in the Support Tab

Self Service Helpful links have been updated to support Workspace ONE Intelligent Hub and Workspace ONE Web apps' deep linking capabilities. This allows admins to setup helpful links that can seamlessly take their users to other parts of the Hub app using wsonehub://{deeplink} or launch web pages in a Web app using awb(s)://{url}.

Support for Windows 11 devices in Omnissa Access Policy Rules

Omnissa Access now recognizes Windows 11 devices for enrollment and conditional access. Prior to this support, access policies with device type set to Windows 10 were not applied to Windows 11 devices. With this update, the Windows 10+ device type rules will be used for Windows 10 and Windows 11 devices. This functionality is supported across all Windows 11 devices, including desktops and mobile devices.

Additional Self-Service Capabilities in the Support Tab

Workspace ONE Intelligent Hub Web now allows users to take actions such as Clear Passcode and Make Noise from the Support tab. These actions are enabled by default and can be managed by the admin from the Hub Services Console (Employee Self-Service > Device Self-Service > Non-Critical Actions).

May 2023

Omnissa Access GovCloud Now Supports FIDO2 Authentication

Omnissa Access GovCloud now allows FIDO2 authenticators to be registered and used for authentication. With this release, end users can authenticate into Omnissa Access using a FIDO2 authenticator (i.e., YubiKey, Touch ID, Windows Hello, etc.). End users can also self-register a FIDO2 authenticator to be used as their primary authentication or as a second factor authentication.

April 2023

Renewed Omnissa Access reporting interface in the Omnissa Access console

Omnissa Access reporting received a renewed facelift for administrator users. This new design is up to date and allows for simple navigation through the following reports.

• Recent Activity

• Resource Usage

• Resource Entitlements

• Resource Activity

• Group Membership

• Users

• Device Usage

• Provisioning Status

• Audit Events

Actions can be reconfigured with ease in new Role configuration page in the Omnissa Access console

The new navigation for configuring Roles allows for all actions to be added, reconfigured, and removed for a service. Roles can be customized with specific actions for each service in any fashion. Users that can manage administrator roles will also be able to delete any or all of the actions configured for a service.

Refreshed Omnissa Access Navigation Pages

We are adding new navigation pages to the Omnissa Access console that were refreshed with an up-to-date design. The following pages have a fresh look and feel.

• UEM Integration page

• Directory page

• Identity Provider page

Before You Begin

Compatibility Matrix

The Omnissa Product Interoperability Matrix provides details about the compatibility of current and previous versions of Omnissa products and components.

Omnissa Access Connector

See the Omnissa Access Connector Release Notes for information about the connector.

Documentation

• Omnissa Access Cloud
• Omnissa Access Connector

Internationalization

See KB article 6000664: Announcing Omnissa Localization Support for information about localized content.

Support Contact Information

Contact the Support team at Omnissa Customer Connect when you need help with your Omnissa Access environment. See How to file a Support Request in Customer Connect and via Cloud Services Portal.