XOAP

XOAP vs Spacelift: What’s the difference?

Stella — Fri, 20 Feb 2026 14:06:23 +0000

<\/path><\/svg>"},"no_headings_message":"No headings were found on this page.","minimize_box":"yes","minimized_on":"tablet","hierarchical_view":"yes","min_height":{"unit":"px","size":"","sizes":[]},"min_height_tablet":{"unit":"px","size":"","sizes":[]},"min_height_mobile":{"unit":"px","size":"","sizes":[]}}" data-widget_type="table-of-contents.default">

Modern IT environments require automation across multiple layers, from provisioning cloud infrastructure to maintaining operating systems, applications and end user environments over time. XOAP and Spacelift are sometimes compared because both interact with infrastructure, but they operate at different stages of the IT lifecycle. This article examines their architectural focus and operational scope to clarify how each platform fits within enterprise environments.

XOAP: The hybrid IT automation platform

XOAP is designed to manage the full IT lifecycle, covering cloud infrastructure, operating systems, applications and workplace environments. It supports automation for Azure Virtual Desktop (AVD) and Windows environments, including application packaging and deployment.

With the XOAP Connector, it manages both on-premises environments (such as vSphere, Nutanix) and cloud platforms (Azure, AWS, GCP) from a single console, without requiring users to have deep knowledge of Terraform or HCL. The platform emphasizes no-code and low-code to simplify automation workflows for users with varying technical expertise.

Spacelift: Infrastructure as code workflow orchestration

Spacelift is a platform specialized in orchestrating infrastructure as code workflows across tools including Terraform, OpenTofu, Pulumi, CloudFormation, Ansible and Kubernetes manifests. It integrates tightly with Git to enable pull request–driven workflows, allowing users to preview infrastructure changes before deployment.

Spacelift enforces governance through policy-as-code using Open Policy Agent (OPA) and Rego. It does not natively include built-in security scanning, but can integrate with external security tools to support compliance.

Complementary solutions

XOAP and Spacelift are often compared, but they serve very different purposes. Spacelift focuses on safely creating and managing infrastructure using code, while XOAP primarily handles running and maintaining systems after they exist.

That said, XOAP can also provision new resources, for example, building a VM image and creating a VM from it, but it still requires some underlying infrastructure, such as a VMware ESX host or an existing AWS account, to be in place.

For example, XOAP can:

Build VM or cloud provider services
Apply some system-level configurations

Keep in mind that:

XOAP manages the “system” inside the infrastructure (it makes sure the VM or server is set up, applications are installed, patches applied and it keeps it “healthy” over time)
Spacelift manages the “infrastructure itself” (it controls how many servers exist, which networks, storage, clusters and cloud resources are created and enforces rules on all changes at the code level)

Purpose behind both

XOAP is designed to automate the full IT “stack”, not just cloud resources. It covers system configuration, application management, image creation and workplace automation across cloud and on-prem environments. XOAP is meant to handle real systems over time, including Windows servers and Clients, Azure Virtual Desktop and hybrid environments.

Spacelift is a specialized infrastructure as code orchestration platform. It does not manage systems directly. Instead, it runs and controls tools like Terraform, OpenTofu, Pulumi, CloudFormation, Kubernetes and Ansible. Its main goal is to make sure infrastructure changes made through code are safe, approved and compliant.

Day 2 operations

XOAP is built for what happens after a platform, server or desktop already exists. It handles patching, configuration enforcement, application deployment, updates and automatic fixes when something changes or breaks. Spacelift is focused on infrastructure lifecycle through code. It detects drift at the infrastructure level, applies policies using OPA and runs IaC workflows when code changes.

The difference is: XOAP also handles Day 2 operations (maintenance, monitoring and optimization), while Spacelift mostly keeps its IaC focus.

Tools and integrations

XOAP connects to multiple clouds, hypervisors and on-prem environments. It uses PowerShell and CLI-based automation to manage systems directly, regardless of how they were created.

Spacelift integrates deeply with IaC tools and version control systems like GitHub, GitLab and Bitbucket. Everything revolves around pull requests, plans, applies and policies.

Who each platform is for

XOAP is aimed at IT admins, infrastructure teams, MSP’s and hybrid environments that need automation without requiring deep Terraform, Rego or GitOps expertise.

Spacelift is aimed at DevOps and platform engineering teams that already work code-first and want strong governance, visibility and safety around IaC at scale.

Example: creating a Windows server or AVD host

If a company uses Spacelift only, a DevOps engineer writes Terraform. Spacelift runs Terraform Plan, checks policies like encryption and naming and then runs Terraform Apply. Azure creates the VM. From there, Spacelift continues to operate within its IaC governance scope.

Spacelift does not install Windows updates, deploy Office or business apps, configure security baselines, patch the server next month, fix configuration drift or maintain the system long-term. All of that must be handled by other tools or scripts.

With XOAP, once the VM exists (is added or created in XOAP), it hardens Windows, installs applications, keeps them updated, applies patches on a schedule (if set like that with a script), enforces configuration and automatically detects drift. XOAP keeps working “every day“.

Where Spacelift excels

Orchestrates multiple infrastructure as code tools (Terraform, Pulumi, CloudFormation, OpenTofu) and manages complex dependencies across them, a capability XOAP does not natively offer.
Enforces policy-as-code governance using Open Policy Agent (OPA) integrated tightly with Git pull request workflows to control infrastructure changes at the code level.
Detects when deployed infrastructure deviates from the desired state defined in IaC repositories, enabling detection of drift at the infrastructure code level.

Where XOAP excels

Provides end-to-end lifecycle management, including installing applications, patching operating systems, enforcing configurations and continuous drift detection inside managed systems.
Supports hybrid environments spanning cloud, on-premises and endpoint devices, managing actual systems beyond just infrastructure code.
Maintains system health continuously through automated workflows, not solely triggered by code changes.

A lire également :
→ Master the BIOS management
→ 30-day guaranteed IT automation delivery with XOAP
→ From cryptic SIDs to clear names: The end of Entra identity confusion
→ How XOAP modernizes Citrix MCS and PVS
→ How to automate AWS without using Terraform

Explore XOAP

Image présentée par Freepik

Disclaimer:
This article is provided for informational and comparative purposes only. All product names, trademarks and registered trademarks mentioned are the property of their respective owners. The information presented reflects publicly available documentation and general product capabilities at the time of writing.

This comparison does not constitute legal, financial or procurement advice. Readers are encouraged to independently evaluate each platform based on official documentation and vendor guidance. Any references to licensing models reflect publicly announced licensing structures and are not legal interpretations.

The analysis is intended to provide an objective overview of architectural differences and intended use cases, not to assert superiority, deficiency or competitive claims.

The post XOAP vs Spacelift: What’s the difference? appeared first on XOAP.

XOAPChangeBIOSsettingDSC: Master the BIOS management

Perica — Fri, 30 Jan 2026 09:09:46 +0000

Managing BIOS settings across a diverse fleet of devices has historically been a headache for IT administrators. Different vendors, different tools, and varying security requirements often lead to fragmented workflows.

To streamline this process, we are excited to share a new PowerShell DSC (Desired State Configuration) module: XOAPChangeBIOSsettingDSC. This module provides a unified way to manage BIOS configurations on both Dell et Lenovo devices using infrastructure-as-code principles.

Caractéristiques principales

Multi-vendor support: Works seamlessly across Dell and Lenovo hardware.
Security minded: Fully tested to work with or without BIOS passwords.
Granular control: Allows for precise setting definitions (e.g., Secure Boot, Wake-on-LAN, etc.).

Important usage notes

To ensure successful deployment, keep these two technical details in mind:

Case sensitivity: The module is case-sensitive regarding setting names. For example, you must use SecureBoot exactly as defined by the vendor; using secureboot will result in an error.
Discovery: If you are unsure of the exact naming or possible values for a setting, you can refer to the scripts within the TestScript portion of the DSC Resources. These can be used to read all available values directly from the hardware.

Why DSC for BIOS?

By using DSC, you ensure that your hardware configuration remains in the “Desired State”. If a user or an update manually changes a BIOS setting, DSC will automatically detect the drift and pull the setting back to your defined corporate standard.

Installation and usage

There are no special prerequisites for this module.

To install the module in XOAP:

Upload the zipped DSC module to Configuration Management → Modules.
Once uploaded, the module can be referenced and used in your DSC configuration as needed.

Get the XOAPChangeBIOSsettingDSC module

Simplify BIOS management across your devices. Get free access to the module now and replace manual, error-prone processes with a unified approach.

Download the free module

The post XOAPChangeBIOSsettingDSC: Master the BIOS management appeared first on XOAP.

30-day guaranteed IT automation delivery with XOAP

Mario — Wed, 21 Jan 2026 13:47:18 +0000

Don’t waste time in 2026. Whether it’s compliance issues, cloud account hardening, migration to a new OS version or something else entirely – we’ll help you solve it in 30 days or less. With XOAP and our automation experts, you’ll be set up for success from day one.

No long projects. No vague promises. Just a real result, delivered fast. → Book it here

Limited offer

30-day implementation guarantee

Activate an annual XOAP subscription by March 31, 2026 and you’ll receive the Deployment Assurance Package (normally €5,000) for free.

What this means for you:

One main challenge solved in 30 days or less
Hands-on support from our automation experts
Clear scope and agreed outcome upfront
If we don’t deliver the agreed result within 30 days, you can cancel your subscription free of charge and never pay a dime

Full details are available in the Terms & Conditions

What we can solve in 30 days

With XOAP and our automation team working alongside you, we can solve one focused challenge such as:

OS or cloud migrations (Windows 11, AWS, Azure, Google Cloud)
Compliance issues (CIS, STIG, SiSyPHuS, and more)
Cloud account hardening (AWS, Azure, Google Cloud)
Automated image build pipelines (Cloud, vSphere, Nutanix)
Standardized software packaging & deployment (PSADT v3 and v4)

Need something else? No problem. XOAP often delivers results with just a few clicks.

Exemples :
→ Image build done for you
→ Client & system management ready to use

Comment cela fonctionne-t-il ?

1) Activate your XOAP subscription

Book a no obligation onboarding session before March 31, 2026.

Our team will then:

Set up your XOAP account
Help you choose the right pricing plan
Connect your infrastructure

2) Pick the challenge

Choose one challenge you want solved in 30 days or less. Even if your use case isn’t listed above, we may still be able to tackle it quickly. Let us know what you need during onboarding.

3) Sit back and let XOAP do the work

Our team and the XOAP platform take over. If the agreed scope isn’t completed within 30 days, you can cancel your subscription at no cost.

Why we can make this guarantee

Because XOAP is built for speed and reliability:

Proven automation workflows
Platform handling for repeatability and scale
Team that has delivered migrations, compliance projects and cloud hardening across diverse environments

Eligibility requirements

There are technical prerequisites to using XOAP that need to be met before the 30-day implementation can begin. If you don’t meet all the requirements yet, just let us know during onboarding and we’ll help you get there.

Go live in 30 days

Book an onboarding session to claim the limited offer and have your IT challenge solved in less than a month.

No extra cost. No risk. Fully done for you.

Claim limited offer with 30-day guarantee

The post 30-day guaranteed IT automation delivery with XOAP appeared first on XOAP.

From cryptic SIDs to clear names: The end of Entra identity confusion

Stella — Wed, 24 Dec 2025 07:50:05 +0000

One of the longest-standing pain points for administrators managing Entra-joined devices is finally being addressed. Starting with Windows Insider build 27881, Microsoft has introduced a long-awaited improvement: Windows can now automatically translate Entra group and Intune role SIDs (like Device Administrators and Company Administrators) into readable names — directly on the device.

The mysterious S-1-12-1 SIDs

If you’ve ever added an Entra group or Intune role to a local Windows group, you probably noticed that instead of a clear name, you were greeted with a cryptic S-1-12-1-xxxx SID.

While Entra users have been properly resolved for years, Entra groups and built-in roles were simply invisible to the Windows local identity system. Even critical roles like “Device Administrators” would just appear as “Unknown Account,” leaving admins guessing who actually had elevated privileges.

To make sense of those SIDs, admins relied on PowerShell scripts or community tools, since Windows itself couldn’t ask Entra who those identities really were.

What’s new in Windows Insider Build 27881

Microsoft has quietly filled that long-missing gap with a new feature known internally as AADSidToNameV2Support.
This enhancement expands the existing SID-to-name lookup process, which previously handled Entra users, to now include groups and roles as well.

Here´s what that means in practice: when Windows encounters an unfamiliar Entra SID – whether a user, group, or role – it now follows a smarter resolution process.

Check the local cache: Windows first looks for the SID in the local identity cache.

Ask Entra if necessary: If it´s not cached, Windows securely queries Entra to identify who that SID belongs to.

Cache the result: Once resolved, the translated name is stored locally so it appears instantly next time – even offline.

This entire process happens quietly in the background, using secure authentication between the device and Entra. The translation data lives under the registry path:

HKLM\SOFTWARE\Microsoft\IdentityStore\Cache\\IdentityCache
The Entra SID-to-Name Endpoint
Under the hood, Windows reaches out to a new Entra endpoint:
https://login.microsoftonline.com//sidtoname

Windows builds a device-signed JSON Web Token (JWT) proving its identity and includes the unknown SID in the request. Entra responds with the corresponding identity name and display information. If the lookup succeeds, Windows updates its local cache – meaning the SID will appear correctly from that point forward. If the lookup fails, the SID remains as-is until it can be resolved.

Backward compatibility with NT4-style names

Some legacy Windows components still expect the classic DOMAIN\User format. To support these, Windows automatically generates a compatible alias (for example, AzureAD\GroupName) using a background process called GenAndPersistNT4StyleName. This makes sure that Entra identities can be displayed consistently across both modern and legacy Windows interfaces.

Before and after: What you’ll see

With the feature disabled, the local Administrators group might show entries like:

S-1-12-1-1234567890-987654321-…

Once AADSidToNameV2Support is enabled, those same entries appear as:

Device Administrators
Company Administrators
apv2_users

In other words, Entra groups and roles now appear exactly as you expect them to – human-readable, accurate, and instantly recognizable.

Why this change matters

This improvement isn’t just about aesthetics. It’s about clarity, manageability, and security. Easier administration – No more guessing which SID corresponds to which Entra group. Better policy targeting – Intune and security baselines can now correctly identify and apply settings to named Entra groups. Improved troubleshooting – Admins can instantly see which cloud identities have local privileges, reducing confusion and potential misconfigurations.

For now, this enhancement is exclusive to Insider builds and hasn’t yet rolled out to the general release versions of Windows 11 (24H2 or 25H2). But it’s a clear signal that Windows is becoming fully Entra-aware, closing the gap between local and cloud identity management.

The bottom line

After years of seeing unintelligible SIDs in the local Administrators group, Windows finally understands Entra identities natively. With AADSidToNameV2Support, Microsoft is delivering what admins have been asking for all along: a readable and accurate view of who’s who on a device – no scripts or workarounds required.

Windows is finally learning to speak Entra fluently and that’s a big win for every IT admin managing cloud-connected devices.

Windows 11 25H2 migration with XOAP

The post From cryptic SIDs to clear names: The end of Entra identity confusion appeared first on XOAP.

How XOAP modernizes Citrix MCS and PVS

Mario — Mon, 01 Dec 2025 10:05:23 +0000

For years, Citrix administrators have relied on Machine Creation Services (MCS) et Provisioning Services (PVS) to deliver virtual desktops and application servers.

While essential, these tools weren’t built for modern hybrid environments spanning on-prem datacenters, Azure, AWS and edge locations, where rapid updates, consistent configurations and automation are critical.

XOAP fills this gap, automating and standardizing the entire image lifecycle around Citrix deployments. Beyond Citrix, XOAP also streamlines physical device and full endpoint lifecycle management, providing consistent automation, compliance and operational control.

What MCS and PVS do

MCS: Machine Creation Services clone virtual desktops or servers from a master image. They are simple and suitable for small-to-medium deployments.
PVS: Provisioning Services stream a shared virtual disk to multiple machines, offering efficiency, fast deployment and reduced storage.

Le défi

Both MCS and PVS focus solely on provisioning and rely on administrators to manually maintain master images and configurations.

However, most operational effort occurs before and after provisioning and includes:

building images
patching OS
installing/updating apps
maintaining best practices
managing hybrid environments.

MCS and PVS do not automate image creation, application packaging, hybrid deployment, versioning or operational workflows, which leads to complexity, risk and increased cost as organizations scale.

Read also: Device management beyond Autopilot

XOAP: Automation across the image lifecycle

XOAP doesn’t replace Citrix or MCS/PVS; it automates everything around them.

Citrix then delivers the images to users.

This layered approach provides faster deployments, fewer errors, consistent environments et lower operational costs, which is far more scalable and future-proof than relying on MCS/PVS alone.

Caractéristiques principales

1. Automated image creation and versioning

You define a pipeline once. XOAP then automatically builds images, applies best-practice configurations, installs apps, enforces naming conventions, versions outputs and enables rollback.

The result: reproducible, reliable golden images ready for MCS or PVS delivery.

En savoir plus : XOAP Image Management

2. Configuration as Code

Centralized configuration enforcement prevents drift, tracks changes and ensures compliance across all machines. Citrix servers and desktops remain consistent, predictable and aligned with policies.

3. Application deployment and packaging

Applications are packaged once, deployed consistently and updated without rebuilding images, reducing image bloat and speeding patch cycles.

4. Multi-cloud and on-prem infrastructure provisioning

XOAP automates infrastructure creation across vSphere, Nutanix, L'azur, AWS et Google Cloud, bringing consistency across distributed environments.

5. Lifecycle, governance and compliance

XOAP centralizes patching, image rebuilds, monitoring and multi-tenant management, reducing manual work and ensuring policy compliance.

Traditional vs XOAP workflow

Without XOAP:
1. Manually update master image → 2. Install apps → 3. Patch OS → 4. Capture image → 5. Push to MCS/PVS → 6. Troubleshoot → 7. Repeat

With XOAP:
1. Update image pipeline → 2. XOAP automation

Consistent, compliant images are delivered to Citrix MCS or PVS with minimal manual effort.

When to use XOAP

While XOAP can automate almost anything in your IT infrastructure, it will help you the most in the following contexts:

• Large or distributed Citrix environments.
• Hybrid deployments across cloud and on-prem.
• Strict security or compliance requirements.
- Service providers managing multiple tenants.
• Teams aiming to reduce manual work.

Dernières réflexions

MCS and PVS remain critical for Citrix provisioning, but modern hybrid IT demands automation beyond provisioning. XOAP delivers this by automating image creation, application deployment, configuration management, infrastructure provisioning and full endpoint lifecycle management.

For organizations seeking faster, more reliable deployments, operational efficiency and compliance, XOAP is a powerful automation layer that complements Citrix and modernizes IT operations.

Further reading:
→XOAP for MSPs
→On-premises automation with XOAP Connector
→All about XOAP’s Image Management module

Automate your Citrix deployment

The post How XOAP modernizes Citrix MCS and PVS appeared first on XOAP.

All about XOAP Connector

Stella — Fri, 14 Nov 2025 11:09:23 +0000

All events

Automation talks

All about the new XOAP Connector

Ep. 05 with Sinisa Sokolic (CTO at XOAP)

About the episode

L'informatique en nuage et l'informatique hybride - conférences sur l'automatisation, hosted by Mario Istuk, is a new podcast by XOAP, exploring IT infrastructure and automation topics.

Tune in for deep dives with expert guests and short updates on current IT topics.

Watch on YouTube & Apple Podcasts
Listen on Spotify

In this special, product-focused episode of Automation Talks, XOAP’s CTO Sinisa Sokolic presents the new on-premises features made possible by Connector.

This new component extends automation capabilities to on-premises environments like vSphere and Nutanix and enables centralized management of distributed systems.

Have a question, suggestion or comment? Let us know at hello@dev.xoap.io.

Watch now!
Available on YouTube, Apple Podcasts and Spotify.

Meet our host

XOAP

Mario Istuk

Mario Istuk, a co-founder of XOAP, oversees sales, marketing and corporate partnerships. With over 15 years of experience in IT infrastructure and automation, he helps organizations optimize complex hybrid IT environments. Mario hosts XOAP’s Entretiens sur l'automatisation podcast, leads online events and speaks at conferences across Europe.

Événements à venir et passés

BLINK 2025 | How XOAP simplifies hybrid IT automation

November 28, 2025 | Bielefeld, DE | Hosted by blucue

XOAP

XOAP vs Spacelift: What’s the difference?

Table des matières

XOAP: The hybrid IT automation platform

Spacelift: Infrastructure as code workflow orchestration

Complementary solutions

Purpose behind both

Day 2 operations

Tools and integrations

Who each platform is for

Example: creating a Windows server or AVD host

Where Spacelift excels

Where XOAP excels

XOAPChangeBIOSsettingDSC: Master the BIOS management

Caractéristiques principales

Important usage notes

Why DSC for BIOS?

Installation and usage

Get the XOAPChangeBIOSsettingDSC module

Download the free module

30-day guaranteed IT automation delivery with XOAP

Limited offer

30-day implementation guarantee

What we can solve in 30 days

Comment cela fonctionne-t-il ?

1) Activate your XOAP subscription

2) Pick the challenge

3) Sit back and let XOAP do the work

Why we can make this guarantee

Eligibility requirements

Go live in 30 days

From cryptic SIDs to clear names: The end of Entra identity confusion

Table des matières

The mysterious S-1-12-1 SIDs

What’s new in Windows Insider Build 27881

Backward compatibility with NT4-style names

Before and after: What you’ll see

Why this change matters

The bottom line

How XOAP modernizes Citrix MCS and PVS

Table des matières

What MCS and PVS do

Le défi

XOAP: Automation across the image lifecycle

Caractéristiques principales

1. Automated image creation and versioning

2. Configuration as Code

3. Application deployment and packaging

4. Multi-cloud and on-prem infrastructure provisioning

5. Lifecycle, governance and compliance

Traditional vs XOAP workflow

When to use XOAP

Dernières réflexions

All about XOAP Connector

All about the new XOAP Connector

About the episode

Meet our host

Mario Istuk

Événements à venir et passés

The AWS European Sovereign Cloud

The AWS European Sovereign Cloud

About the episode

Meet our host

Mario Istuk

Événements à venir et passés

The AWS European Sovereign Cloud: Insights from our podcast ep. 06

Table des matières

What sovereignty really means

AWS European Sovereign Cloud: A separate cloud for Europe

Built with European regulators

Who needs this?

Why not use local EU cloud providers?

Adoption path & timing

Watch now

BLINK 2025 | How XOAP simplifies hybrid IT automation

BLINK 2025 How XOAP simplifies hybrid IT automation

About the event

Meet the speaker

Mario Istuk

Événements à venir et passés

BLINK 2025
How XOAP simplifies hybrid IT automation