We're a WS1 UEM shop, converted legacy Airwatch Orange; MDM/MEM only (all we do is deliver an ActiveSync profile to BYO devices and do 2 simple compliance checks). I want to federate to Okta, but support says I may/may not have entitlement pre-reqs. Looking at Subscriptions and Services and Services in our Connect portal shows only Omnissa Workspace ONE Standard - Production Support/Subscription. Do we get Access (which is where I assume I'd fed to Okta then delegate WS1 UEM auth to Access) with this?

IIRC, all WS1 UEM skus should include Access

Thanks Sean, that's what this says as well... not sure why we got pushback from support then Choose the right Workspace ONE edition from Omnissa

There is a good chance it’s a newer support person and they didn’t know the answer. Plus that might have been more of a partner/sales question since it has more to do with entitlements

Any idea if federating UEM auth source triggers reenrollment or even just reauthentication for already enrolled devices (I'd assume so on an interval, but with direct UEM login, it's not like the user is dealing with a refresh token lifetime)? FWIW, We're currently authenticating directly to UEM using (domain auth -> Cloud Connector)

I haven’t tried this and well beyond my area of expertise. I think it depends on how you want your auth flow to work. It can get pretty complex between Access, UEM and 3rd-party IDPs, especially if you want to use certificate auth or some of the more advanced WS1 auth features like Mobile SSO.

@Stephen Daniel Wagner Do you do much around identity/federation? Or are IAM wizards cut from a different cloth?

We do, but I have someone that does that. Paging @Daniel Keer 🙂

I know federation/IAM isn't entirely new, but with all the traction SSO/federated IdPs have gained in the last years in the 'normy' world, being an IAM person is like being last gens 'a pki/certificate person'

IAM wizards are cut from a different cloth. 😄 but in this case, you're dealing with the intersection of WS1 Access and UEM. Have you reached out to your account SE to see if you can talk to one of Omnissa's internal SMEs? It used to be Peter Bjork...but I think he moved into a new role

We pinged our partner, who is trying to get a meeting lined up

OK

thanks! reading now

This might have more info https://docs.omnissa.com/bundle/workspaceone_okta_integration/page/OverviewofWorkspaceONEandOktaIntegration.html

Yes it's possible I have a customer using Okta as their Primary IDP, they don't use active directory either 🙂 at least only when they HAVE to 🙂 https://www.omnissa.com/workspace-one-editions/

Thanks Daniel and Chris. We're more concerned with user impact / forecasting our service desk load when changing the auth point from UEM directly to Access federated to Okta. We're a law firm and enrollments for attys are handled white glove style, typically in person. Which poses a challenge if there would be a mass reenrollment event.

makes sense, if you want to DM me and I can connect you with your specific Omnissa team. They can help investigate the impact for you and work through the goals you have.