I would really like to see UniFi Site Manager retain and display a read-only “last known configuration” for consoles that are currently offline.

For MSPs and anyone managing multiple UniFi sites, this would be extremely useful for troubleshooting, documentation, and confirming what the environment looked like before a device went offline.

For example, if a UDM goes offline, I should still be able to open the site in Site Manager and view the most recently synchronized configuration, including things such as:

• Networks and VLANs
• WAN configuration
• DHCP scopes
• Firewall rules
• Port profiles and switch port assignments
• Adopted devices
• Access points and SSIDs
• Device names and IP information
• Routing and other site settings

This would be read-only historical information, clearly marked with the date and time of the last successful synchronization.

Right now, if a console is offline, there is no practical way to simply verify what the configuration was. Cloud backups may exist, but a backup is primarily a restore mechanism. Having to restore a backup to another console just to confirm a VLAN, port assignment, or previous network configuration is unnecessarily cumbersome.

A “Last Known Configuration” or “Offline Configuration Snapshot” in Site Manager would be especially valuable for MSPs when troubleshooting outages, validating previous configurations, documenting environments, or determining whether something was changed after the last known-good state.

Ideally, Site Manager would automatically retain the last synchronized configuration whenever a console is online and make that snapshot available for read-only viewing whenever the console becomes unreachable.

This seems like information UniFi is already in a position to retain through remote management and cloud backup functionality.

Exposing it in a safe, read-only format would make Site Manager significantly more useful for troubleshooting and administration.

Thank you.

Carmine

So about 2 weeks ago i got an email stating my Official Hosting payment was declined, i remembered it was being paid for by an amazon card that closed. I then added a second card to the portal and though it would auto try the new card. Well, it did not, and here beings the UNNECESSARY DRAMA and scare.

Fast forward to, today, 2 week later, i awake to more than 50% of my 140 sites offline. I reach out to technical support, and they inform me they will get into in contact with Hosting Solutions(THEY DO NOT HAVE A DIRECT SUPPORT OPTION), and let me know, as they dont know why either. About 4 hours go by and i am getting nervous, i reach out to them again, this time the tech said Hosting told them its due to my payment declining, and i have received ZERO updates from support via email. Eventually i check and realize i got an email to say my account is being deleted 10 hours ago, and now i am TERRIFIED.

It has been 12 hours and support CANNOT give me any updates as to the state of my account, though i have 2 payment methods on my account.

@UI-Team

Only for one Site (we have >200) we have a problem creating a custom Role in the Fabric. Protect is used on that site UDM with one working G5 Bullet Pro camera and it is not possible to create a custom role with one user and only one specific location assiged to it.

On the privileged Details section selecting custom Option it says "no devices adopted". But there is a camera adopted, it is working in protect an accessible. Once i assign a second site scope also running protect it is working fine and the role can be created but this is not whated.

Any ideas?

I hope someone here can help me out. What am I missing.

We also use multiple UCG-Ultras and UDM pros in our offices and installed sites. And obviously this is what they were designed for and are incredible.

However unfortunately our events/moving ones have a large range of people using them, across multiple use cases. Sometimes the configs Start to get a little messy. Until recently we have recently just been factory resetting them for each new event. But assisting less network inclined people becomes a lot harder.

We are currently testing out a having a default backup, with all UDMs and UCGs linked to one account (with multiple admins).

But I was wondering if there was a way the device could be reset to "Business default" Kinda like factory default but pre configured. Then leave it so just the Owner can factory default. Or a better way this could be managed?

Sorry of the probably dumb question. But we are currently trying to bring the next wave in, and want a simple way so they can learn easier.

The company I am at is hybrid-joined.

I would like to setup the VPN on fabric to use Entra but I am not sure what security priviledges I need to give to the entra account to interface fabric?

I would like to get it connected to see if I can use the 2MFA over Entra to for the VPN users. Since it doesn't look like Ubiquiti is going to offer any kind of 2 MFA VPN access with OpenVPN anytime soon.

Thanks,

• WAN1: restricted healthcare network / private internet connection
• WAN2: unrestricted 5G backup connection

The restricted WAN is intentionally used for normal client traffic, it is a "secured" network that only allows outbound TCP traffic to port 80 and 443; hence it does not allow the Cloud Gateway to establish all required connections to UniFi Site Manager.

As a result, the gateway has working internet connectivity for the local network but appears offline in UniFi Site Manager.

Current limitation

UniFi Policy-Based Routing allows routing client/VLAN traffic through a specific WAN, including destination/domain-based rules.

However, there does not appear to be a way to apply these policies to traffic generated by the Cloud Gateway itself.

For example, I would like to create a rule such as:

• Source: Cloud Gateway / Local Gateway
• Destination: UniFi cloud services / ui.com
• Interface: WAN2

or preferably:

• Source: Local Gateway
• Destination: selected domains/IPs
• Interface: selected WAN

Why this would be useful

This would allow management traffic to use an unrestricted secondary WAN while leaving production/client traffic on a restricted or private WAN.

This is particularly useful for:

• Healthcare/private networks
• MPLS or restricted business connections
• Managed ISP connections with outbound filtering
• Backup LTE/5G connections
• Sites where only management traffic should use a secondary WAN

Currently, the workaround is effectively to make the unrestricted WAN the default route and policy-route all client networks back through the primary WAN, which is silly.

Requested feature

Please add Gateway / Local Gateway as a selectable source in Policy-Based Routing / Traffic Routes.

Ideally this should support:

• Local gateway-originated traffic
• Domain/IP destination matching
• WAN/interface selection
• Failover behavior
• Optional kill switch

This would make multi-WAN setups with restricted primary connections significantly easier to manage.

Alternatively perhaps considering automatic fallback for gateway originated traffic to fallback over WAN2 if it cannot reach unifi over WAN1. This would make management on restricted WAN connections better and could even allow for backup connections to be exclusively used for OOB purposes.

@UI-Team

I have a WG and Tailscale site running on Oracle free and so thought I would try that first for Unifi. I used the AmazedMender16 script to get a Unifi network server running and connected. But like with other efforts on Oracle, the NAT with the public IP to private IP brings complications (and is largely above me). Unifi shows a 10.0.0.x IP rather than the public IP.

I have opened the STUN port which one guide suggested would help but it hasn't shifted the IP yet.

I have set the manual inform override but that has not updated the adoption link. It still shows 10.0.0.x.

At this point, it will not let me add this network application site to a SD-WAN. It doesn't show. That may be because I haven't yet adopted a device. I will do that when I get back on-site. However given the IP, I am doubtful that this solution will work for SD-WAN unless I can somehow get the server to see the public IP.

I doubt that I can manually override the WAN IP internet settings and the connection still work.

I wanted to try the MallocArray Terraform but I think I don't have enough free network profiles. I expect that it didn't work because I already have 2 sets of network profiles (VCN / subnets / etc). I would need to combine these networks so that all the VMs used one network to try this script again but I am wondering if anyone can confirm if this script terraform is able to show a public IP on the unifi network application. If it doesn't, then it is not worth the trouble.

If anyone has been successful getting a Unifi instance running on Oracle with a public IP that allows for SD-WAN, I would appreciate any guidance.

Thank you, Rob

Given Ubiquiti's ongoing deprecation of the legacy UniFi Network Server in favor of UniFi OS Server: does this CloudKey — because it currently identifies as a legacy self-hosted instance — fall under that deprecation and lose support/updates, even though the underlying hardware is a CloudKey Gen2+? Or is this identity flag purely cosmetic, with no functional impact since the CloudKey runs its own built-in Network application regardless of the reported label?

If this does carry deprecation risk, what is the correct procedure to restore the CloudKey's native hardware identity without needing to re-adopt all 26 devices on the network?

@UI-Team

Lewis.

I have the following equipment:

UDM Pro Max

USW Pro Aggregation

ENVR

UNAS Pro

The network has been kept simple for now. All devices are on the default network with VLAN 1 in the 192.168.17.1 ... 192.168.17.254 range.

All devices are owned and set up by a single account.

In SIte manager I had the option to merge the UNAS into one site with the Dream Machine.

I do not have this option for the ENVR.

The only shared application between the devices was Protect. This is now uninstalled and only runs on the ENVR.

It is important for the ENVR to be merged into the same site as the Dream Machine. The ENVR will need to run the Access application. Identity users currently use endpoint to open doors, connect to wifi, etc. If The ENVR is treated as a different site, all the functionality will be split across different sites in the app, which is not the intent.

Please could you advise how I can merge the ENVR into my existing site?

I was looking at the Fiber Loco (UF-LOCO) product page and noticed something that seems odd.

One of the product images explicitly labels the device as:

"GPON CPE with integrated WiFi"

However, I can't find any Wi-Fi information anywhere else on the page. The technical specs don't appear to list:

• Wi-Fi standards (802.11ax/ac/n)
• 2.4 GHz or 5 GHz radios
• Antenna specifications
• Wireless throughput
• SSID configuration options

The hardware photos also only show a GPON port, GbE LAN port, reset button, and power input.

Normally if a device had integrated Wi-Fi, I'd expect that to be a pretty prominent feature in both the specifications and marketing copy.

Can anyone confirm whether:

1. The UF-LOCO actually contains a Wi-Fi radio that's simply undocumented?
2. The image annotation is a leftover from an earlier product revision?
3. The product page image is just incorrect?

Fiber Loco - Ubiquiti Store Canada

Curious if anyone from Ubiquiti can clarify.

Thanks!

@UI-Team

I may understand that somehow this simplifies the UniFi backend model but it does not help to reflect device management reality.

Please consider adding some workaround to allow having independent names for the site and the router device. Perhaps an alias of the device that is used only in the network app?

According to the Site Manager 5.8.1 release notes, a new feature has been added:

• Remote Screen Sharing for macOS and Windows Endpoints

I would like to use this feature, but I cannot find where it is located in the interface.

The users do have the UniFi Endpoint application installed on their Windows PCs, and the devices are correctly listed in Identity. However, there is no visible option to start or request a remote screen-sharing session.

Could you please let me know:

• where this feature can be found in the interface;
• whether there are any specific prerequisites required to use it;
• whether the feature is currently available in France.

Thank you in advance for your assistance.

Kind regards,

Alain.

we currently have "Consolidated People Management" on, and we would like to turn it off.

We would like to know if all the tenants and users of each individual site will be loosing their access rfid card or pin if we turn it off, or it will stay active and we not going to have issues?

@UI-Team

I'd like to share a product/partner concept from the perspective of a contractor who sees an opportunity for UniFi to become much more than a networking and security platform in the residential market.

My name is Tim Southard, and I'm the Director of Product Development at Nichols, an electrical, plumbing, heating and cooling contractor serving the Greater Rochester, New York area.

Part of my role is researching new products, technologies, manufacturer relationships, and services that we can bring to our customers. We are already using and testing UniFi products across Network, Protect and Access, and I've become increasingly interested in what UniFi could eventually mean for the entire home.

What we're seeing in the contractor industry

Recently we've started working with companies such as Emporia Energy and Resideo/Honeywell, and we're seeing an interesting shift.

Manufacturers aren't simply selling a smart device anymore.

They're creating contractor partner portals.

For example, a contractor can install connected equipment in a customer's home, the homeowner retains their normal app and control, but the contractor can—with the customer's permission—remotely monitor certain equipment health, faults or conditions.

For a service contractor, that's extremely valuable.

Instead of waiting for the homeowner to discover that something has failed, we're potentially able to identify a problem and proactively offer assistance.

That got me thinking:

UniFi already has most of the foundation for this.

UniFi can already touch a tremendous amount of a property:

• Internet and networking
• Wi-Fi
• Cameras
• Door access
• Security and alarms
• Environmental sensors
• EV charging
• UPS and power equipment
• Building/device management

What seems to be missing is a residential contractor/managed-home layer that brings these pieces together.

Our vision at Nichols is something I would describe as:

Security and health monitoring for the entire home.

Not "home automation" in the traditional sense.

We aren't looking to turn lights on and off for customers.

We want to know whether the important infrastructure of a house is secure, online, operating normally and healthy.

As an electrical, plumbing, heating and cooling contractor, that creates an interesting opportunity because if a system reports a problem, we have technicians who can actually do something about it.

One product I would love to see: UniFi Energy Monitor

This seems like an especially natural addition to the UniFi ecosystem.

Imagine a UniFi device installed at the home's electrical panel with:

• Main service CT monitoring
• Individual branch-circuit CTs
• Real-time electrical usage
• Historical consumption
• Circuit-level monitoring
• High/low consumption alerts
• Abnormal load detection
• EV charging integration
• HVAC electrical-use monitoring
• Solar/battery integration
• Load-management capability

Essentially, give the home's electrical system visibility inside UniFi.

UniFi already has the concept of Power Grid for EV charging. Extending that philosophy to the electrical service and major loads could be incredibly powerful.

As an electrical contractor, this is something we could install as part of a service upgrade, EV charger installation, generator/backup power project or premium home-service program.

Then take Site Manager one step further

I'd also love to see a Managed Home / Contractor mode within Site Manager.

The homeowner should absolutely own their UniFi system and their data.

But they could grant a trusted service company limited monitoring permissions.

For example, Nichols shouldn't necessarily be able to casually view a customer's camera recordings.

But perhaps we could see:

Smith Residence

• Network: Healthy
• Internet: Online
• Security devices: Healthy
• Cameras: 7/7 online
• Smoke/CO devices: Healthy
• Water sensor: Normal
• Electrical service: Normal
• EV charger: Online
• UPS: Healthy

And then receive actionable alerts such as:

• Electrical usage anomaly detected
• EV charger fault
• Smoke/CO device offline
• Water sensor alarm
• Network gateway offline
• Camera offline
• Unusual HVAC circuit cycling
• Sump pump circuit hasn't operated within an expected period

The permission system would be critical. A contractor needs equipment-health information, not unrestricted access to the customer's private life.

This could go beyond electrical

We're currently evaluating a similar contractor-monitoring concept on the HVAC side through Resideo/Honeywell.

That raises an even larger question:

Could UniFi eventually provide APIs or integrations that allow other important home systems to report basic health information into the UniFi ecosystem?

Imagine one secure infrastructure dashboard containing:

Network + Security + Electrical + HVAC + Plumbing/Leak Protection + EV + Backup Power

UniFi doesn't necessarily need to manufacture every furnace, water heater or shutoff valve.

It could become the secure platform connecting and monitoring them.

Why I'm bringing this to Ubiquiti

I realize our use case is somewhat different from a traditional MSP.

Nichols isn't primarily an IT company.

We're the people working on the physical infrastructure of homes every day—electrical systems, plumbing systems, heating, cooling, EV chargers, service panels and increasingly connected-home technology.

That's exactly why I think there's an opportunity here.

A network MSP can tell a customer that their access point went offline.

A full-service home contractor could potentially tell a customer:

"Something important in your home isn't operating normally. We noticed it, and we can help."

That's a very different type of relationship with a homeowner.

If Ubiquiti is exploring this type of residential contractor model, energy-monitoring product, managed-home capability, or broader "whole-property" strategy, Nichols would be very interested in talking with the product team and potentially serving as a real-world contractor use case or pilot environment.

We're already trying to determine what the next generation of residential service should look like.

From where I sit, UniFi has an unusually large number of the pieces already in place.

I'd love to see them connected into something bigger.

Tim Southard

Director of Product Development

www.CallNichols.com

Nichols — Electric • Plumbing • Heating • Cooling

Greater Rochester, New York

I believe I have found a reproducible issue involving unifi.ui.com running in Safari on macOS that can consume hundreds of gigabytes of local disk space.

Environment

Mac: Apple Silicon Mac Studio

macOS: 26.6.2

macOS Build: 25G83

Safari: 26.6.2 (21624.5.1.11.3)

Site: https://unifi.ui.com

Problem

Safari/WebKit LocalStorage associated specifically with unifi.ui.com is continuously growing a SQLite write-ahead log (localstorage.sqlite3-wal) without apparently checkpointing it back into the LocalStorage database.

I originally discovered the problem because Safari was consuming approximately 464 GB of disk space.

I traced essentially all of it to this WebKit WebsiteData origin:

~/Library/Containers/com.apple.Safari/Data/Library/WebKit/WebsiteData/Default/<WebKit-origin>/<WebKit-origin>/LocalStorage/

The WebKit origin metadata identifies the origin as:

https

unifi.ui.com

The LocalStorage directory contained approximately:

localstorage.sqlite3 — 3 MB

localstorage.sqlite3-shm — 928 MB

localstorage.sqlite3-wal — 462 GB

In other words, almost the entire 463 GB WebKit WebsiteData allocation was a single SQLite WAL file associated with unifi.ui.com.

Cleanup and Reproduction

I completely quit Safari and removed only the affected UniFi LocalStorage directory.

This immediately reduced the Safari container from approximately 464 GB to 1.3 GB.

I then reopened Safari and used unifi.ui.com again.

The problem immediately began reproducing.

The newly created WAL grew from approximately 53 MB to 208 MB in a short period.

I then monitored the WAL every 30 seconds.

Observed growth:

09:22:34    240 MB
09:23:04    256 MB
09:23:35    272 MB
09:24:05    304 MB
09:24:35    320 MB
09:25:05    336 MB
09:25:35    352 MB
09:26:05    384 MB
09:26:35    400 MB
09:27:05    416 MB
09:27:35    416 MB
09:28:05    432 MB
09:28:35    432 MB
09:29:05    448 MB
09:29:35    448 MB

This represents approximately 208 MB of additional WAL growth in seven minutes.

The main LocalStorage database remained essentially empty while this was occurring.

After completely quitting Safari, I checked the storage again. The WAL had not checkpointed or been removed:

LocalStorage                         481 MB
localstorage.sqlite3-wal             480 MB
localstorage.sqlite3-shm             960 KB
localstorage.sqlite3                   4 KB

Therefore, quitting Safari does not appear to cause this WAL to checkpoint back into the database.

Impact

In my case, the WAL eventually reached approximately 462 GB before I discovered the problem.

Because APFS/Time Machine local snapshots retained blocks belonging to the runaway file, simply deleting the LocalStorage did not initially recover the disk space.

After deleting the affected LocalStorage, I also had to thin the local Time Machine snapshots before the space became available again.

Available disk space increased from approximately 84 GiB to 600 GiB after cleanup and snapshot thinning.

Current Workaround

I have stopped leaving unifi.ui.com open in Safari and am using another browser for UniFi.

I have also excluded this specific UniFi Safari LocalStorage directory from my Time Machine backups so a future runaway WAL is not unnecessarily copied into normal Time Machine backups.

Suspected Behavior

This appears to be a WebKit LocalStorage/SQLite WAL checkpointing problem triggered by activity from unifi.ui.com.

The important characteristics are:

• The issue is reproducible after completely deleting the affected LocalStorage.
• The WAL begins growing again immediately when using UniFi through Safari.
• Growth can be observed continuously while UniFi is running.
• The actual localstorage.sqlite3 database remains extremely small.
• Quitting Safari does not checkpoint or substantially reduce the WAL.
• The WAL can eventually grow to hundreds of gigabytes.

I can provide additional filesystem information, WebKit origin information, logs, screenshots, or perform additional reproduction/testing if it would help diagnose the issue.

@UI-Team

With the new MSP Groups and IdP functionality in Site Manager 5.8.1, we have run into a rather unfortunate onboarding loop.

Our setup:

Microsoft Entra ID → MSP IdP → Identity Sync → MSP Group

The synchronization itself works correctly. Our Entra users appear in UniFi, we can assign them MSP roles, and UniFi sends them an invitation email.

The problem starts when the employee follows that invitation.

They cannot complete the invitation because Site Manager requires them to already have a UI Account.

But these are newly synchronized Entra users. They don't have a UI Account yet.

So the process currently becomes:

Entra user synced → user appears in UniFi → role assigned → invitation received → invitation requires UI Account → user has no UI Account → manually discover that account.ui.com registration is required → create separate UI Account → return to invitation → continue onboarding → finally use IdP authentication (and ONLY to Customer Fabrics which has the Admin Enforce iDP setting on!)

This is particularly confusing because from the MSP administrator's perspective the user has already been provisioned successfully from the configured authoritative IdP.

It also significantly reduces the benefit of IdP-based MSP onboarding.

Feature request

Please add automatic UI Account provisioning / Just-In-Time account linking for MSP users synchronized from an IdP.

Ideally the process should simply be:

Entra ID → Identity Sync → MSP Group + role → first SAML login → automatic UI Account creation/linking → Site Manager

If UniFi technically requires an underlying UI Account, that is fine. But that account should be created and linked transparently as part of the federated identity process rather than requiring every MSP employee to manually register another account beforehand.

This would also provide a much cleaner identity lifecycle for MSPs:

Joiner: add employee/group in Entra → UniFi access automatically provisioned

Mover: change Entra/MSP role → access changes centrally

Leaver: disable/remove identity → UniFi access removed

At minimum, until JIT provisioning is available, the invitation email should explicitly tell a newly synchronized administrator that they must first create a UI Account with the same email address before the invitation can be accepted.

The current invitation implies that the synchronized user can simply continue the onboarding process, while in reality there is an undocumented prerequisite that causes the user to hit a dead end.

For MSP environments this really should be a zero-touch IdP onboarding experience.

Odd issue here.

All of my sites except one is reporting correct internet health from the site manager. The affected site has a grey bar like it's not connected, but when you drill into the site, the health bar is perfectly fine.

Site manager:

In the site:

Any thoughts for an OCD guy?

Thanks,

Jeremy