A customer has recently reached out to me to clarify if Workspace ONE Assist was different to the Assist they were using for Horizon. This was in relation to a recent security advisory (VMSA-2022-0028 (vmware.com)), and they had been alerted by their auditing team that upgrades may have been necessary.
While it was easy to confirm that their UEM instance was fine as it was on the VMware Shared SaaS instance that is patched frequently, they struggled to find if their “Horizon Assist” solution would be protected.
I was able to confirm based on the Response Matrix within the VMSA, however they wanted to understand the differences between the Assist versions, which I thought would be a useful article, as the brief answer it is not well documented.
The brief answer is that “Workspace ONE Assist for Horizon” is a variant of “Workspace ONE Assist”, and while it provides much the same function as “regular” Assist, it has slightly different infrastructure.
To go into more detail: ‘Workspace ONE Assist’ is the “Remote Access” tool that UEM uses to allow Admins to remote into devices for support assistance and administration. Critically, it requires the device to be enrolled into a Workspace ONE UEM environment and can be used for most Device Types and Operating Systems (As of time of writing, including MacOS, iOS, Android, Linux, Windows Mobile and Windows 10/11). (For a full overview of functionality, see the VMware documentation: Workspace ONE Assist (vmware.com)).
‘Workspace ONE Assist for Horizon’, on the other hand, does not require Devices to be enrolled, due to the nature of non-persistent VDI. It is also specific to Windows 10 VDI’s that have the Assist for Horizon agent installed on them, as the agent provides the connection back to the UEM instance. (For a full overview of functionality, see the VMware documentation: Workspace ONE Assist for Horizon and Horizon Cloud (vmware.com))