Getting Started with UniFi Fabrics
UniFi Fabrics provide a scalable foundation for managing multiple UniFi sites under a shared trust domain (a boundary within which identity and access policy are enforced consistently). By grouping sites into a fabric, you can centralize people and identity management, bind an Identity Provider (IdP) for Zero-Trust network security, and take advantage of advanced capabilities such as policy orchestration or centralized API endpoints.
For more information, see here.
Requirements
- UniFi OS v4.4 or newer.
- Identity Provider (IdP) binding requires any of the following consoles to be present within the Fabric: UDM Pro, UDM SE, UDM Pro Max, UDM Beast, EFG, EF Core, UCG-Fiber, UNVR Pro, ENVR, ENVR Core.
Getting Started
Best Practices
We recommend creating one Fabric per trust domain, typically defined by having a distinct Identity Provider (IdP) integration. If you manage multiple customer organizations as a managed service provider, see Managing Multiple Customers with an MSP Account. It lets your team scale across every customer Fabric you manage without duplicating access setup per Fabric.
Before creating a Fabric, we strongly recommend transferring ownership of all sites you intend to centralize to a single, company-owned email address (for example, it@example.com). Use this account to create and manage the Fabric. This approach helps ensure long-term continuity and prevents access issues during personnel changes.
Creating A Fabric
- Navigate to Site Manager.
- In the left-hand sidebar, open the Fabrics menu and click Create New.
- Enter a name for the Fabric and optionally upload a logo.
- Select the sites you own that will be members of the Fabric.
- Click Create Fabric.
Adding Sites To A Fabric
The Fabric Owner can add any site they own to a Fabric by following these steps:
- Navigate to Site Manager.
- In the left-hand Fabrics menu, hover over the Fabric and click Configure.
- Click Add Sites.
- Select the sites to add.
- Confirm the changes.
Removing Sites From A Fabric
The Fabric Owner can remove sites from a Fabric as follows:
- Navigate to Site Manager.
- In the left-hand Fabrics menu, hover over the Fabric and click Configure.
- Click Remove Sites.
- Select the sites to remove.
- Click Remove Sites to confirm.
Identity & Consolidated People Management
By default, each UniFi site maintains its own independent database of users and administrators. Fabrics allow you to consolidate people management across sites, providing several key benefits:
- Manage all people, including their Door Access credentials, from a single, centralized location
- Assign roles and permissions consistently across sites
- Enable the UniFi Endpoint app for seamless access to UniFi services, including WiFi, VPN, and Door Access
- Optionally integrate with an external IdP for real-time employee onboarding and off-boarding, and secure SAML-based authentication
Consolidated People Management
To enable Consolidated People Management:
- Go to Site Manager.
- Select a Fabric.
- Navigate to Settings > Identity.
- Enable Consolidated People Management.
- Optionally Bind an Identity Provider for Zero-Trust Networking, and automated employee onboarding and off-boarding.
- Optionally enable Enforce IdP Authentication. This enforces SAML authentication for anyone signing in to Site Manager and other ui.com domains globally, not just to this Fabric.
Note: This is only available for cloud IdPs like Microsoft Entra or Google Workspace, and can only be done once per email domain.
Enabling this feature automatically activates the Identity Sync Service, which runs on a designated UniFi Console referred to as the Master Site. This console acts as the orchestrator for people and permissions across all sites in the Fabric.
Explore Other Fabrics Features
- Bind an Identity Provider for Zero-Trust Networking, and automated employee onboarding and off-boarding
- Create Roles & Assign People Permissions
- Managing Multiple Customers with an MSP Account
- Multi-Site Orchestration and Templating