I got a question from a customer if they can leverage VMware’s MFA technology (Verify) to secure access to their Office 365 environment. Which of course they can, but they were even more curious if they can do it without the Azure Active Directory P1 license. And the answer is again yes.

What the customer needs to do is to federate the authentication of their O365 environment to Workspace ONE Access tenant and then they can leverage the great conditional access we have (including MFA) to secure their environment.

I thought that it would be a good example to show them, how simple and quick it is to federate a blank O365 tenant with Workspace Access.

I am writing this post, because I burned my fingers recently, thinking that I can outsmart the process. Long story short:

Can you deploy it on ESXi host without a vCenter server? No, you can’t – you need to have a vCenter server.

Unless you want to see me struggling, there is no point on reading further. 😀

Workspace ONE Tunnel is a per-app VPN technology, which is pretty easy to deploy and work on all major platforms today (iOS, Android, macOS and Windows 10). In order for this to work you need to deploy a Unified Access Gateway in a DMZ and configure a few things in Workspace ONE UEM console.

Deploying such virtual appliance can be really simple – one machine with one NIC. This is what I typically deploy for testing or PoC. But what if you require something little bit more secure?

Securing the external access to Horizon with MFA is de facto a standard today. There are a lot of MFA solutions out there, but some of them are more popular than others. I see a lot of traction for Azure MFA, that’s why I decided to show you how to integrate this technology with VMware Horizon.

In my next post about Workspace ONE Access, I would like to finally move away from using passwords and change it to something more secure and way more convenient for the employees. I am talking about certificate-based authentication.

I think I will continue the trend I started in the last post (about Windows 10 OOBE) and show you a short video about the look and feel of the result.

You haven’t seen any rocket science video, but it’s pretty cool, that we have just eliminated passwords from the login process. The employee is prompted for a certificate, which in this case was automatically requested for him during the enrollment using our device management solution Workspace ONE UEM. 

Recently I’ve been in many conversations about Teams and running them on top of Horizon virtual desktop. I’ve seen a couple of implementation where Teams are installed during user logon every single time (because of the nature of non-persistent instant clones).

This is not the way how to run Teams on Horizon. This post will be a “quick tip” how to speed up your logon time for your user, because we will install Teams properly to the master/golden image.

This post will be a bit different because I will show you the end result first. 🙂

What we want to achieve in the out of box enrollment experience. In real world this means you can ship the laptop directly to the employee or your employee can buy any device in the local store and after unpacking it will be automatically configured and he is able to work.

To be honest with you this is not a comprehensive guide on how to setup FSLogix. This a quick step by step list of task you have to to to get a profile management solution for your Instant clones or any other non-persistent virtual desktops up and running.

I would say the difficulty of the setup is a bit easier compared to our VMware Dynamic Environment Manager – mostly because the management is all done in GPO, you don’t need to deal with configuration share and you don’t need to install any management console.

So far we have been adding more and more applications into the portal, but in this post, we will focus on adding security – specifically 2FA authentification.

VMware has its own solution called VMware Verify, which is part of every edition of Workspace ONE and also Horizon Advanced and higher so let’s focus on that today, but of course, you can use any other 2FA solution over RADIUS.

I will continue by adding more application sources into our unified application portal. In the last post, we successfully added our first SaaS application (the SAML integration of Salesforce app), now it’s time to bring in virtual application and desktop. Specifically, I will work on the VMware Horizon platform, but keep in mind that Workspace ONE Access can integrate with Citrix platform too.