Skip to main content
The tool reaches your own Horizon Connection Server through its REST API, signed in as the Horizon administrator you save in Neo, so each call is limited twice: by that administrator’s role in Horizon and by the agent’s permission groups below.
Automatically enabled when you configure Omnissa Horizon permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • Find a user’s desktop, machines and sessions from their login name, and a machine or pool by name
  • Restart, reset, shut down, rebuild or recover a virtual desktop, and put machines in or out of maintenance mode
  • Create a desktop pool, change its size or settings, add or remove machines, push a new image, and delete machines and pools
  • Entitle a user or group to a desktop or application pool, assign or unassign a dedicated desktop, and log off a leaver’s sessions
  • List unused desktops: machines with no entitled user, machines idle now, and machines nobody signed in to for a number of days
  • Read the health of Connection Servers, gateways, vCenter servers and the event database, licence use, and audit events
  • Manage farms and RDS hosts, application pools, gateways, Cloud Pod federation and settings, with the access and approvals you choose
The agent calls the Horizon REST API through the Vendor API tool, with omnissa_horizon as the vendor id. Sandbox scripts can call Horizon too, under the same permissions.

​
Permission Groups

Every group can be Disabled, Read Only or Read/Write, except Monitoring & Events, which is Read Only at most. Neo never sends these calls: signing in, out or refreshing a token (Neo signs in with the connection’s user and keeps the token to itself), a Remote Assistance ticket, exporting a Connection Server certificate, and the download links of log bundles. Neo removes the fields Horizon keeps credentials in from every answer.

​
Access Profiles

Every group Read Only. The agent reads, and never changes anything.
Machines & RDS Hosts, Sessions & Help Desk, and Entitlements & Users are Read/Write with technician approval. Everything else is Read Only.
Every group Read/Write (Monitoring & Events Read Only). Servers, Federation & Settings and Administrators & Authentication require technician approval, and so do the changes below.
Every group Read/Write without approval (Monitoring & Events Read Only), except the changes below, which still require technician approval.

​
Safety Controls

These require technician approval under every access profile, whatever the group’s own approval setting:
  • Deleting a desktop pool or a farm, which deletes every machine or RDS host in it, and deleting a persistent disk.
  • Any change to administrators, roles, permissions, access groups, authenticators and domain accounts, and changing a user’s password.
  • Creating, joining, leaving or dissolving a Cloud Pod federation, rotating its keys, and deleting a site.
  • Removing a vCenter server, clearing the event database, deleting the Connection Server certificates, and installing or upgrading a Connection Server.
  • Starting a Workspace ONE Assist remote-control session on a user’s desktop.
  • Any change to Horizon’s security settings, and any update to a record that holds a stored password or key: a capacity provider, a vCenter server, the App Volumes Manager, a customization specification, the event database, an external deployment, a UEM server and the syslog file share.
  • Any change that stores a credential.