Authenticate to Horizon and return access and refresh tokens.

The access_token is valid for ~8 hours. The refresh_token can be used with horizon_refresh_token to obtain a new access_token without re-entering credentials.

This tool also updates the running server's active token so subsequent tool calls work immediately without restarting the server.

SECURITY: Copy the returned access_token to your MCP client config (HORIZON_ACCESS_TOKEN env var), then clear it from the conversation. Treat both tokens as passwords — do not share or log them.

Exchange a refresh token for a new access token.

Use this before the current access token expires (~8 hours) to maintain an active session without re-entering credentials.

Invalidate the current Horizon session (access + refresh tokens).

List all Horizon Connection Servers in the pod.

Get configuration details for a specific Connection Server.

List all vCenter Servers configured in the Horizon environment.

Get environment-level properties including version, FIPS mode, and feature flags.

Get the global Horizon configuration settings.

Includes client session timeouts, pre-launch settings, display protocol defaults, HTML Access settings, and other global options.

Get global VDI policies including USB redirection, multimedia redirection, clipboard settings, and other environment-wide policy settings.

Update global VDI policies (USB redirection, clipboard, multimedia redirection).

Always call get_global_policies first to read current values. Only modify the specific fields you intend to change — pass the full object back.

Update a Horizon settings section.

setting_type maps to these resources and endpoints: general → horizon://config/settings/general security → horizon://config/settings/security client → horizon://config/settings/client feature → horizon://config/settings/feature agent-restriction → horizon://config/settings/agent-restriction

Always read the current settings first and only modify the fields you intend to change.

List all Horizon licenses and their status, mode, and expiry information.

Get the configuration and connection status of the Horizon event database.

List instant clone domain accounts used for provisioning instant clone desktops.

List image management streams, versions, or tags.

List all registered Unified Access Gateways.

Initiate an immediate backup of one or more Connection Servers.

CAUTION: This triggers an active backup operation, not a validation check. If no server_ids are provided, all Connection Servers are backed up.

List all available Horizon MCP tools, resources, and unsupported operations.

Call this to understand what can be managed via this MCP server before attempting a task, or to accurately inform users which Horizon features are and are not supported.

Returns three sections: tools — all callable tools grouped by function resources — read-only MCP Resources (horizon://) for config and monitor data not_yet_supported — Horizon API operations not yet implemented

List entitlements for all pools of the given type.

Returns which users and groups are entitled to each pool. Use get_pool_entitlement for a specific pool's details.

Get the users and groups entitled to access a specific pool.

Add, replace, or remove entitlements for a desktop or application pool.

CAUTION: action='replace' removes any existing entitlements not in the provided list. CAUTION: action='remove' immediately revokes access for the specified principals. Always confirm with the user before using replace or remove.

Search for AD users and groups in the Horizon environment.

Use the returned 'id' field when setting pool entitlements.

Common filter fields: name, login_name, group, domain. Example filters: Find user by login: {"type":"Equals","name":"login_name","value":"jsmith"} Find by display name: {"type":"Contains","name":"name","value":"John"} Groups only: {"type":"Equals","name":"group","value":"true"}

Get detailed information about a specific AD user or group.

List all Active Directory domains configured in the Horizon environment.

Returns domain details including trust relationships, status, and bind accounts.

List AD containers (OUs) available in a domain for pool provisioning.

The rdn (relative distinguished name) from these results is used as the ad_container_rdn in create_desktop_pool and create_rdsh_farm provisioning_settings to control which OU newly provisioned computers are placed in. This is the OU picker equivalent of what the Horizon Console shows during pool creation.

Get a mapping of domain NETBIOS names to DNS names for all configured domains.

List Horizon audit events (administrative actions and system events).

Useful for reviewing recent changes, troubleshooting, and compliance auditing.

List VMs in vCenter that can be used as base images for instant clone pools/farms.

List datastores available in vCenter for desktop pool or farm provisioning.

List VM folders in a vCenter datacenter for use in pool/farm configuration.

List datacenters in a vCenter Server.

The datacenter ID is required by list_vm_folders, list_hosts_or_clusters, and create_desktop_pool / create_rdsh_farm provisioning_settings.

List hosts and clusters in a vCenter datacenter.

The host_or_cluster_id is required by list_datastores, list_resource_pools, list_network_labels, and create_desktop_pool / create_rdsh_farm provisioning_settings.

List resource pools on a host or cluster.

The resource_pool_id is required by create_desktop_pool and create_rdsh_farm provisioning_settings.

List snapshots of a base VM that can be used as the image for an instant clone pool or farm.

The snapshot_id is required by create_desktop_pool and create_rdsh_farm provisioning_settings when source is INSTANT_CLONE.

List network labels (port groups / distributed port groups) available on a host or cluster.

Network label IDs are used in the nics array of create_desktop_pool and create_rdsh_farm provisioning_settings: "nics": [{"nic_id": "", "network_label_id": ""}]

List network interface cards (NICs) available for pool or farm NIC configuration.

The nic_id from these results pairs with a network_label_id (from list_network_labels) in the nics array of create_desktop_pool and create_rdsh_farm provisioning_settings: "nics": [{"nic_id": "", "network_label_id": ""}]

Pass base_vm_id + base_snapshot_id to filter NICs for an instant-clone pool, or vm_template_id to filter NICs for a full/linked-clone pool.

List VM templates available in vCenter for use as pool base images.

Templates are used for full-clone or linked-clone desktop pools (source=FULL_CLONE or LINKED_CLONE). Use the template_id in create_desktop_pool provisioning_settings instead of parent_vm_id.

List datastore clusters (Storage DRS pods) available on a host or cluster.

Use the datastore_cluster_id in create_desktop_pool or create_rdsh_farm provisioning_settings when using Storage DRS for automated datastore placement.

List vCenter customization specifications (Sysprep/QuickPrep) available for pool provisioning.

The customization_specification_id from these results is used in create_desktop_pool and create_rdsh_farm provisioning_settings to apply OS customization (hostname, domain join, license key) to provisioned VMs.

Retrieve diagnostic information for a user session in a single call.

Fetches any combination of: logon timing breakdown, real-time display protocol metrics, 15-minute historical performance, running processes, and active remote applications. Results are keyed by aspect name; a failed aspect returns its error message as a string rather than failing the whole call.

Generate a Microsoft Remote Assistance ticket for a user session.

Returns an MSRA connection ticket that allows a help desk technician to view and control the user's desktop session.

Terminate a specific remote application running in a session.

CAUTION: The application will be force-closed. Unsaved data will be lost. Confirm with the user before calling this.

List all desktop pools (VDI and RDS) in the Horizon environment.

Get detailed configuration and status of a specific desktop pool.

Create a new desktop pool.

CAUTION: Provisioning an AUTOMATED pool immediately begins creating VMs in vCenter. Always confirm with the user before calling this.

Update an existing desktop pool's configuration.

Delete a desktop pool and all of its machines.

CAUTION: This is irreversible. All machines in the pool are deleted and any active user sessions are terminated. Always confirm with the user before calling this.

Enable, disable, or toggle provisioning for one or more desktop pools.

enable/disable controls whether new user sessions can be established. enable-provisioning/disable-provisioning controls whether new VMs are provisioned. Disabling provisioning is the correct way to pause scale-out during maintenance.

List machines (virtual desktops) in the environment.

To filter by pool, use: filter={"type":"Equals","name":"desktop_pool_id","value":""} To filter by state, use: filter={"type":"Equals","name":"state","value":"AVAILABLE"}

Get detailed information about a specific machine.

Perform a bulk action on one or more machines.

Actions:

• shutdown: gracefully power off (use force=true to override active sessions)

• restart: reboot the machine (use force=true to override active sessions)

• reset: hard reset (power cycle) — may cause data loss

• rebuild: re-provision the machine from the pool's image

• recover: recover a machine stuck in an error state

• enter_maintenance: put machine into maintenance mode (prevents new sessions)

• exit_maintenance: take machine out of maintenance mode

• archive: initiate machine archival

CAUTION: rebuild and reset are destructive and will discard unsaved user data. Always confirm with the user before calling these actions.

Assign or unassign users to a dedicated desktop machine.

Only applicable to machines in dedicated (non-floating) desktop pools. A machine can only have one assigned user at a time in most pool configurations.

List all RDS (Remote Desktop Session Host) farms in the environment.

Get detailed information about a specific RDS farm.

Create a new RDS farm.

CAUTION: Provisioning an AUTOMATED farm immediately begins creating VMs in vCenter. Always confirm with the user before calling this.

Update an existing RDS farm's configuration.

Delete an RDS farm and all of its servers.

CAUTION: This is irreversible. All servers in the farm are deleted and any active user sessions are terminated. Always confirm with the user before calling this.

Enable or disable one or more RDS farms.

Disabling a farm prevents new sessions from being routed to it without terminating existing sessions — useful for draining a farm before maintenance.

List published application pools in the environment.

Get detailed information about a specific application pool.

Publish a new application pool from an RDS farm.

Update an existing application pool's configuration.

Delete a published application pool.

CAUTION: Users will immediately lose access to this application. Always confirm with the user before calling this.

List active user sessions in the environment.

Common filter fields: user_name, desktop_pool_id, machine_name, client_name, state. Session states: CONNECTED, DISCONNECTED, PENDING.

Get detailed information about a specific user session.

Disconnect one or more user sessions (sessions remain active, clients are disconnected).

The user's applications keep running. Use logoff_sessions to fully terminate sessions.

Log off one or more user sessions, terminating their running applications.

CAUTION: This will close all running applications in the session. Unsaved data will be lost. Always confirm with the user before calling this.

Reset or restart the virtual machine backing one or more sessions.

CAUTION: Both actions will terminate the user's session. reset is a hard power-cycle and may cause data loss. restart attempts a graceful reboot but the session will still end. Always confirm with the user before calling this.

Send a pop-up notification message to one or more active user sessions.

Get health and status across Horizon infrastructure in a single call.

Components:

• summary: overall health rollup across all component types

• connection_servers: per-server reachability, load, and tunnel counts

• gateways: Unified Access Gateway connectivity status

• virtual_centers: vCenter Server connectivity and health

• ad_domains: Active Directory domain reachability and bind status

• farms: RDS farm health and server capacity

Results are keyed by component name. A failed component returns its error as a string rather than failing the whole call.

Get detailed health information for a specific Connection Server.

Get performance and capacity metrics across the Horizon environment in a single call.

Scopes:

• pools: session and machine counts per desktop pool

• sessions: aggregate connected/disconnected/pending session totals

• machines: aggregate machine state counts across all pools

• system: CPU and memory metrics for connection servers

• rds_servers: RDS server state counts across all farms

• license: current and peak license usage

Results are keyed by scope name. A failed scope returns its error as a string rather than failing the whole call.