Workspace ONE, formerly called AirWatch, has supported Windows modern management for over a decade. Its early support focused on the built-in MDM capabilities of Windows but then expanded over the years through agent-based enhancements. In parallel, more advanced cloud based functionally was introduced as Workspace ONE evolved into the Omnissa platform. Reviewing this history of improvements provides valuable context for recent Omnissa announcements regarding AI, Vulnerability Defense and Next-gen Windows management. In short, what Workspace ONE will soon be able to do has everything to do with a history of advancements going back to 2010.
Initial Workspace ONE (WS1) modern management capabilities focused on the OMA-DM client and Microsoft's Configuration Service Providers (CSP), APIs developed for the purpose of modern management. Over the years WS1 proprietary agent-based functionality was added to enhance configuration, management and reporting. Along with extending control over endpoints some enhancements have lent themselves to advanced workflows through Freestyle Orchestrator. Freestyle Orchestrator in turn was made possible through cloud based expansions like Omnissa Intelligence and Mod Stack, a modern back-end architecture now referred to as Modern SaaS. Arguably, Workspace ONE Windows modern management today is the culmination of over 15 years of development and support.
A brief review of this history goes a long way towards explaining the how, what and why behind recent AI and Next-gen Windows management announcements at Omnissa ONE 2025. WS1 modern management capabilities are fuel for the Omissa AI agentic service and it's first use case, Workspace ONE Vulnerability Defense. So, a review of Workspace ONE modern management milestones elucidates the future of Omnissa's AI driven workspace. It also sheds light on the path forward for Next-gen Windows management. Most notably, this history is a SaaS adoption success story, a shift to higher ground now paying dividends in the form of practical AI adoption and greater independence from Microsoft.
Parlaying AirWatch Success Into Modern Management
A could-based service capable of managing windows devices anywhere in the world is foundational to modern management. AirWatch had been perfecting this model for half a decade by the time Windows 10 was released. To support iOS and Android devices AirWatch leveraged the cloud messaging services and APIs their respective manufacturers had purpose built for mobile device management. Windows modern management would trace a similar path, with Microsoft offering up the Windows Notification Service (WNS) and Configuration Service Providers (CSPs) for Windows. Accordingly, Windows modern management was a natural pivot for AirWatch, a parlay of previous success with iOS and Android management.
Expertise in delivering this SaaS based model shows through best-in-class administration consoles and processes, features that may not shine brightly in a boardroom but mean the world to folks actually in the trenches. Fast and responsive APIs, smart groups for device targeting, and support for multi-tenancy immediately set Workspace ONE apart from other modern management solutions, as they still do today. Most notably, there's 15 years of experience supporting large scale customers with a SaaS based solution that needs constant updating to keep up with the demands of new devices and new features. Heck, this model is so mature Omnissa had to modernize the back end services to keep up with demands of scale and speed, leading to what's now called Modern SaaS. This transition wasn't easy, but necessary for growth that now sets Workspace ONE further apart from its competitors.
Agent-Based Enhancements To Modern Management
CSPs and the OMA-DM client used to implement them were the starting point for WS1 modern management, accounting for most of the built-in Windows profile payloads offered through the WS1 console today. They’re an obvious way to handle table stakes administration for mobile Windows devices such as configuring Wi-Fi firewalls, anti-virus, windows updates, etc...
Though these CSP based payloads are still widely used by customers today, over the last decade WS1 has expanded its modern management functionality through the Intelligent Hub agent or other tightly integrated Omnissa agents. Many of these features extend a WS1 admin's control over the system state of these devices. The Software Deployment Agent SFDAGent (2018) has helped overcome limitations with CSP based app deployments and Baselines (2019) addressed CSP limitations for porting traditional AD GPOs to modern management. An Integration Mode for Dynamic Environment Manager (2022) has opened the door to radical control over the user and application profile settings, while the Freestyle Orchestrator Scripts (2022) feature has simplified the use of PowerShell for both system and profile configuration.
Other agent-based features have increased security and simplified support. BitLocker management (2017) dramatically simplified support of encryption while Workspace ONE Tunnel for Windows Desktop (2021) enables Zero Trust architecture through a policy controlled Per-App or Full Device VPN. Particularly helpful for support has beenWS1 Assist for Windows 10 (2019), enabling admins to remotely view, control and reconfigure managed windows devices in real time directly from the WS1 console.
In terms of monitoring and reporting, two major milestones are the release of Sensors (2019) and Workspace ONE Experience Management (2020). Upon their initial release Sensors enabled customers to customize the collection of attributes from managed devices by running PowerShell scripts on the endpoint and uploading the results into Intelligence. While Sensors provided some awesome reporting extensibility, Workspace ONE Experience Management really took monitoring to the next level. In the past referred to as DEEM or, more generally, our DEX solution, Workspace ONE Experience Management focuses on KPIs that reflect the health of a Windows device and applications it runs. This telemetry, along with employee surveys, are aggregated within the Intelligence data lake for analysis and rich reporting.
Most notably, the data collected from both Sensors and WS1 Experience management can be used to trigger advanced Freestyle Orchestrator workflows from WS1 UEM or Intelligence.
Advanced Sequencing And Workflows
For advanced sequencing and workflows there's two flavors of Freestyle Orchestrator, one accessed directly within WS1 UEM and another configured within Omnissa Intelligence. Both provide an intuitive, low-code/no-code, drag-and-drop interface for developing complex orchestration. The main differences are the breath of actions and data set used to inform decision logic. Freestyle Orchestrator for UEM is squarely focused on the endpoint itself, providing complex app sequencing, device on-boarding and desired state management. Initial targeting is through smart groups, with actions fine-tuned based on applications, files, registry settings or Sensor attributes detected on the device. Accordingly, apps, profiles or scripts are delivered to the device using if-then-else logic. Freestyle Orchestrator for Intelligence is triggered by a broader dataset from within the Intelligence data lake, including extensive WS1 UEM reporting, DEX and Sensors. The actions triggered are much broader in scope as well, including extensive automation across the WS1 UEM environment as well as 3rd party integrations with solutions like ServiceNow. Against the WS1 UEM environment there's some 30 different actions to choose from, including device tagging, app installs and organization group device migrations. For 3rd party solutions, actions are made available through Workflow Connectors that execute REST API calls according to a solution's API options.
The range of actions available through these Workflow Connectors is largely dependent the richness of the REST APIs a 3rd party solution makes available. For example, ServiceNow offers a very rich and extensive set of APIs, so all sorts of actions and integrations are possible. In the demo below Incident tickets are created in ServiceNow using a custom Workflow Connector. Since it's an Intelligence based Freestyle Workflow, it could get triggered by any information within the Intelligence data lake, including experience management analytics. In this demo automation is driven by a PowerShell based Sensor that reports to Intelligence about the amount of free space on the endpoint device. When the device's storage falls below a specific threshold calls are made to both ServiceNow and Teams, along with a call to WS1 that applies a TAG to the device.
Arguably, Freestyle Orchestrator for UEM was developed to enable WS1 to compete with traditional PCLM solutions when it comes to endpoint provisioning or complex application packaging. However, Freestyle Orchestrator for Intelligence takes things to the next level, enabling automation capabilities that move beyond traditional desktop management. The capabilities of these two flavors of Freestyle Orchestrator can blend to collectively enable ruthless automation across managed devices and the 3rd party services used to support them. These workflow capabilities are the building blocks for the AI driven autonomous workspace vision presented at the Omnissa ONE conference this September. In this future Freestyle Orchestrator workflows could be automatically created and driven by Omnissa AI agentic services.
AI Enhancements
The imminent GA of the Omni AI assistant was a major announcement at Omnissa ONE this year. It's a generative AI offering that provides, "natural-language interactions for your data, documentation, and scripting needs." First and foremost, Omni allows admins to explore Workspace ONE data using a natural language processor. You can ask it a question like, "How many Windows devices are currently enrolled, " and in response get automatically generated reports and dashboards. You could even go on to manually target your Freestyle workflows based on these generated dashboards. In addition, Omni will offer advanced search capabilities and suggestions based on the Omnissa knowledge base. Finally, Omni can generate PowerShell scripts on behalf of the customer. These scripts can be used as Sensors for collecting data from endpoints or for pushing out system state changes through the Scripts capabilities of Freestyle Orchestrator. Here's a demonstration of the Omni AI assistant:
Omnisa AI agentic services, also announced at Omnissa ONE this year, will build off the generative AI capabilities of Omni to deliver agentic workflows using Freestyle Orchestrator. It's a major step towards the vision of an autonomous workspace that's, "self-configuring, self-healing and self securing." This service will be made up of, "prebuilt and customizable agents that stitch data, signals, and automations into end-to-end workflows." It's first planned use case as part of Workspace ONE Vulnerability Defense adds some useful color. When a vulnerability is detected through this new CrowdStrike integrated security solution, the Omni AI agentic service will automate remediation, creating and executing a Freestyle workflow and even phasing out the deployment through rings. Historically, workflows from Intelligence have been manually configured by admins and then triggered by Intelligence data or Experience Management analytics. Now, through the Omnissa AI agentic service generative AI will drive Freestyle Orchestrator automation to complete complex tasks.
Considering the Omnisa AI innovations already in place and the stages of AI growth planned, it makes sense that Omnissa is beginning to nibble on this fourth stage of AI adoption.While Omnissa has been dipping it's toe within AI since the initial release of Intelligence, more immediate examples have been Insights and the Guided Root Cause Analysis (RCA) features of Workspace ONE Experience Management. These solutions leveraged machine learning to detect anomalous trends and predict statistically significant root cases for some of these trends. With the release of Omni we're beginning the adoption of generative AI that will eventually drive our core Workspace ONE capabilities through AI agentic services.
As we've detailed throughout this article, agent-based improvements have laid the ground work for a shift away from the OMA-DM client. Over the years more and more functionality has been introduced through the Hub agent and other tightly integrated Omnissa agents. While there’s not a lot of publicly available information about Next-gen Windows management, the known progress Omnissa has had with Windows Server management certainly offers some clues. Windows servers don't have modern management capabilities built into them like the desktop OS, so success with the Windows Server management beta release has progressed independent of OMA-DM and CSPs.
With the beta release for Windows Server features like Experience Management, Intelligence and Assist have been supported. This aligns with the fact that these capabilities have been delivered through Intelligent Hub or other Omnissa agents. As far support for profiles goes, Windows Server management for WS1 leans on a new feature called, Windows Administrative Template (ADMX) Profiles, an alternative that leverages Intelligent Hub to apply ADMX settings more alined with traditional AD GPO settings. It's hard not to speculate that Next-gen Windows management will follow a similar path. More information on how Next-gen Windows management will work should come out in November.
Reaching Hire Ground
The dust has yet to settle from these recent Omnissa ONE announcements and additional clarity should come out over the next months. In the meantime reviewing the history of Workspace ONE's modern management solution offers much food for thought. What Omnissa AI will do for Workspace ONE Vulnerability Defense tomorrow has everything to do with advancements in WS1 modern management made over the last decade. Over time more and more WS1 proprietary functionality has been introduced to address deficits in the native modern management capabilities of the Windows OS. AI will drive much of this functionality as WS1 customers shift to an autonomous workspace. Further, this functionality looks to be foundational to Next-gen Windows management, though exact details are still forthcoming.
Ten years ago, arguments for a shift to SaaS based modern management focused on hardware savings and faster time to value. While these indeed are real advantages, the benefits don't stop there. Simply put, cloud adoption opens doors to processes and capabilities that just aren't practical or within reach for an on-premises model. In the case of Workspace ONE, Freestyle Orchestrator isn't even an option for an on-premises deployments and don't even think about AI. These are just two examples of what's possible today through the cloud-based Omnissa platform. SaaS synergies are paying off. We have reached higher ground, and the views are gorgeous.
Intelligence for Horizon has provided cloud based monitoring and analytics since 2022. The data this solution feeds into Omnissa Intelligence is foundational to the Experience Management for Horizon add-on, an enhancement that tracks the digital employee experience (DEX) of Horizon users. Along with providing rich visibility this DEX solution entitles customers to Workflow Connectors, an Omnissa Intelligence feature for 3rd party integrations. Based on Horizon telemetry or experience analytics these Workflow Connectors execute REST API calls against popular solutions like ServiceNow.
In the graphic above telemetry is collected from the Horizon Client, Horizon Agent, Connection Server and UAG appliance, then funneled into the Omnissa Intelligence cloud through the Horizon Edge Gateway Appliance. Using this data, along with it's own proprietary telemetry, Experience Management for Horizon generates experience analytics that reflect the health of Horizon sessions, infrastructure components and delivered applications. These experience analytics or underlying raw Horizon telemetry can trigger workflows that execute REST API calls against any 3rd party services supporting a REST API. For example, in the video below a slow login time for a VIP user triggers the automatic creation of an incident ticket within ServiceNow.
The impressive automation capabilitiesof Omnissa Intelligence, formerly called Workspace ONE Intelligence, have been around for over half a decade now. The biggest difference today is that many customers now actually have Horizon data within Omnissa Intelligence to trigger automation with. Over the last few years the most common subscription licenses sold have included the Intelligence for Horizon service, so increasingly customers have gained access to Horizon telemetry within the Omnissa Intelligence data lake. In parallel, SaaS adoption has only accelerated, with solutions like ServiceNow, Office 365 and Salesforce dragging enterprises kicking and screaming into the 21st century. Given the confluence of these two trends the workflow automation capabilities of Omnissa Intelligence are more relevant than ever, enabling customers to better adapt, fine tune and enrich the SaaS based solutions that support their Horizon environments.
This article will detail the process behind creating a Custom Connector, a customized Workflow Connector type that's a catch all solution for integrating Omnissa Intelligence with 3rd party apps. Specifically, I'll walk through the creation of the Custom Connector for ServiceNow used in the demo video above. However, before doing a deep dive into Custom Connectors I want to review the Horizon data and analytics we can use to drive this automation.
The Data Driving The Automation
Omnissa Intelligence for Horizon provides cloud based monitoring and analytics for an organizations entire Horizon estate, across cloud and on-premises deployments. Loosely speaking it represents an aggregation of the individual Horizon session metrics typically viewed through the Horizon Help Desk Tool. So imagine the data output of the Horizon Help Desk tool for all the current sessions across your enterprise collected in a single place. Add to this a few additional metrics like wifi signal strength and WAN latency, along with monitoring for Horizon Connection Servers and Unified Access Gateway, and that's the Omnissa Intelligence for Horizon dataset in a nutshell. It's information collected across an enterprise at one minute samples and retained for 2 to 3 months within the Omnissa Intelligence data lake. This vast source of Horizon data is the foundation for the Experience Management for Horizon solution and the experience analytics it provides.
Experience Management for Horizon generates Horizon session analytics based on 12 experience KPIs and customer defined thresholds for these KPIs. Assessments of each of these KPIs bubble up into a super metric called a Horizon Session Experience Score. As mentioned earlier, most of these KPI assessments are based on the Omnissa Intelligence for Horizon dataset, though Experience Management for Horizon also introduces proprietary telemetry regarding local LAN latency and Active Directory GPO processing. Horizon Session Experience Scores based on all 12 KPIs are calculated at 4 hour intervals, 6 times a day, and retained for up to a year. So compared to Intelligence for Horizon datapoints we're talking about lower frequency but higher retention.
This is all in the name of defending the Horizon user experience. It's based on an understanding that a deficit in any one of these KPIs is detrimental to the entire user experience. In other words, the user experience is no better than the weakest KPI. If 1 KPI out of 12 is consider poor, then the user experience is considered no better than poor, regardless of what the other 11 KPIs look like. This makes perfect sense when you think of the fragility of the user experience. For example, if you have poor protocol latency, it doesn't matter how good everything else is, you're users are going to have a bad time.
Experience Management for Horizon also introduces proprietary telemetry and KPIs for applications running within Horizon sessions. This data is collected from an Experience Management agent running within the virtual desktop or RDS host. It records this data at a much higher frequency, tracking app cpu usage, memory usage, hangs and crashes, then uses these metrics to calculate overall scores for the application enterprise wide.
Finally, similar to Horizon Session scores, Experience Management for Horizon generates health scores for Horizon Connection Servers and Unified Access Gateways supporting on-premises Horizon environments. This involves KPIs regarding session capacity, cpu usage, memory usage and SSL cert status that contribute to overall experience scores calculated for Connection Servers and UAG appliances.
Again, much of the analytics generated by Experience Management For Horizon is based on the raw telemetry collected by Omnissa Intelligence for Horizon. Accordingly, you might be able to squeeze some DEX insights out Omnissa Intelligence for Horizon on it's own using custom dashboards and elbow grease. However, you would land far short of the DEX solution provided by Experience Management For Horizon. For starters, you wont have access to more than 2 to 3 months of data and some of the visualization magic of Experience Management for Horizon will be impossible to match. Further you simply wouldn't have access to the proprietary telemetry provided by Experience Management for Horizon. No local LAN latency visibility, no segmentation of GPO performance and most notably, no application performance metrics. A great analogy given by Cris Lau, a PM for the solution, is it's like the difference between building something with generic lego blocks vs a themed lego set. Yeah, using generic lego blocks with some creativity and imagination you might be able to approximate the outcome of a purpose built themed lego set, but there are hard limitations in terms of how close you can get and you'll have to seriously lower your expectations.
Along with missing DEX visualizations and insights, without Experience Management for Horizon most Horizon customers would be missing out on the automation capabilities provided by the Workflow Connectors of Omnissa Intelligence. These are what allow for integrations with 3rd party solutions like ServiceNow, enabling Horizon shops to drive automation based on Experience Management analytics or raw data collected from Omnissa Intelligence for Horizon. Without Experience Management for Horizon or Workspace ONE Enterprise licenses, these automation capabilities aren't available to Horizon customers.
Creating A Custom Connector For ServiceNow
Out of the box Omnissa Intelligence includes built-in Managed Connectors for solutions like ServiceNow, Slack and Zoom, not to mention Omnissa products like Workspace ONE UEM and Hub Services. These Managed Connectors represent, "easy buttons," for Workflow Connector integrations. You simply add a URL for your service along with credentials and you're off the races. For example, within an hour of spinning up a ServiceNow developer tenant I had the Managed Connector for ServiceNow integration working after following the first few paragraphs of guidance within this official documentation.
While these Managed Connectors are impressive, Custom Connectors allow for customization and a far broader set of potential integrations with 3rd party vendors. For example, to customize the integration between ServiceNow and Intelligence I went with a Custom Connector to achieve the functionality demonstrated in the video above.
The process for developing a Custom Connectors begins with developing a firm understanding of the target vendor's REST API. From there you go on to develop a request to the API within a Postman Collection. After fine tuning the request and successfully testing it's execution from Postman you export the collection and then import it into Omnissa Intelligence. Examples of these types of custom integrations are currently available at GitHub, while official Omnissa guidance on the creation of Workflow Connectors can be found here. For Horizon admins who require a primer on REST APIs and Postman I'm proud to offer up one of my previous articles, No Rest For The RESTful: Omnissa's Horizon Server API.
For the Custom Connector demonstrated in the video above I tweaked out a ServiceNow example from the GitHub repository just mentioned. After importing the sample ServiceNow collection into my instance of Postman I had a request that looked like this:
After populating this imported collection with variables for the base url and authorization credentials I was able to begin creating incidents in ServiceNow directly from Postman. While the automation introduced through this sample Custom Connector is impressive, there's a ton of attributes for an Incident it leaves out. This includes some very compelling information like Assignment Groups, configuration items, Category, etc... To extend the Custom Connectors functionality to cover these additional items I needed to get more familiar with the ServiceNow REST API options. Fortunately ServiceNow makes it really easy to do this through the REST API Explorer. It not only provides documentation on the relevant Table API, but also a way to test out calls against your ServiceNow instance in real time. For example, after navigating to the REST API Explorer, I selected the crud operation I was interested in exploring, then selected, "Incident," as the table name.
Then, after scrolling down, there's was absolutely wonderful Builder tab under Request Body. It provides a method for exploring all the key/value pairs associated with the Incident table.
Even more impressive, it offers an option to actually test out a REST API call directly against your ServiceNow tenant. So, to explore leveraging the Assignment Group key I selected Assignment group then associated it with a test value.
Upon clicking Send the test was executed against my tenant. The results of this execution were shown at the bottom of the page. Further, when I looked under Incidents within ServiceNow I could see the newly created ticket. Liking what I saw, translating this to a request in Postman was a walk in the park. I just yanked this assignment group key value pair form the builder and plugged it into my Postman request.
Now, after confirming successful execution from Postman, I began the process of importing this logic into Omnissa Intelligence. First I needed to right click on the collection in Postman and select the option to export.
With my paws on the exported JSON, I now needed to add a special ID field as instructed in the official documentation for Workflow Connectors. Accordingly, I inserted the value pair highlighted below.
With this small edit made and saved to the exported JSON file I was able to begin the import into Omnissa Intelligence. From within the Omnissa Intelligence console I navigated to Integrations --> Workflow Connectors, then clicked Add.
This launched the Add New Workflow Connector Wizard. I populated that with the base URL for ServiceNow along with my credentials and clicked setup at the bottom.
After the successful creation of the Connector I navigated to Actions. It's here I had the option to import the exported JSON from Postman.
And a little drag and drop and voila! I had this new action to work when creating Workflows with Freestyle Orchestrator.
A Whole World Of SaaS And 3rd Party Integrations To Explore
While ServiceNow is one of my favorite integrations to talk about it's only one of countless possibilities. Again, Custom Connectors could theoretically be created for any 3rd party application that supports a REST API. You would follow the same basic process I just detailed for the custom ServiceNow connector. For a ServiceNow integration we went from:
ServiceNow REST API Explorer --> Postman Collection Creation --> Custom Connector
So step one was getting familiar with the ServiceNow REST API and figuring out exactly how to interact with the API and what key/value pairs were necessary. Then there was creation and testing within Postman, followed my an export of the JSON collection. Finally, there was the creation of the Custom Connector within Intelligence and import of the JSON collection. For any other solution it's a similar path:
Sort Out REST API Logic of App X --> Postman Collection Creation --> Custom Connector
This general process is demonstrated through the numerous examples in GitHub for popular solutions like Atlassian, Microsoft Teams, Pager Duty, Salesforce and Zendesk.
For a deeper dive on the Horizon telemetry driving the Experience Management for Horizon solution, don't miss this YouTube Series by Cameron Fore, Getting Started With Intelligence for Horizon. The first installment of this series, Part 1: Where Is The Data, focuses on the types of data available within Intelligence for Horizon. One of my favorite parts of this first video is the introduction to the recently released Omnissa Intelligence Data Explorer, a great tool for getting your hands dirty with the Horizon data stored in Intelligence. That said, all four videos of the series are definitely worth checking out for anyone curious enough to make it this far through an article like this. For context, Cameron is the guy who designed the new Horizon Operations Overview dashboard and has focused on Horizon monitoring in one shape or another for over a decade now.
Ruthless Automation Across An Ecosystem Of Apps And Services
To my mind the ability to drive automation across 3rd party SaaS solutions amounts to end user computing scripting for the 21st century. Sure, getting into the guts of the Windows operating system with PowerShell is still highly relevant for most Horizon admins. However, as SaaS has gotten more and more relevant the potential for Horizon shops to benefit from more integration and automation with those solutions has emerged. What's possible and on the table really amounts to what options that vendor has made available through their REST API. In the case of ServiceNow, it's A LOT. In the case of other vendors maybe it's not so impressive, but when any vendors does step up with some interesting REST API capabilities Experience Management For Horizon will allow Horizon admins to take advantage of them.