A quiet summer week in EUC: Thomas Marcussen's Entra SMS and voice MFA retirement playbook, a passkey migration setting, Login Enterprise 6.8.6, ControlUp, IGEL UMS and more.

This week's EUC roundup leans on the community: Niehaus on WSUS, Reinhard on Enterprise App Management, Billekens' vendor-neutral Workspace Optimizer, a GO-EUC benchmark, and Omnissa's Forrester win.

Weekly End User Computing roundup for 15-22 July 2026: NetScaler CVE-2026-8451 still exploited, a record Windows Patch Tuesday, Entra retiring SMS/voice MFA, XenServer 9 preview, Nutanix and vSphere deadlines, Intune E3/E5 changes and more.

A few weeks ago, I did a research with Leee Jeffries for GO‑EUC on NVMe memory tiering versus traditional swap in VMware ESXi. VMware ESXi Memory Management Reimagined: NVMe Tiering vs Traditional Swap | GO-EUC The article sparked some great discussions and there is an important caveat when it comes to vGPU desktops that I want to highlight. vGPU Desktops Always Need Full DRAM Here’s the thing that often trips people up: every VM with a vGPU requires all of its RAM to be rese

Over the past few months, I’ve been looking into some of the trickier issues in environments that combine Omnissa Horizon Instant Clones, Hybrid Azure AD Join, App Volumes and even TrueSSO. A true resonance cascade For issues with PRT when federated EntraID to Omnissa Access and when using TrueSSO read my previous post: The Hybrid Join Incident: Recovering the Lost PRT 1. PRT unpredictability and the “Wait for Hybrid Join” setting One of the biggest headaches in Instant Clone

A few years back, VMware Verify reached end of life (2022). Since then, we basically had two options left from the Omnissa perspective: a TOTP authenticator app based on RFC 6238 or Intelligent Hub MFA with push notifications. The TOTP option works well, especially for Bring Your Own Devices (BYOD) , but users still end up typing in codes constantly. Intelligent Hub MFA solves that with push, but the downside is that it requires some level of device management or registration

Single Sign-On in modern environments can be a beautiful thing, until it isn’t. You’ve federated Entra ID to Omnissa Access, implemented Hybrid Join, and everything works perfectly when users log in with their username and password. But then you try it externally. TrueSSO is in place to make VDI logins seamless, certificates replace passwords and suddenly the PRT never shows up. Microsoft apps (Teams v2 being the most noticeable) rely increasingly on the PRT for full Single S

If you’ve integrated Workspace ONE Access with Microsoft 365 before, the steps will look familiar. Omnissa Access is the evolution of VMware Identity Manager, and while the interface and URLs have changed slightly, the principle remains the same: let Microsoft 365 trust Omnissa Access as the identity provider for your domain. This post walks through the new way to federate Entra ID with Omnissa Access using the Microsoft Graph PowerShell SDK. It replaces the legacy MSOnline m

Measuring Real Latency — The Missing Piece in VDI Performance Latency isn’t just a number you pull from monitoring tools. It’s about the delay users feel, the gap between when they click and when something actually happens on their screen. In virtual desktop environments, traditional latency metrics (like server response times or network delays) only tell part of the story. Users interact with their device locally, so the real question is: how long does it take until their sc

You know, most VDI environments run like a well painted canvas. The default FSLogix GPO covers most users with smooth even strokes. They are happy users, their profiles load fast, and the picture looks just right. But then there are the VIPs, those special users with bold bright colors. The users with massive OST caches that need a bigger space, or the sales crew whose Teams data just keeps growing like a happy little forest. This is when the ObjectSpecific keys step in, like

Omnissa Intelligence has been in the stack for a while now. Most people knew it existed, but it often got ignored, to many day-to-day concerns like UEM, Horizon, or App Volumes. Intelligence always looked promising, but it felt like another dashboard with too many lines and not enough relevance. That... is changing. The Digital Employee Experience (DEX) side of Omnissa Intelligence has received serious attention. It is now mature enough to actually do something useful in r

On december 18, 2024, I had the honor to do a live webinar with Leee Jeffries. "Mastering the Multi-Layered EUC Environment: A Journey Through the Maze" We show how we test and validate the layers with Login VSI. Some of the technologies mentioned are Omnissa Horizon and Appvolumes, Liquit part of Recast Software, IGEL Technology and Microsoft EntraID Conditional Access... sounds like a challenge right!? In case you missed it, here is a link to the recording: Mastering the M

So… on December 19th of 2024, Omnissa released App Volumes 2412. One change I’m most thrilled about: MSI for Windows Endpoints AND and discovered: Physical Endpoint support! App Volumes now supports MSI-wrapped VHD packages, alongside traditional VHD and VMDK formats. This allows the App Volumes agent to operate independently within existing delivery infrastructures such as Workspace ONE UEM, Microsoft Intune, and Microsoft Configuration Manager. and with the parameters of th

Although with many implementations of the Workspace One platform Workspace One Access is configured as the IDP (personally preferred when using this platform) I also encounter customers where EntraID is the preferred IDP with mostly valid reasons. There are use cases this is the better choice. With the flexibility Workspace One Access offers this is no issue at all. But when shifting the IDP to EntraID I usually advice to also shift the Conditional Access policies to EntraID.

Recently got involved in designing and building a new awesome blistering fast Omnissa Horizon environment for a hospital. This new environment is based on the latest Horizon ESB, DEM, AppVolumes, Windows 11 etc. And as many hospitals do, they use Imprivata OneSign. We ran into a bug. When logging in to the desktop (either Imprivata Client or Horizon client directly) we got confronted by the Imprivata GINA screen. Once again entering credentials and the desktop continues. Reco

A while ago I created a discission tree to explain/help customers and coworkers with a couple of the design choices possible with the FSLogix Office 365 and/or the Profile Containers. I thought to share this, hoping this will help others in their decision making! If you need any help, additional explanation, have any remarks or additions I should add, please let me know! First starting with some of the basics, if you don't need the basics just scroll down to use the chart! W

More and more authentication methods are available to Workspace One Access and one of them is FIDO2. I’ve seen multiple use cases with the well-known Yubico Security Keys. But did you know you can also use Windows Hello as Security key? So, to put it in context, you can use Biometrics or PIN as identifier and login to Workspace One Access without sending credentials! Rock On! How does FIDO2 work? FIDO2 is like having a digital key that unlocks your online accounts instead o

A while ago I wrote a cross reference blog with my buddy Henry Heres about integrating Citrix Gateway and VMware Workspace One Access. A respected customer read these blogs and tried integrating this in their environment but ran in to issues and called for some assistance. Unfortunately, the original scenario we blogged about did not work in this specific environment, so I had to find an alternative way. In this blog I will show you another option and how to configure this!

A new feature available since vSphere 8.0 U2 is federated authentication with Microsoft Entra ID (Azure Active Directory) and provision the users with SCIM. This is really nice since it is now possible to create Single Sign On, leverage Conditional Access policies and Multi Factor Authentication (MFA). In this blog I will explain step by step how to configure this and how to mitigate a in my opinion big fat no no required in the original documentation: Expose vCenter to the

As you probably already know App-V was originally scheduled to end in January this year (2023). Recently Microsoft announced they pushed the EOL date to April 14th, 2026 so you have still have some air left. But you have to think about a new strategy to deliver the apps. A great alternative is VMware AppVolumes! Little is known you can also use this when you use Citrix Virtual Apps and Desktops. Even better you can use this with the new amazing AppVolumes on Demand feature!