Service Integration

This chapter is one of a series that make up the Omnissa Workspace ONE and Horizon Reference Architecture, a framework that provides guidance on the architecture, design considerations, and deployment of Omnissa Workspace ONE and Omnissa Horizon solutions. This chapter provides information about building integrated services for users.

Introduction

At this stage, the Omnissa Workspace ONE and Omnissa Horizon components have been designed and deployed, and the environment has all the functionality and qualities that are required. We can now proceed to creating the parts from each component and assembling and integrating them into the various services that are to be delivered to end users. Some components are common to multiple services.

Workspace ONE Use Case Service Integration

The following table lists the parts required for each Omnissa Workspace ONE service. The rest of this section details the design and configuration of each service.

Table 1: Workspace ONE Service Requirements

	Enterprise Mobility Management Service	Enterprise Productivity Service	Enterprise Application Workspace Service
Workspace ONE UEM	X	X	X
Workspace ONE Access	X	X	X
AirWatch Cloud Connector	X	X	X
Workspace ONE Access Connector		X	X
Adaptive management	X
Device enrollment		X	X
Native mobile apps	X	X	X
SaaS apps	X	X	X
Unified app catalog	X	X	X
Mobile email management		X
Mobile content management		X
DLP restrictions		X	X
Secure browsing		X
Mobile SSO	X	X	X
Conditional access		X	X
Horizon 8 or Horizon Cloud Service			X
Unified Access Gateway			X

The two broad categories of application types are handled as follows:

SaaS applications – Are added from the Workspace ONE SaaS cloud catalog and are entitled to appropriate users.
Native mobile apps – Are added from the Workspace ONE UEM Console. Privileged apps have the Require Management option selected; other apps do not.

Enterprise Mobility Management Service

The Enterprise Mobility Management service brings an organization that has minimal device management capabilities—such as Exchange ActiveSync policies applied for passcode, wipe, and other basic settings—under an EMM strategy.

The devices are initially configured to support adaptive management. Some less critical applications are enabled for SSO, while other applications are configured to require enrollment. Employees are encouraged, but not required, to enroll their devices. Users can use their native email clients, email apps available from the public app stores, or Workspace ONE Boxer.

Figure 1: Enterprise Mobility Management Service

Devices in this service have the following characteristics.

Table 2: Configuration Considerations for the Enterprise Mobility Management Service

Service Feature	Configuration Considerations
Adaptive management	Adaptive management enables applications such as WebEx and Concur to be used with mobile SSO across all platforms without device enrollment. Other applications, such as HR sites, ADP, or Salesforce, require device enrollment to have a high degree of control over the device. Users are encouraged to download the Workspace ONE app from a public app store. Applications that are deemed to have a higher risk to user or company data are set to require management in the Workspace ONE UEM device profile.
Active Directory – cloud password authentication	Workspace ONE Access is configured with a policy to use the cloud password from the built-in identity provider and authenticate through the Workspace ONE Access Connector to the Active Directory account.
Email access	Users are provided appropriate documentation on how to configure their device for native or third-party email client access. If users choose to install Workspace ONE Boxer, their email configuration is automatically pushed to the device. Typically, users are provided with the Exchange ActiveSync Server address (outlook.office365.com) and their email address and password.
Enrollment	Enrollment is completed through the Workspace ONE application. If a user attempts to access an application that has been deployed as one that requires management in Workspace ONE UEM, the enrollment process is initiated. After enrollment in Workspace ONE, end users have all applications available to them. They can also use mobile SSO after they have enrolled because they have a device profile. This profile deploys the appropriate payloads to authenticate using the appropriate SSO technology. Additional compliance information is passed to Workspace ONE Access. If the device is no longer in compliance, the user loses access to the applications provided by Workspace ONE Access.

Enterprise Productivity Service

The Enterprise Productivity service builds on the previous service in that it begins with devices that have been enrolled with the Workspace ONE Intelligent Hub and that are fully managed at deployment. When new devices are brought into the organization, they are essentially quarantined until enrolled.

Devices in this service have the following characteristics.

Table 3: Configuration Considerations for the Enterprise Productivity Service

Service Feature	Configuration Considerations
Device enrollment	All devices in the Enterprise Productivity service are required to enroll using the Workspace ONE Intelligent Hub. These devices are likely to have valuable enterprise data on them and so require a higher level of control and security.
Email restrictions	Native and third-party email apps are blocked, and all users use Workspace ONE Boxer for increased security.
Content access	Workspace ONE Content is pushed to the device and configured for secure access to corporate repositories.
Secure browsing	Workspace ONE Web is pushed to the device to ensure that links to intranet sites are always opened in a secure browser.
Email access	Email and content are delivered from Microsoft Office 365, so federation with the Microsoft Office 365 service is enabled to allow SSO to the Office service and native mobile Microsoft Office 365 apps.
Data loss prevention	DLP components are enabled within Workspace ONE Content and Workspace ONE Boxer to prevent the use of unapproved applications, ensuring that data cannot be inadvertently or purposely copied and pasted into other apps.

Figure 2: Enterprise Productivity Service

Table 4: Configuration Considerations for Microsoft Office 365 Federation

Configuration Item	Tasks and Considerations
Federation to Microsoft Office 365	Workspace ONE Access uses the Microsoft Federated Identity approach to authenticate login requests to the Microsoft Office 365 service. For information about this configuration, see the following resource: The Workspace ONE Access and Microsoft Azure with Office 365 Integration video
Enable federation in the Microsoft Office 365 or Microsoft Azure AD portals	Sync Active Directory user accounts through the Microsoft Azure AD or Microsoft Office 365 portal. Use PowerShell scripting to configure the Microsoft Office 365 service to authenticate through Workspace ONE as a federated identity provider. A set of PowerShell scripts with appropriate parameters and signing certificates establish trust between Microsoft Office 365 and Workspace ONE Access. Note: An important criterion to make Microsoft Office 365 integration work is ensuring that the attribute ObjectGUID is synced from AD to the Workspace ONE Access service.
Configure Microsoft Office 365 apps in Workspace ONE Access	Using the templates in the Cloud Application Catalog, configure the Microsoft Office 365, WS-fed based template to allow authentication against Workspace ONE Access for Microsoft Office 365-based apps and resources, such as email, SharePoint Online, Skype for Business, and other Microsoft Services.

Table 5: Configuration Considerations for Email

Configuration Item	Tasks and Considerations
Email integration with Microsoft Office 365 through PowerShell	Workspace ONE UEM issues commands through PowerShell to Exchange in Microsoft Office 365. Devices communicate directly with Exchange ActiveSync in the Microsoft Office 365 service. For full configuration information, see PowerShell Integration with Workspace ONE UEM.
PowerShell Roles in Office 365	PowerShell requires specific roles to be established in the Microsoft Office 365 administration portal for Exchange. These roles enable the execution of PowerShell cmdlets from Workspace ONE UEM to the Microsoft Office 365 service.
Blocking and quarantine rules	To prevent unauthorized devices from connecting to the Exchange server, you can block or quarantine devices until they have enrolled. PowerShell commands are used to set the appropriate policy. These rules are not needed for environments where enrollment is not required.
Email compliance policies	Compliance policies for email include a range of options for controlling managed and unmanaged devices: Must the device be enrolled to perform email sync? Which email clients are allowed to sync email? Is device encryption required for email sync? Are jail-broken or otherwise compromised devices allowed?
ActiveSync profiles for email clients	To enable email sync, you must configure the Exchange ActiveSync payload for the device profiles. The hostname for Microsoft Office 365 is typically outlook.office365.com. The domain, username, and email address are configured with lookup values. Make sure that these values are available in the directory and are properly mapped from AD through the AirWatch Cloud Connector (ACC).

Table 6: Configuration Considerations for Content

Configuration Item	Tasks and Considerations
Content integration with Microsoft Office 365	Integration is established through the Workspace ONE UEM Console under the Content node. From here, you configure templates for the SharePoint libraries in Microsoft Office 365, to sync to the mobile devices. For more information see Corporate File Servers.
Office 365 SharePoint document libraries	Use https://portal.office.com to log in to Microsoft Office 365 and create SharePoint sites with document libraries containing content.
Content templates in Workspace ONE UEM for automatic deployment	To create these templates: In the Workspace ONE UEM Console, access the Content node, select Templates, and then select Automatic. Configure SharePoint Office 365 as the repository type. Configure the Link field with the path to the SharePoint document library. For example, https://<domain>.sharepoint.com/Sales_Material/Shared%20Documents Enable Allow Write if read/write access is needed. If content is synced, choose Allow Offline Viewing. If content is used with other apps, select Allow Open in Third Party Apps. Review other security settings per your enterprise policy. Assign appropriate groups to the repository. For more information, see the Enable End-User Access to Corporate File Server Content section in Corporate File Servers.
Workspace ONE Content	To ensure access to content, require that Workspace ONE Content be automatically deployed to groups who use SharePoint.

Table 7: Configuration Considerations for Data Loss Prevention

Configuration Item	Tasks and Considerations
DLP configuration on a global basis	You can set DLP configuration on a global basis, platform basis, or per application deployment. For DLP settings to take effect, the application must be built with the Workspace ONE Software Development Kit (SDK), or, for an internal application, DLP settings must be supported through app wrapping. Workspace ONE Boxer, Workspace ONE Content, and Workspace ONE Web are built using the Workspace ONE SDK and honor the settings chosen.
SDK profile defaults for iOS or Android	SDK profiles allow global configuration of DLP settings that are applied to applications on the platform for which the profile is defined. Policy settings include enabling or disabling: Printing Composing email Location services Data backup Camera Watermarking Ability to open documents in certain apps Copy and paste in and out Third-party keyboards
Custom policies for Workspace ONE Content and Workspace ONE Boxer	Workspace ONE Content can use the default policies defined in the SDK profile, or defaults can be overridden by enabling custom policies. Requiring MDM (mobile device management) enrollment ensures that content is accessed only by enrolled devices.
Email compliance policies	When configuring Workspace ONE Content policies, verify that the email compliance policies match corporate standards, including whether devices must be enrolled in device management to receive email.

Table 8: Configuration Considerations for Access and Compliance Policies

Policy	Tasks and Considerations
Workspace ONE UEM compliance	Create a compliance policy for the appropriate platforms through the Workspace ONE UEM Console. Criteria for evaluation can include jail-broken or rooted devices, devices that have not checked in to the Workspace ONE UEM environment in a certain period of time, or the installation of denylisted applications. The policy can include an escalation of notifications as actions, starting with an email notification to the user, followed by an email notification to an administrator, and ultimately blocked access to email if the device is not remediated in time.
Workspace ONE Access compliance	Workspace ONE Access compliance checking is enabled through policy configuration. Policies include device compliance with the Workspace ONE UEM authentication adapter and other authentication methods, such as a password. You can use the policies in conjunction with network ranges, OS platforms, or specific applications, allowing varying requirements to evaluate whether an application can launch based on the location of the user, which device they are using, and how they are authenticating.

Policy

Tasks and Considerations

Workspace ONE UEM compliance

Create a compliance policy for the appropriate platforms through the Workspace ONE UEM Console. Criteria for evaluation can include jail-broken or rooted devices, devices that have not checked in to the Workspace ONE UEM environment in a certain period of time, or the installation of denylisted applications.

The policy can include an escalation of notifications as actions, starting with an email notification to the user, followed by an email notification to an administrator, and ultimately blocked access to email if the device is not remediated in time.

Workspace ONE Access compliance

Workspace ONE Access compliance checking is enabled through policy configuration. Policies include device compliance with the Workspace ONE UEM authentication adapter and other authentication methods, such as a password.

You can use the policies in conjunction with network ranges, OS platforms, or specific applications, allowing varying requirements to evaluate whether an application can launch based on the location of the user, which device they are using, and how they are authenticating.

Enterprise Application Workspace Service

The Enterprise Application Workspace service has a similar configuration to the Enterprise Productivity service, but also includes access to Horizon applications running on Horizon or Horizon Cloud. Horizon resources can be synced with Workspace ONE through an outbound-only connection from the Workspace ONE Access Connector. This method allows entitlements to sync to the service.

Inbound access to the Horizon environment or the Horizon Cloud pod, virtual desktops, and applications is still required. Therefore, Unified Access Gateway is also part of this solution.

Components in the Enterprise Application Workspace service have the following unique characteristics.

Table 9: Enterprise Application Workspace Service Details

Component	Purpose
Workspace ONE Access Connector	The connector component of Workspace ONE Access is installed and runs as a service on a Windows server. The connector integrates with your enterprise directory to sync users and groups to the Workspace ONE Access service and to provide authentication.
Horizon entitlements	Entitlements are enabled through the Workspace ONE Access catalog by connecting to Horizon pods or Horizon Cloud tenants that expose user-entitled apps and desktops. The Horizon-based services that facilitate these entitlements are described separately, in the following sections of this guide: Horizon 8 Use Case Service Integration and Horizon Cloud on Microsoft Azure - first-gen Use Case Service Integration.
Unified Access Gateway	This component enables external Horizon Client devices to securely access Horizon resources for virtual apps and desktops.

Figure 3: Enterprise Application Workspace Service

Table 10: Configuration Considerations for Workspace ONE Access

Configuration Item	Tasks and Considerations
Workspace ONE Access Connector deployment	The connector can be deployed either on-premises or in any data center that has a line of sight to Active Directory domain controllers. Instructions for deploying the connector are given in Installing Workspace ONE Access Connector 23.09.
Directory sync	After the connector is deployed, directory synchronization is performed to sync Active Directory users and groups with the Workspace ONE Access service. For more information, see Directory Integration with Workspace ONE Access.
Access to Horizon desktops and applications in the Workspace ONE app catalog	To make Horizon resources available in the Workspace ONE app, you create one or more virtual apps collections in the Workspace ONE Access administration console. The collections contain the configuration information for the Horizon pods, as well as sync settings. See Providing Access to Horizon Desktops and Applications in Workspace ONE Access and Using SAML Authentication for Workspace ONE Access Integration. User entitlements for apps and desktops are made available through the Horizon configuration and automatically appear in the Workspace ONE app and in a web browser.
Access to Horizon from external devices	To access the resources made available through Horizon, you must establish a means of access from Internet-based devices. You can configure Unified Access Gateway and optionally True SSO to allow egress and provide connectivity to the Horizon pods. See Deployment with Horizon 8 in the Unified Access Gateway documentation.
Access to Horizon Cloud desktops and applications in the Workspace ONE app catalog	To make Horizon Cloud resources available in the Workspace ONE app, you create one or more virtual apps collections in the Workspace ONE Access administration console. The collections contain the configuration information for the Horizon Cloud tenants, as well as sync settings. See the following documentation: Horizon Cloud Environment with Universal Broker - Integrate the Tenant with Workspace ONE Access and Intelligent Hub Services A Horizon Cloud Environment with Single-Pod Brokering — Integrating the Environment’s Horizon Cloud Pods in Microsoft Azure with Workspace ONE Access Providing Access to Horizon Cloud Service Desktops and Applications in Workspace ONE Access User entitlements for apps and desktops are made available through the Horizon Cloud configuration and automatically appear in the Workspace ONE app and in a web browser.
Access to Horizon Cloud from external devices	To access the resources made available through Horizon Cloud, you must establish a means of access from Internet-based devices. You can configure Unified Access Gateway along with True SSO to allow egress and provide connectivity to the Horizon Cloud pods. Unified Access Gateway appliances can be automatically deployed in external or internal configurations. See Add a Gateway Configuration to a Deployed Horizon Cloud Pod.

Table 11: Configuration Considerations for Horizon Client

Configuration Item	Consideration
Horizon Client native app	When Horizon resources are used in Workspace ONE, the resources appear on the Launcher page of the app, but the resources launch using the Horizon Client native mobile app.

Horizon 8 Use Case Service Integration

The following table details the parts required for each Omnissa Horizon 8 based service. The rest of this section details the design and build of each of these services.

Table 12: Components Required by Horizon Services

	Published App Service	GPU- Accelerated App Service	Desktop Service	Desktop with User-Installed App Service	GPU- Accelerated Desktop Service	Linux Desktop Service
Windows 11 or 10 instant clone			X	X	X
RDSH instant clone	X	X
Linux instant clone						X
App Volumes package	X	X	X	X	X
App Volumes writable volume				X	X
Dynamic Environment Manager	X	X	X	X	X
Smart Policies	X	X	X	X	X	X
Application blocking		X	X	X	X
Folder redirection	X	X	X	X	X
GPO	X	X	X	X	X
Virtual printing	X	X	X	X	X
ThinApp Packages	X	X	X	X	X
SaaS apps			X	X	X
Unified Access Gateway	X	X	X	X	X	X
True SSO	X	X	X	X	X
vGPU		X			X

Multiple Horizon 8 services can use the same underlying desktop pool type (core service). When there is no variation in the hardware specifications of the desktop, you can reuse the same pool to address multiple use cases. App Volumes and Dynamic Environment Manager can provide the customization to the use case.

Horizon 8 Published Application Service

This service is created for static task workers, who require a small number of Windows applications.

Core Service

The core service consists of RDSH-published applications that can optionally be made available to end users through the Workspace ONE app catalog. A Horizon 8 server farm is created running Windows Servers with Remote Desktop Server Host (RDSH) enabled.

Figure 4: Horizon 8 Published Application Service – Core

Table 13: Configuration Considerations for RDSH-Published Applications

RDSH Instant Clone	Configuration Considerations
Windows Server golden image VM	Build a Windows Server VM using the guidelines in Manually Creating Optimized Windows Images for Horizon VMs.
Automated RDSH farm	Create a Horizon 8 RDSH automated farm using the prepared golden image VM. See Creating and Managing Farms. For details on the specific settings to use, see the Horizon Installation and Configuration section in Horizon 8 Configuration.

RDSH Instant Clone

Configuration Considerations

Windows Server golden image VM

Build a Windows Server VM using the guidelines in Manually Creating Optimized Windows Images for Horizon VMs.

Automated RDSH farm

Create a Horizon 8 RDSH automated farm using the prepared golden image VM. See Creating and Managing Farms.

For details on the specific settings to use, see the Horizon Installation and Configuration section in Horizon 8 Configuration.

Applications

The applications available from the RDSH server farm can be either of the following:

Applications that are installed in the golden image VM.
Applications that are part of App Volumes packages, which are attached to the RDSH server at system startup.

We assign the package containing the core software programs, and each RDSH instant-clone server has the same software program set for publishing.

Placing the software programs in packages allows for the separation of the application from the Windows operating system. This strategy can offer operational efficiencies, such as updating applications without having to update the golden image VM and the RDSH server farm. It also allows the golden image VM to be reused for different farms that might use different applications.

Figure 5: Horizon 8 Published Application Service – Applications

Table 14: Configuration Considerations for packages in the Horizon 8 Published Application Service

App Volumes	Configuration Considerations
Overview	Create packages as required to address the use cases. With RDSH instant clones, App Volumes saves us from needing to install the same apps on each node. We assign the package containing the core software programs so that each RDSH instant-clone server has the same software program set for publishing.
Packaging machine	Because the packages are created for an RDSH server, each package should be captured on the same operating system to ensure that applications are compatible with the OS that they are being attached to.
Core applications	Create a package to contain all core software programs to be delivered as RDSH-published apps. Follow the instructions in Working with Applications for details. These package-delivered apps are published through RDSH. Assign and entitle the packages to an Active Directory OU containing the RDSH server machine accounts—these are machine-based assignments. Note: OU-based assignments are not required but ensure that packages are available as soon as new hosts in an RDSH farm are provisioned.
Application pool	Use the Horizon 8 Administrator console to add an application pool and publish the desired applications. See Creating Application Pools. Entitle the relevant user groups to the matching published applications.

Profile and User Data

With Dynamic Environment Manager, a combination of Windows and application environment settings, user preference settings, and folder redirection work together to create and maintain the user profile.

Figure 6: Horizon 8 Published Application Service – Profile and User Data

For detailed instructions for all of the tasks mentioned in the following table, see the Dynamic Environment Manager Administration Guide.

Table 15: Configuration Considerations for User Profiles in the Horizon 8 Published Application Service

Profiles	Configuration Considerations
Environment settings	Map the H: drive to the users’ home drive with Dynamic Environment Manager. Map location-based printers with Dynamic Environment Manager, according to the IP address range.
Personalization – applications	Verify that Dynamic Environment Manager Flex configuration files are created and configured properly for each application that allows users to save preference settings. Verify that each application that persists user settings across sessions has a Dynamic Environment Manager Flex configuration file. If a Dynamic Environment Manager Flex configuration file does not exist, use the Application Profiler to create one and place it in the configuration share. See Introduction to Dynamic Environment Manager Application Profiler to get started.
Folder redirection	Folder redirection is configured from Dynamic Environment Manager, which redirects user profile folders to a file share so that user data persists across sessions. See the Horizon Group Policies section in Horizon Configuration.
Smart Policies	Leverage Horizon Smart Policies to apply the Internal Horizon Smart Policy profile, which allows USB, copy and paste, client-drive redirection, and printing. See the Horizon Smart Policies section in Dynamic Environment Manager Configuration.