Earlier this year we setup Identity Hub in Fabric, syncing with an on prem AD server. This was just a test while we were considering replacing an existing door access control system with Unifi.

We haven't used any One-click VPN or One-Click Wifi at all, and just have test users for door access.

We appear to be affected by a glitch from back in July: https://community.ui.com/questions/Enabled-Fabric-and-now-most-users-cannot-sign-into-Identity-Endpoint/345f8a6f-ffbd-41b0-a288-d2568824278e?reply=7

We get the same error messages trying to do anything in identity hub like see our existing AD settings or after deleting that AD sync, trying to set it back up.

So it appears we'll need to disable Consolidated people Management and then set it up again.

My question is, will this cause any downtime for our two sites? As I said we're not using the one-click stuff at all, but each site does have Unifi AP's with Wifi configured (802.1x and PSK) and the two sites are using Fabric for a site-site VPN.

If there will be any interruption to users I'll wait and do this after hours.

Thanks in advance.

Currently have a fabric with a single site setup for IdP Binding to Entra as well as Enforce IdP Authentication. When I login to the Identity app on desktop I am properly redirected to Entra to sign in and all Conditional Access rules apply. However, once i'm logged in to the app I can toggle on and off VPN without any additional authentication requirements.

This feels like a little bit of a security concern, and I see that in the Fabrics One-Click VPN menu the option to Require MFA on Every Connection is checked. It does not seem like this is honored as I'm free to connect and disconnect from the VPN and pass traffic without ever being prompted to authenticate again (unless I log out of Identity completely).

I even went as far as to Revoke Session tokens in Entra but that didn't do anything for Identity or VPN login.

I should also note that in my testing, I got some mixed results between Windows and Mac:

• Mac seems to always connect no matter what, never prompts for Entra redirect after signing into Identity Endpoint
• Windows seemed to honor the MFA enforcement and redirect to Entra(?) - I did more limited testing on this as our target user base for the specific client we are doing this for is Mac

My questions are:

1. Do I need Identity Enterprise and to link it somehow to the Fabric for this feature to work?
2. If this is supported out of the box are there any instructions on what additional configuration may be needed? (Do I need Entra CA policies to restrict token lifetime, etc.)
3. Why doesn't Mac seem to honor this? :)

Editing to add versions:

UDM Pro - 5.1.33

Network - 10.6.106

UniFi Endpoint Version - 4.2.1

Device MacOS Version - 26.6

Current behaviour

- A firewall policy whose source zone is a WiFi zone offers an Identity option, and role/user selection works as expected.

- With Source Zone: Vpn, the available source options are Any / VPN Server / Site-to-Site / IP - no Identity option.

Why this matters

One-Click VPN gives all connected users the same network reach. Selecting the VPN server as the source matches every user on it equally, so there is no way to express something as basic as "HR staff should not reach development servers" without falling back to per-user IP rules - which defeats the purpose of identity-based policy.

This is increasingly relevant for organisations in the EU. NIS2 requires access control and network segmentation proportionate to risk, and least-privilege remote access is one of the most common ways to demonstrate it. Right now UniFi can express that for WiFi users but not for remote workers - which is exactly the population where it matters most. Anyone in scope of NIS2 running UniFi for remote access will run into this, so the feature would benefit a large and growing group of deployments, not a niche one.

Workarounds that do not solve it:

- Adaptive VPN (UID Enterprise Standard) controls whether a user may connect, not what they may reach afterwards. It is also not purchasable outside the US.

- Multiple One-Click VPN profiles with separate split tunnels would work, but Fabric supports only one One-Click VPN service.

- Manually created WireGuard servers fall outside Identity entirely, which breaks IdP-driven offboarding and creates a parallel user registry.

Request

Allow Identity Roles and users as a source filter for firewall policies where the source zone is Vpn, matching the behaviour already available for WiFi. Identity already manages VPN as a resource, so the association exists - it just isn't available to the firewall engine.

Is there a cache that I need to clean out? Anyone else run into a similar issue. And as these are attached to Enterprise UID, I assume after migrating to the other console (both the current and destination are within UID and within the same site) that there won't be any loss of user codes and/or Touch Passes (big selling point coming off our old access control system).

is it now avalable?

after updating to UniFi Endpoint on my Mac (OS 26.5) to version 4.2.1 (267), the credentials were lost and I had to resend them to myself to make Endpoint work again.

Is this a known bug?

Best regards,

Marc

I don't currently have remote access to the UNVR Pro (it's powered off and unplugged), and I'm several hours' drive away from it, so I have to go off of memory here. I tried to add it to my UID Enterprise Workspace, and instead of the familiar token generation process, I was presented with the SSH commands. I'm trying to find info mentioning this new process, and I've only come across the one post I linked above.

In any case, I ran the commands and had similar output to the linked post, although I also had some issue even installing the agent - It hung around 20% on the downloading side and then failed. I eventually was able to install the agent, but have not been able to get the token to work on the NVR.

What's the current correct way to add a console to a UID Enterprise Workspace? Specifically a UNVR Pro. I don't have a support file or anything and won't be able to generate one for now.

We are trying to implement the One-Click VPN in fabric using a split tunnel. We want to be able to access servers via hostname instead of IP but DNS across the split tunnel does not work.

Has anyone had anything similar and how did you resolve it? I have reached out to support but they are also unsure

Please add a bulk “Send / Resend Invitation” action to UniFi Fabric > People.

I needed to change the VPN DNS. This was only possible without any user.

Now i need to click in every user to resend the Invitation.

Thank you.

I have enabled the One-Click VPN inside the identity settings for my test environment Fabric in Site Manager. Once this is done, the VPN server is automatically created and creates its own network settings as shown in the screenshots below. With this, I am able to connect to my test environment from the Unifi Endpoint application and move from there into production. My biggest issue is not being able to specify the network address and DNS servers used by VPN users.

If I switch the advanced settings to manual in order to change the IP range used or specify DNS servers, I am then required to add at least one WireGuard client, which I don't want to have to do. The biggest benefit we were looking for was ease of setup and use, and having to manually create a bunch of client configuration files is against that.

I can accept the automatically generated network range for VPN clients (although I would prefer being able to specify), but I HAVE to be able to set the DNS settings or this solution isn't viable for my environment.

However, the command then returns /usr/lib/uid-agent/scripts/unifi-goapp-mgnt.sh: line 1343: cmd_bind: command not found

What We've Tried:

• Reinstalling the UniFi Endpoint App from scratch on both iOS and Windows
• Deleted any old credentials in the Endpoint app(s)
• Removed the user's native account in the Identity Dashboard
• Removed the Azure identity in the UniFi dashboard and re-synced from Azure
• Revoked & regranted one-click Wi-Fi site access
• Deleted cached UniFi certificates on Windows
• Confirmed consoles & network are up to date & Endpoint apps are up to date

The weird thing is... this user was not the only one of her kind. There were other users with similar native access to sites before we switched to Fabric + Azure SSO and those users do not have an issue connecting with one-click Wi-Fi. I'm at a loss at what we could try next. Any input is appreciated.

We need users to be able to open the front door (the G3 intercom) remotely and the other doors they have access to only locally, but this doesn't seem possible anymore with the Mobile Button feature in the Endpoint app.

Any suggestions or comments @UITeam?

I really enjoy how far the Identity app has come. We are currently implementing them with customers and it is nearly as good as using SCEP/WPA Enterprise but there is one small thing... very small: When the app is installed it automatically launches (as we used the argument for it) but it does not automatically trigger the user login flow.

If this would be implemented we could automatically signin the user with Entra ID/Edge and therefore make the enrollment of the Identity Endpoint app a true no-touch thing.

Thank you all in advance.

We started using a UDM Pro Max and are using identity on devices for VPN. Our client devices at the moment are a couple of macs and some windows laptops. my mac and the bosses windows seem to have no issue at all. but another mac and 2 windows got really bugged. They worked fine at first, went on business trip and one day to the other they could no longer connect to any network. I don't have all the info but they told me Hotspot on phone still worked for a while and then nothing worked anymore. I asked AI and it said it would be like an improper shut down of the vpn and might block the network driver or overwrite the dns?

Did anyone ever encounter the same issue? Is there a fix to that or how can i prevent it from happening?

Thanks in advance!