Upgrading VCF Identity Broker to 9.1.1 Step by Step

Cosmin Trif — Wed, 09 Sep 2026 03:00:00 +0000

With VCF 9.1.1 released on September 3, 2026, I continued patching the management services in my lab. This post is a follow-up to my VCF 9.1 management services upgrade walkthrough and covers VCF Identity Broker through VCF Operations.

The VCF 9.1.1 release notes are the source for the release scope, upgrade sequence, dependencies, and known issues. The VCF Operations 9.1.1 release notes list the Identity Broker target build as 25679886.

In VCF 9.1, Identity Broker is a VCF management service hosted by the VCF services runtime. The supported lifecycle workflow is Build -> Lifecycle -> VCF Management -> Upgrade. This walkthrough covers a 9.1.0.x maintenance upgrade. If you are coming from an older VCF or VMware Identity Manager deployment, follow the applicable migration or upgrade procedure first; this is not a replacement for that transition workflow.

Versions in This Upgrade

These are the versions reported by the VCF Operations UI in my lab:

Component	Current Version	Target Version
Identity Broker	9.1.0.0100.25522734	9.1.1.0.25679886

The target build matches the Identity Broker entry in the VCF Operations 9.1.1 release notes.

Before You Begin

For an existing 9.1.0.x environment, upgrade Fleet Lifecycle to 9.1.1.0 before any other VCF component. The release notes also require VCF Services Runtime to be upgraded to 9.1.1 before Identity Broker or Salt RaaS. In my lab Fleet Lifecycle and the runtime were already on 9.1.1 when I ran this operation. I documented the runtime upgrade in Upgrading VCF Services Runtime to 9.1.1 Step by Step.

Before starting:

Verify that the VCF management-services backup configuration is present and reachable under Build -> Lifecycle -> VCF Management -> Backup & Restore. Keep the backup encryption passphrase available for a restore.
Take an on-demand component backup and verify that it completed successfully before patching Identity Broker. The VCF management backup and restore documentation describes the supported workflow.
Check VCF services runtime and hosted-service health before starting, including node CPU, memory, and disk utilization. Identity Broker depends on that runtime for its control plane and storage.
Confirm that lifecycle metadata is current and that the 9.1.1 binaries are available in the configured software depot. For a disconnected environment, prepare the binaries with the VCF Download Tool.
Make sure no other management-component upgrade or patch operation is running. The individual-component procedure says another management-component operation cannot run while a component operation is in progress.
Plan a maintenance window. Identity Broker provides SSO, so expect authentication to be unavailable or interrupted while its services are restarted. Record the SSO login and directory integrations you want to test afterward.

The VCF Operations page can also display a warning that VCF Operations must be patched independently from the other management components. If that warning is present, finish that patch and wait for it to complete before starting Identity Broker.

Selecting Identity Broker

Set the target VCF version to 9.1.1.* if it is not already selected. If the release is not listed, use Sync to refresh the lifecycle metadata and wait for that task to finish before checking again.

Filter the component list for identity and select Identity broker for the VCF instance you want to patch. In my lab the instance was instance-a. Expand Check Required Binaries and resolve any missing binary before continuing.

The upgrade path should read 9.1.0.0100.25522734 -> 9.1.1.0.25679886. The screenshot below shows Fleet Lifecycle on 9.1.1, the 9.1.1 target, and Identity Broker ready for upgrade.

Running the Prechecks

With only Identity Broker selected, click Run Prechecks (1). Open Precheck details and wait for the Identity broker Precheck Workflow to finish.

When the precheck completes, review the Prechecks tab and confirm that the overall result is Passed. In my run, the checks covered package staging, the vCenter connection, the database upgrade, the VCF services platform version, and the single-component backup requirement.

Return to the component list and confirm that Identity Broker is Ready for upgrade. Do not start the upgrade while the precheck is still running. If a check fails, open its details, fix the reported issue, and run the precheck again.

Starting the Upgrade

Click Upgrade on the Identity Broker row. The status changes to Upgrade in progress. Open Upgrade details to follow the workflow.

The workflow runs through these subtasks:

Set Identity Broker upgrade context for the workflow.
Stage the Identity Broker plugin in the VCF services runtime.
Run the Identity Broker prechecks.
Stage the Identity Broker package in the VCF services runtime.
Prepare Identity Broker for upgrade.
Perform the Identity Broker upgrade.
Run the inventory sync after the Identity Broker upgrade.

The task details show the plugin staging and component-stage prechecks while the upgrade is in progress.

The workflow in my lab started at 7:52 PM and completed at 9:18 PM, for a total workflow time of about 1 hour and 26 minutes. That is the task duration shown in my lab, not a promise about service downtime in another environment. Wait for the final inventory sync and confirm that the overall task is Completed.

Verifying the New Version

Go to Build -> Lifecycle -> VCF Management -> Components and open the Identity Broker component for the instance you upgraded.

Under Summary, verify that the status is Running and the version is 9.1.1.0.25679886. In my lab the deployment size was Small, it was managed by the VCF services runtime, and the managed link was VCF SSO.

After the component reports Running, validate the authentication path that matters in your environment:

Sign in to VCF Operations with the configured SSO identity provider.
Test a directory user and a group-based role assignment.
Confirm that the expected groups and permissions are still available.
Test representative VCF component logins and any applications that use the Identity Broker integration.
Check VCF Management -> Tasks for failed or partially completed tasks, and review VCF services runtime and Identity Broker health.

Treat the lifecycle task and the login checks as separate validations. A completed task confirms that the package workflow finished; successful SSO tests confirm that the broker is serving authentication correctly in your environment.

Once the component and authentication path have been validated, keep or expire the backup artifacts according to your retention policy. I also recommend clearing the browser cache before using the updated VCF Operations interface.

Identity Broker in my lab is now on 9.1.1.0.25679886. If this is part of a larger VCF 9.1.1 maintenance run, continue with the remaining components in the order and dependency boundaries documented in the VCF 9.1.1 release notes.