However the Endpoint app for Drive is extremely limited. It badly needs these features for images:

• pinch and zoom on images

• freeform tags

• editing date (such as scanned photos),

• description field,

• rotation

And the previews sometimes spin forever and seem to time out from even trying. I experience this while on the local network, not even remote where I might expect this more.

Is UniFi identity with Azure Sync only available if the site is in a Fabric?

Also, I moved a site to be inside of a fabric, and my "free 10 touch passes" disappeared, and I immediately had to purchae them.

Is it one or the other?

Oh, and up the limit past five.

Sign-In Failed

Organization not found. Check your organization domain and try again.

If I try "Add New Account" -> "Sign In" in the Endpoint app and enter the vanity domain, it says "This organization only supports direct invitation sign in. Use the invitation link sent to your email to sign in."

@UI-Team How can I fix this?

I checked my account and I see this:

However, I'm supposed to be a Full Admin I believe?

My goal is to migrate accounts from the local UniFi console to the Fabric. How can I do this?

Microsoft doesn't recognize any outages that would cause this and Entra in itself is working fine so is this an ongoing issue at Ui or something there is a workaround for?

• Send an invitation, I start by selecting the user (me) in unifi.ui.com/iam/<userid>/devices and clicking Resend Invitation Email. The user already has a successful connection through the Endpoint desktop app on Windows.

• I have a Work profile on my mobile device, so I need to copy the URL from the 'Activate in UniFi Endpoint', otherwise it opens the URL in the wrong profile and the app is not allowed to install there.

• After pasting the URL into my default profile browser, I get the redirect to play.google.com, then the redirect to open in the local Play Store. The app is already installed, so clicking Open successfully opens the Endpoint app.

• There are now two options - sign in or scan QR code. Clicking Sign In yields this screen:

• Clicking Activate does nothing, and since I'm using a vanity domain, entering the vanity domain yields:

• So, it's unclear why the invitation link isn't getting passed through the redirects to the app. If I back out of the Playstore site, I can get to this page, but the 'click here' just reloads the page.

• From the Endpoint splash screen, scrolling down reveals some text regarding how to generate a QR code from the Desktop app; however, I do not see an option in the desktop app to generate a QR code.

• Endpoing settings options:

Versions:

UDM SE - 5.1.33

Network - 10.6.106

There is a fabric created with two sites, both running identical software versions. Consolidated People Managements is Enabled, with the IdP set to None (UniFi Native Credentials).

Any assistance would be appreciated.

Hi there. I’ve noticed another feature has disappeared from the UI interface

There is no way to upload a profile photo of users on the UI web console anymore and photos that were there are now gone unless the user is a registered UNIFI member which most of my users don’t won’t or need to have a UniFi account. We don’t want users having UniFi accounts as there’s no point and people resist from making accounts when all they need is access to a few doors or WiFi

I know there are lots of new features, but to honest I’d like the ability to upload profile pictures, the option to change the date format from USA date format to EU and UK formats as I don’t reside in the States, and the ability to change Site Consoles language on a site by site basis as I have sites in non English speaking countries.

These features were all there before and now are gone. I can’t see that this would crash the system for a few lines of code to return all this.

Please return these features

Thanks.

When (hopefully) will this be integrated to the iOS app?

I have very disappointed customers, since I demoed the Endpoint app to them on an Android device, and they are deeming that a critical feature.

When importing from a csv file with "Send Automatically to New People" disabled, it's not feasible to manually click each user and then the Send Email button. We need to be able to select a large number of users and click one Send Email button to send an email to every user selected.

When selecting a single user, the Send Email option is available:

When selecting multiple users, only these options are available:

I'm just setting up the Unifi Fabric idp integration with Entra. When I check the application permissions, I see it needs some fairly broad permissions such as:

Synchronization.ReadWrite.All
Application.ReadWrite.All

AppRoleAssignment.ReadWrite.All

Now, the recent ConnectWise breach has permissions in Entra top of mind for a lot of us. One possible thing it abused was how the above permissions can allow App's to modify ANY application in the tenant, and can also elevate itself to GlobalAdmin permissions.

The much more restrictive permission of .ownedby is recommended to be used instead of the .all permissions above.

Can you justify why Unifi needs to be able to make these modifications to the entire tenant, basically giving itself Global Admin access? In the aftermath of this recent breach, this just seems like sloppy programming at best, and a huge security risk at worse.

Are you able to rescope the app to only require less powerful permissions?

@UI-Team

It would be interesting to have the ability to limit the total amount of devices a user can be logged on with Endpoint to a specified ammount. We've discovered a user had been able to connect 5 devices with his account due to potentially getting a few invitation emails sent but even after working with Unifi support we were not able to identify the cause.

Such ability would make the environment much more secure. We've seen other apps like gym access membership that would log out the extra devices as the person would log in new ones.

i would like to configer the domain and wifi and VPN connection like i can do on windows and mac OS.

so my users dont need to configure enything.

Thanks.

Please add a Fabric-level Network Access Profile that can be assigned to a role. When a person is added to that role—manually or through an IdP group synced with SCIM—UniFi should automatically place that authenticated person into the appropriate VLAN or virtual network.

Proposed behaviour

• A Fabric role can include one optional Network Access Profile.

• The profile maps to a logical virtual network, with a per-site VLAN mapping where needed.

• It applies consistently to One-Click WiFi, WPA2/WPA3-Enterprise WiFi, wired 802.1X and, where relevant, One-Click VPN.

• UniFi's built-in RADIUS should translate the assignment into the required standard RADIUS tunnel attributes automatically; administrators should not need to recreate Fabric users as local RADIUS credentials or operate an external RADIUS service solely for VLAN assignment.

• A role or person should have one clearly effective network profile per site. Roles are otherwise permissive and additive, so conflicting VLAN assignments must be rejected or resolved with explicit, visible precedence—not silently combined.

• SCIM group changes should update both service permissions and network placement immediately. Enable RADIUS CoA / re-authentication so a changed or revoked role takes effect for active WiFi sessions without waiting for a long lease or manual reconnect.

• Keep person-based 802.1X distinct from device-based MAC authentication, which should remain appropriate for fixed devices such as IoT, phones, cameras and access hardware.

• Provide an audit trail showing the role change, effective network profile, site, device, assigned VLAN, authentication time and revocation event.

• Expose the capability in the public API, so Fabric is also a reliable policy source for automation.

This would make a Fabric role a coherent least-privilege identity object: assigning it could grant the intended Endpoint/VPN/door permissions and the correct network segment in one action. Today those functions are centralised, but VLAN enforcement remains a separate RADIUS administration workflow. Native role-to-network assignment would make UniFi's zero-trust model materially more complete and easier to operate at scale.

Would Ubiquiti consider adding this as a native Fabric and UniFi Network capability?

we are deploying UniFi Endpoint across our macOS fleet and are running into a certificate trust issue.

Environment:

• macOS 27
• UniFi Endpoint 4.2.2, deployed via MDM

Issue:

On every macOS device, when connecting to the network, the user is prompted to manually trust the certificate issued for standard.ui.com. On the Windows platform, with the same setup, we do not experience this issue at all.

My questions:

1. Is the only supported solution to deploy the certificate as trusted via an MDM configuration profile?
2. Are there any plans in the near future to change UniFi Endpoint on macOS to use a certificate signed by a publicly trusted CA, so that no additional trust configuration is needed?

Thank you in advance for your help.

Hi,

We're having some issues with the Unifi Endpoint with Fabric and Entra IDP.

1. Every day, or after connecting and disconnecting a few times during the day. The Endpoint app gets a blank entry (as shown in attached screenshot) and a error triangle with "VPN is not Not Working Problerly - Please contact your admin for more information".

The workaround the users have come up with for this: clicking the (+) button and logging in again. This works sometimes and is not very reliable as they may need to do it a few times.

2. The MFA (or realistically the re-auth as it's not asking for MFA when it's satisfied with Entra session) when having the "Require MFA on Every Connection" checked is not honored every time. I see that theres another post on this bug.

I've attached a support file on a machine where i could recreate the issue and our EFG where the VPN is set up + Fabric master site.