- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Omnissa Access
A lost phone still opens the CRM. Your MDM knows it is non-compliant; your sign-in does not — Omnissa Access gives your staff single sign-on to web, SaaS, mobile and Horizon apps and lets device compliance from Workspace ONE UEM decide who gets in, with Omnissa Pass for MFA — already included in every Workspace ONE Essentials edition.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Omnissa platform family
This page covers Omnissa Access — with Omnissa Pass and the Secure Access Suite folded in. The rest:
Quick facts
30-second orientation- Product
- Identity broker: single sign-on, adaptive MFA and risk-based conditional access for any app
- Maker
- Omnissa, Mountain View, California; owned by KKR since July 2024; CEO Amit Singh since 28 September 2026
- Lineage
- Built in VMware’s end-user computing unit, which Broadcom sold to KKR; Omnissa launched as its own company on 1 July 2024
- Delivery
- Cloud service; the Omnissa Access Connector is installed on-premises to sync directory users and groups
- Signals
- Workspace ONE UEM device compliance, plus network, location, user behaviour and third-party security feeds
- MFA
- Omnissa Pass Basic comes with all Access SaaS licensing; Pass Advanced is a $3 per user per month add-on
- Price
- No standalone SKU: included in every Workspace ONE Essentials edition, from $3 a user a month on 12-month prepay
- Bundle
- Secure Access Suite pairs Workspace ONE with Google Chrome Enterprise Premium; an add-on with no published price
- India
- Omnissa’s status page lists an ‘Omnissa Access - India’ instance; no residency commitment is published
- In India via
- TechBag — edition fit, connector and policy pilot, quote in INR with GST
Understand device-aware access before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
An identity broker that knows the device
Omnissa Access gives single sign-on and MFA to every app, and lets the device’s compliance decide who gets in.
Separate SSO and MDM tools vs Omnissa Access — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Separate SSO and MDM tools | Omnissa Access |
|---|---|---|
| Sign-in | A password per app | One Hub catalogue with single sign-on |
| Device check | MDM and SSO never talk | UEM compliance decides each app open |
| MFA | Same prompt for every login | Step-up only when the risk rises |
| Directory | Copied by hand to each SaaS | Synced from AD by an on-site connector |
| Audit | Logs spread across apps | One report of sign-ins and policy calls |
| What it is NOT | — | A directory of record, or a standalone SKU |
The cheapest test is five apps behind single sign-on with one device-compliance rule: run it for a month and read the failed-sign-in report.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Access broker
Each sign-in is weighed against user, device and network context; the policy engine then allows it, blocks it or asks for a stronger factor, per app or group.
Connector
Installed inside your network, the connector syncs users and groups from Active Directory and other directories to the cloud service; passwords stay with your directory.
Omnissa Pass
Pass Basic gives native multi-factor prompts in every Access SaaS licence; Pass Advanced, a $3 per user add-on, is the stronger tier and is bundled in Platinum.
Intelligent Hub
The Hub app and catalogue is the front door: one place on phone, laptop or virtual desktop where entitled apps open with single sign-on and self-service.
A connector syncs your directory to Omnissa’s cloud, the broker weighs device and context, and Omnissa Pass asks for more proof when risk rises — the tenant region is not committed in writing.
Nine capabilities. Broker, decide, verify.
Omnissa Access brokers the directory you already run — and makes the device’s compliance part of every sign-in.
One sign-in, every app type
Single sign-on reaches web, SaaS, mobile and virtual apps, including Horizon desktops, from the same Intelligent Hub catalogue.
Federation with your directory
Federates with cloud and on-premises directories, including AD and Entra ID, and provisions users and groups from that source.
Works beside Okta
Omnissa documents an Okta integration that uses Okta’s sign-on and policies while both products exchange risk signals.
Device compliance as a rule
Access asks Workspace ONE UEM whether the device is compliant before it opens the app, so a non-compliant phone can be refused.
Network, place and behaviour
Policies weigh network, location, session attributes and user behaviour, plus third-party security signals, per app or group.
Who signed in, and why not
Built-in reports show authentication patterns, failed attempts and each policy decision, consolidated for audits and investigations.
Native factors with Pass
Pass Basic supplies MFA in every Access SaaS licence; the docs add FIDO2 keys, Windows Hello and RADIUS, or plug in your own MFA.
Harder checks when risk rises
High-value apps or a risky session trigger step-up authentication, while low-risk sign-ins on compliant devices stay quick.
Platform SSO for Macs
With Workspace ONE UEM, Platform SSO through Access lets staff log in to their Mac with identity-provider credentials.
Watch Omnissa Access in action
Two videos from Omnissa’s official channel: a 2026 overview of zero-trust conditional access in Workspace ONE, and a 2025 tutorial on installing the Access Connector.
Zero-trust conditional access in Workspace ONE
A 1:25 Omnissa overview from April 2026 of conditional access that checks the device and user before any app opens.
Installing the Omnissa Access Connector
A 5:38 walk-through from 2025 of installing the on-premises connector that syncs your directory to Omnissa Access.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Most sign-ins never ask about the device. Omnissa Access makes compliance the first question.
Here’s what genuinely sets it apart — and exactly where it stops.
The device is part of every sign-in
Because Access and Workspace ONE UEM share one platform, the compliance state of the phone or laptop becomes a condition of opening Salesforce, SAP or a Horizon desktop. Add network, location and behaviour, then step up to a stronger factor only when the risk score rises; staff on compliant kit see fewer prompts.
It brokers identity, it does not replace it
Omnissa calls Access an identity broker. It federates with Active Directory and Entra ID, can lean on Okta for sign-on while exchanging risk signals, and pulls users in through an on-premises connector. You keep the directory you have and add device-aware policy on top, with no forklift migration.
Often already paid for
Access is included in every Workspace ONE Essentials edition, and Employee Essentials lists at $3 a user a month on 12-month prepay. Pass Basic MFA comes with it; Pass Advanced is $3 a user a month or included in Workspace ONE Platinum and Horizon Platinum. Check your current licence before buying any new identity tool.
Where it stops
There is no standalone price, and Access leans on your directory rather than replacing it. The best rules assume Workspace ONE UEM. Header-based and Kerberos web apps need Unified Access Gateway in front, and LDAP proxying is not documented. An India instance is listed, but no residency commitment is, and no analyst has placed Access itself.
The numbers behind the platform
What your Omnissa Access rollout looks like
Check what you already own
List your Workspace ONE or Horizon editions: Access may be included already, and Platinum also carries Pass Advanced.
Install the connector
Install the Omnissa Access Connector, sync AD or Entra ID groups, and ask Omnissa in writing which region the tenant sits in.
Pilot five apps
Put five apps behind single sign-on through the Hub, including one SaaS app, one Horizon desktop and one mobile app.
Turn on device rules
Make UEM compliance a condition for sensitive apps, add step-up MFA for high-risk sign-ins, and read the failure reports.
Decide on Pass Advanced
Settle whether Pass Basic is enough or Pass Advanced is needed, enrol FIDO2 keys for admins, then take the INR quote with GST.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Branch tablets that fall out of compliance can no longer open the loan app. That rule took an afternoon, not a project.”
“We already paid for Workspace ONE, so single sign-on through the Hub cost us nothing extra beyond the connector set-up.”
“Horizon desktops and SaaS apps now sit behind one sign-in, and doctors stopped writing passwords on sticky notes.”
“Our older intranet apps needed Unified Access Gateway in front before Access could sign users in. Budget that project as well.”
“The connector synced AD groups cleanly; plan time for the policy design, because that is where the real work sits.”
“Contractors on personal laptops were the gap; the Secure Access Suite browser route closed it, at an extra cost.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the workforce identity and access market — tap any vendor to see why it sits where it does.
TechBag Workforce Identity Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Inside Workspace ONE from $3 a user; Pass Advanced $3.
Device Awareness × Identity Breadth
The grid nobody publishes — how much each product lets the device decide a sign-in vs how broad its identity toolkit is: catalogue, protocols, factors and older apps.
UEM compliance plus context in every rule; FIDO2 in the docs.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Omnissa Access vs the identity field
Against Okta Single Sign-On, Microsoft Entra ID, Cisco Duo, miniOrange SSO and Scalefusion OneIdP — on directory, single sign-on, MFA strength, device rules, older apps, price and India data.
| Dimension | Omnissa Access | Okta Single Sign-On | Microsoft Entra ID | Cisco Duo | miniOrange SSO | Scalefusion OneIdP |
|---|---|---|---|---|---|---|
| What it is | UEM-aware broker | Neutral identity provider | Microsoft’s IdP | MFA-first access | India-built SSO | UEM-bound identity |
| Deployment | Cloud + local connector | SaaS only | Microsoft cloud | SaaS + on-site proxy | SaaS or on-premises | SaaS with the UEM |
| Directory model | Brokers yours | Own or synced | Is the directory | Syncs to yours | Own or synced | Own or synced |
| Single sign-on reach | Web, SaaS, mobile, VDI | Largest app catalogue | M365 and gallery apps | SSO beside MFA | SAML, OAuth, OIDC | Conditional SSO on Pro |
| MFA strength | Pass, FIDO2 in docs | FIDO2 documented | Passkeys and FIDO2 | FIDO2 documented | FIDO2 documented | FIDO2 unverified |
| Conditional access | Device + context signals | Full adaptive policy | P1; risk needs P2 | Device health checks | Rated full | UEM agent posture |
| Older apps | Via UAG; RADIUS sign-in | LDAP, RADIUS, header | Check app by app | RADIUS and LDAP | Widest legacy list | LDAP only |
| Device dependence | Best with Workspace ONE | Device-neutral | Intune for compliance | Its own health checks | No UEM tie | Needs Scalefusion UEM |
| Ecosystem | Okta, Microsoft, Google | Neutral, widest | Microsoft 365 native | IdP-agnostic | Narrower ecosystem | Scalefusion suite |
| Pricing model | Inside Workspace ONE | Per user, suites climb | Often already paid | Three published tiers | Per user, INR list | Per device |
| Published entry price | $3/user, Essentials | ~$6/user, $1,500 min | $7/user for P1 | $3/user Essentials | ₹180/user/month | $4/device/month |
| India data region | India instance only | In-country tenants | Asia-Pacific geo | Mumbai since 2022 | India-built, on-prem | India-built |
| Lock-in and exit | Tied to the licence | Directory may move | Hard to leave M365 | Light to unwind | On-prem keeps control | Bound to the UEM |
| Best fit | Workspace ONE estates | App-heavy estates | Microsoft 365 estates | MFA in front of all | Cost-led Indian buyers | Scalefusion UEM fleets |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Omnissa Access if…
- ✓Workspace ONE UEM or Horizon already runs your fleet, and device compliance should decide who opens which app
- ✓You want single sign-on and MFA you may already own inside a Workspace ONE Essentials edition
- ✓You need to keep AD, Entra ID or Okta as the source of identity and add device-aware policy on top
Compare alternatives if…
- ✓You need a directory of record with lifecycle automation — Okta Universal Directory or Entra ID hold the users
- ✓Identity data must sit in India under contract — Okta’s in-country tenants or an on-premises miniOrange
- ✓Most devices are not on Workspace ONE — Okta or Duo work with any device manager or none
Do not expect…
- ✓A directory of record — Access brokers the directory you already run
- ✓A standalone Access price — it comes inside Workspace ONE and Horizon editions
- ✓Header-based or Kerberos apps to work without Unified Access Gateway in front
Omnissa Access is one of 30 iam, sso & mfa products TechBag carries. The IAM, SSO & MFA guide narrows them to a shortlist and shows the reasoning. →
What do passwords and access requests cost you?
Drag the sliders (staff who sign in to work apps; IT-hour cost). Estimates model the help-desk time spent on password resets, locked accounts and app access requests, at an assumed 0.25 hours per user a month, with 60% of it removed by single sign-on, self-service and device-aware rules. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Access has no standalone price. Omnissa says it is included with all Workspace ONE Essentials editions; the cheapest, Employee Essentials, lists at $3.00 a user a month or $1.67 a device a month, in USD, prepaid for 12 months with production support. Omnissa Pass Basic comes with all Access SaaS licensing, and Pass Advanced is a $3 per user per month add-on (included in Workspace ONE Platinum and Horizon Platinum). The Secure Access Suite is an unpriced add-on. TechBag quotes in INR with GST.
Omnissa Access + Pass Basic
Best for Workspace ONE estates wanting SSO now
- Included in every Essentials edition
- Employee Essentials from $3 a user a month
- 12-month prepaid, USD list
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Omnissa Pass Advanced
Best when MFA must be stronger than Pass Basic
- $3 per user per month add-on
- Included in Workspace ONE and Horizon Platinum
- Ask which factors are phishing-resistant
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which Workspace ONE or Horizon editions do you hold today, and is Access already inside one of them?
Which users and apps will be held to FIDO2 keys or platform authenticators, and will our auditors accept that set-up?
Is our tenant on the India instance listed on Omnissa’s status page, and will Omnissa commit to that in the contract?
Which Kerberos or header-based apps can sit behind Unified Access Gateway, and which LDAP apps will need another tool?
How do contractors and BYOD users sign in without UEM enrolment, and does that need the Secure Access Suite add-on?
If Okta or Entra ID stays the identity provider, which policies run in Access and which stay in the IdP?
How long are sign-in and policy logs kept, and can they reach our SIEM for CERT-In’s 180-day log retention rule?
What term, user count and Pass tier does the quote cover? Ask TechBag for it in INR with GST, Pass Advanced itemised.
Questions buyers ask
Ready to evaluate Omnissa Access?
Tell us which Workspace ONE or Horizon editions you hold, or let a TechBag advisor get the tenant-region, FIDO2 policy and log-retention answers from Omnissa in writing and the quote in INR.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.