These steps are applicable when your Horizon Cloud environment is configured for Universal Broker and when you have integrated your Horizon Cloud with your Workspace ONE Access tenant. Horizon Cloud provides this feature by which you can specify that end users must go through the Workspace ONE Intelligent Hub catalog to access their pod-provisioned desktops and remote applications. Requiring end users to access their desktops through the Hub catalog prevents direct desktop access using their Horizon Client or by HTML access. This enforcement is useful when you want to use the two-factor authentication method that is set in your Workspace ONE tenant environment.

When your environment is configured with Universal Broker, your end users typically launch their entitled desktops using the following methods.

In the Horizon Universal Console, you can optionally configure your Horizon Cloud environment to require your end users use Workspace ONE Hub catalog only.


Verify that your Horizon Cloud configured with Universal Broker and Workspace ONE Access tenant are successfully integrated. See Horizon Cloud Environment with Universal Broker - Integrate the Tenant with Workspace ONE Access and Intelligent Hub Services.


  1. In the console, navigate to Settings > Broker > Authentication.
  2. Enable the toggle Enforce Intelligent Hub and confirm your choice.

What to do next

Verify that the desktop access behaves according to your settings by trying to access a desktop using the Horizon Client or using a browser directly instead of through the Workspace ONE Hub catalog.