A quiet summer week in EUC: Thomas Marcussen's Entra SMS and voice MFA retirement playbook, a passkey migration setting, Login Enterprise 6.8.6, ControlUp, IGEL UMS and more.

This week's EUC roundup leans on the community: Niehaus on WSUS, Reinhard on Enterprise App Management, Billekens' vendor-neutral Workspace Optimizer, a GO-EUC benchmark, and Omnissa's Forrester win.

Weekly End User Computing roundup for 15-22 July 2026: NetScaler CVE-2026-8451 still exploited, a record Windows Patch Tuesday, Entra retiring SMS/voice MFA, XenServer 9 preview, Nutanix and vSphere deadlines, Intune E3/E5 changes and more.

Over the past few months, I’ve been looking into some of the trickier issues in environments that combine Omnissa Horizon Instant Clones, Hybrid Azure AD Join, App Volumes and even TrueSSO. A true resonance cascade For issues with PRT when federated EntraID to Omnissa Access and when using TrueSSO read my previous post: The Hybrid Join Incident: Recovering the Lost PRT 1. PRT unpredictability and the “Wait for Hybrid Join” setting One of the biggest headaches in Instant Clone

A few years back, VMware Verify reached end of life (2022). Since then, we basically had two options left from the Omnissa perspective: a TOTP authenticator app based on RFC 6238 or Intelligent Hub MFA with push notifications. The TOTP option works well, especially for Bring Your Own Devices (BYOD) , but users still end up typing in codes constantly. Intelligent Hub MFA solves that with push, but the downside is that it requires some level of device management or registration

Although with many implementations of the Workspace One platform Workspace One Access is configured as the IDP (personally preferred when using this platform) I also encounter customers where EntraID is the preferred IDP with mostly valid reasons. There are use cases this is the better choice. With the flexibility Workspace One Access offers this is no issue at all. But when shifting the IDP to EntraID I usually advice to also shift the Conditional Access policies to EntraID.

More and more authentication methods are available to Workspace One Access and one of them is FIDO2. I’ve seen multiple use cases with the well-known Yubico Security Keys. But did you know you can also use Windows Hello as Security key? So, to put it in context, you can use Biometrics or PIN as identifier and login to Workspace One Access without sending credentials! Rock On! How does FIDO2 work? FIDO2 is like having a digital key that unlocks your online accounts instead o

As mentioned in my previous blog I was discussing a valid migration scenario between an existing Citrix Deployment to VMware Horizon with my buddy Henry Heres. One of the steps is to migrate the external portal from Citrix (Unified) Gateway to VMware WS One Access. This will be a divided in to two blogs describing the 2 steps. This blog is Step 2! In this step we will switch the portal to VMware WS One Access. Same as the previous one, I will show the flow, Henry will show t

A while ago I was discussing a valid migration scenario between an existing Citrix Deployment to VMware Horizon with my buddy Henry Heres. One of the steps is to migrate the external portal from Citrix (Unified) Gateway to VMware WS One Access. As seen before, discussing these kind of scenarios with Henry is like planting a seed and pouring a gallon of Pokon on top of it. So, we decided to do a Cross reference Blog. I will show the flow, the blog(s) made by Henry will show h

Lately a lot has been written about the EOL of VMware Verify. But… what if you are already used to Imprivata and maybe have the Confirm ID for remote access licenses around? Can we use this instead? Yes you can! How? By connecting to Imprivata with RADIUS. Is this new? Nope… they even call this the legacy experience. But sometimes legacy is just what you might need so he ho, let’s go! Of course: As an alternative to this you can use the VMware Authenticator or Intelligent HU

As I mentioned in my previous blog VMware Verify goes EoS and EoA on on October 31st, 2022. VMware developed (sort of) 2 alternatives: Intelligent HUB verify and the Authenticator App. Yeah Great news!: The Authenticator App is GA (Globally Available) since 10-06-2022 What is the Authenticator App? Authenticator App (any app supporting TOTP RFC 6238 standard)*: By adding support for authenticator apps that use time-based one-time passcodes (TOTP) such as Microsoft Authenticat

Awesome: VMware Verify (Intelligent HUB) is available within the Default Access Policy on al device platforms! Little back story: As stated in the following article: Workspace ONE Access: VMware Verify End-of-Life Migration Paths (88424) VMware Verify will reach end-of-support (EoS) and end-of-availability date (EoA) on October 31st, 2022. This gave us some headaches.. what are the alternatives? VMware Verify worked very well and gave us the basic features we requested… like