To connect to a remote desktop or application, you must provide the name of a server and supply credentials for your user account.

To use remote applications, you must connect to Connection Server 6.0 or later.

Note: Before you have end users access their remote desktops, test that you can log in to a remote desktop from a client device.


  • Obtain credentials to log in, such as an Active Directory user name and password, RSA SecurID user name and passcode, or RADIUS authentication user name and passcode.
  • Obtain the NETBIOS domain name for logging in. For example, you might use mycompany rather than
  • Perform the administrative tasks described in Preparing Connection Server for Horizon Client.
  • If you are outside the corporate network and are not using a security server to access the remote desktop, verify that your client device is set up to use a VPN connection and turn on that connection.
    Important: VMware recommends using a security server rather than a VPN.

    If your company has an internal wireless network to provide routable access to remote desktops that your device can use, you do not have to set up a View security server or VPN connection.

  • Verify that you have the fully qualified domain name (FQDN) of the server that provides access to the remote desktop or application. Underscores (_) are not supported in server names. You also need the port number if the port is not 443.
  • If you plan to use embedded RSA SecurID software, verify that you have the correct CT-KIP URL and activation code. See Using Embedded RSA SecurID Software Tokens.
  • Configure the certificate checking mode for the SSL certificate presented by Connection Server. See Setting the Certificate Checking Mode for Horizon Client.
  • If you plan to use Touch ID to authenticate, add at least one fingerprint in the Touch ID & Passcode setting on your iOS device. For complete Touch ID authentication requirements, see Touch ID Authentication Requirements.


  1. If a VPN connection is required, turn on the VPN.
  2. Tap the Horizon app icon on the Home screen.
  3. Connect to a server.
    Option Action
    Connect to a new server Enter the name of a server, enter a description (optional), and tap Add Server.
    Connect to an existing server Tap the server icon on the Servers screen.
    Connections between Horizon Client and servers always use SSL. The default port for SSL connections is 443. If the server is not configured to use the default port, use the format shown in this example:
  4. If a smart card is required or optional, select the smart card certificate to use and enter your PIN.
    If your smart card has only one certificate, that certificate is already selected. If there are many certificates, you can scroll through them if necessary.
  5. If you are prompted for RSA SecurID credentials or RADIUS authentication credentials, either type your credentials or, if you plan to use an embedded RSA SecurID token, install an embedded token.
    Option Action
    Existing token If you use a hardware authentication token or software authentication token on a smart phone, enter your user name and passcode. The passcode might include both a PIN and the generated number on the token.
    Install software token Click External Token. In the Install Software Token dialog box, paste the CT-KIP URL or CTFString URL that your administrator sent to you in email. If the URL contains an activation code, you do not need to enter anything in the Password or Activation Code text box.
  6. If you are prompted a second time for RSA SecurID credentials or RADIUS authentication credentials, enter the next generated number on the token.
    Do not enter your PIN and do not enter the same generated number entered previously. If necessary, wait until a new number is generated.

    If this step is required, it is required only when you mistype the first passcode or when configuration settings in the RSA server change.

  7. (Optional) If the Enable Touch ID setting is available, turn the setting on to use Touch ID to authenticate.
    The Enable Touch ID setting is available only if biometric authentication is enabled on the server and you have not previously authenticated with Touch ID.
  8. If you are prompted for a user name and password, supply Active Directory credentials.
    1. Type the user name and password of a user who is entitled to use at least one desktop or application pool.
    2. Select a domain.
    3. (Optional) Tap to toggle the Remember this Password option to on if your administrator has enabled this feature and if the server certificate can be fully verified.
    4. Tap Login.

    If Touch ID is enabled and you are logging in for the first time, your Active Directory credentials are stored securely in the iOS devices's Keychain for future use.

  9. If you are prompted for Touch ID authentication, place your finger on the Home button.
  10. (Optional) Tap Settings at the bottom of the Horizon Client screen and tap Preferred Protocol to select the display protocol to use.
    VMware Blast provides better battery life and is the best protocol for high-end 3D and mobile device users. The default display protocol is PCoIP.
  11. Tap a desktop or application to connect to it.
    If you are using smart card authentication, you are not prompted to supply your PIN again, but the login process takes longer than if you use Active Directory authentication.
    If you are connecting to a session-based remote desktop, which is hosted on a Microsoft RDS host, and if the desktop is already set to use the Microsoft RDP display protocol, you cannot connect immediately. You are prompted to have the system log you off the remote operating system so that a connection can be made with the PCoIP display protocol or the VMware Blast display protocol. VMware Blast requires Horizon Agent 7.0 or later.


After you connect to a desktop or application for the first time, a shortcut for the desktop or application is saved to the Recent screen. The next time you want to connect to the remote desktop or application, you can tap the shortcut instead of typing the server's name.