Conversion Overview
Learn how to prepare for and what to expect before and after the conversion of the Cloud Classic Console (My Services) to the new Oracle Cloud Console.
If you received an email with the subject line: Upcoming Quarterly Update and Console Conversion, your account has been selected for the conversion to the new Oracle Cloud Console for Fusion Applications environment lifecycle management.
The new Oracle Cloud Console provides a single service management platform for Oracle Cloud Infrastructure and Applications services, providing a "single pane of glass" visibility across all your Oracle cloud services.
The new Console provides a complete set of self-service capabilities in a new, modern UI. You can provision environments, install language packs, refresh environments, manage administrators, initiate data masking, and perform many more tasks without having to engage Oracle or log Support requests.
Oracle is converting all customer environments to the new Oracle Cloud Console in phases as part of the standard quarterly update cycle. When your Fusion Applications environments are scheduled for the Oracle Cloud Console conversion, you will receive an email with all the relevant information 30 days in advance of the quarterly update cycle. Also, the Cloud Classic Console (My Services) will display a banner message with information about the Console conversion. If you haven't received a notification yet, you will receive one when your environments are scheduled for the Console conversion.
What Is Happening
During one of your upcoming quarterly updates, your Fusion Applications environment service management Console will be converted from the Cloud Classic Console (My Services) to the new Oracle Cloud Console.
The conversion for each of your environments will occur during its quarterly update downtime window as mentioned in the announcement email. The announcement email includes the start and end times of the quarterly update downtime, so please review that email and retain for your reference.
Console Conversion Cadence
Quarterly updates are applied to your non-production and production environments according to your selected quarterly maintenance schedule. The Console conversion occurs during an environment's corresponding quarterly scheduled downtime. As per the standard practice, quarterly updates are first applied to non-production cadence environments and then to production cadence environments.
Non-production cadence: Environments on non-production cadence will be converted to the new Console during the downtime stated in the announcement email. After the downtime completes, your converted environments are available only in the new Oracle Cloud Console. Your production cadence environments are still available in the Cloud Classic Console (My Services). You can switch between the Consoles to view converted and non-converted environments.
Production Cadence: Environments on the production cadence will be converted to the new Console during the downtime as stated in the announcement email. After the downtime completes, you will manage all your environments in the new Oracle Cloud Console
Pre-Conversion Tasks
You can also view a list of these tasks in a printable checklist.
Sign in to the Oracle Cloud Console to verify your access.
Sign in to the Console
- Sign in to your Cloud account.
If you do not have credentials to sign in to your Cloud account, contact one of your other Administrators. If there are no Administrators in your organization, file a support request. See also How can I manage Admin users before the conversion?.
-
Open the navigation menu, under Account Management, point to Users, and then click identity (Primary).
-
The User Management page displays a message indicating that your user management has been moved to the new identity and access management experience.
- Click the link to open the Users page in the new Console. Prior to the conversion, your Identity Management interface is converted to the new Oracle Cloud console. Verify that your page resembles the screen image below. (Your Domain may be OracleIdentityCloudService.) You can browse through the new Console, though at this time it will not include any of your Fusion Applications services, which will be converted to this new Console after the scheduled quarterly downtime.
If you can't navigate from the Cloud Classic Console (My Services) to the new Oracle Cloud Console as described in the preceding steps, file a Service Request on My Oracle Support (MOS).
If you have policies already set up, ensure that they follow the correct syntax.
'<identity_domain_name>'/'<group_name>'For example:
Allow group 'OracleIdentityCloudService'/'FA-Admins' to manage fusion-family in tenancyIf any of your policy statements do not have the single quotes placed as shown above, make the correction and save the policy.
To navigate to the policies page to check your policy statements: Open the navigation menu and click Identity & Security. Under Identity, click Policies.
Inform your Fusion Applications Service Administrators about this upcoming change and share this information with them.
If your organization works with implementation partners to manage your Fusion Applications, share this information with them. Ensure to inform them that many environment lifecycle activities previously handled by Oracle Support (including environment refresh) will be self-service, and no longer processed by Oracle Support.
The free, one-and-a-half-hour Oracle University course Fusion Applications: Environment Administration will familiarize you with the new Cloud Console interface and the Fusion Applications environment provisioning experience.
You will learn:
- How to activate your Oracle Cloud Applications subscription.
- How to navigate the Cloud Console and the Applications interface, including how to manage your account, set Console preferences, and troubleshoot common issues.
- Key concepts of Fusion Applications environment lifecycle management, including how to provision, run, and manage your environments.
To take this class, you must have an Oracle University login, which you can get with a free registration. You can register or confirm your login by going to this link https://mylearn.oracle.com/ou/home. Click the Account icon on the top right-hand side and then click Sign in to my account or Sign up for an Oracle Account.
Familiarize yourself with the documentation for managing your Fusion Applications environments in the new Oracle Cloud Console:
After the Console conversion, the associated Oracle proxy/gateway IPs will change. If you have set up allow-lists to permit network traffic from Oracle IPs or you have set up a VPN or FastConnect, you will need to update the values for the Oracle IPs to prepare for the conversion.
Your Fusion Applications environments are hosted on Oracle Cloud Infrastructure (OCI), so you'll need to update your network settings to correspond to the IP address ranges for the OCI region where your environment is located. The data center where your environment is located is the same as the OCI region for your environment.
For help finding these, see:
-
How do I find the data center for an environment before conversion (in the Cloud Classic Console)? and How do I find the region for an environment after conversion?
To find the new, required IP address values:
-
See IP Address Ranges for information about public IP address ranges for services that are deployed in Oracle Cloud Infrastructure. Use the IP addresses file to find the CIDR block ranges for your environment's region (data center). Note the following:
- In the file you'll find several types of CIDR IPs. You only need to add the CIDR IPs with the "OSN" tag.
- It is not necessary to poll the published file after you have updated the IP address values.
This update is required if you have set up your Fusion Applications for egress (for example, transmitting files and reports to external destinations, and external integrations such as Oracle Integration Cloud), and the destination network or server is using IP allow-listing to restrict access from only a trusted source. You must update the settings on the destination server to allow Oracle's proxy/gateway IP to continue receiving these transmissions post conversion. Some of the common application flows that where you might have Oracle IP allow-listing are:
- Oracle Fusion Payments Payment and Positive Pay file delivery (SFTP / HTTPS)
- Oracle Cash Management bank statement download (SFTP / HTTPS)
- Oracle Fusion Expenses corporate card transactions file upload (SFTP / HTTPS)
- Oracle Fusion Payments check printing (HTTPS)
- ERP Integration callback service (HTTPS)
- BI Publisher printer delivery option (HTTPS)
- BI Publisher report delivery option (SFTP)
- HCM Extracts delivery (SFTP)
If you are transmitting files to external destinations in any of the above scenarios, you must also verify the port settings for these transmissions. Ensure that you are using ports within this list: 21, 22, 70, 80, 210, 280, 443, 488, 591, 631, 777, 993, 1025-65535. If additional ports are required, open a service request.
-
For updates to your private VPN: Updates to the IPSec VPN tunnel configuration may be required depending on routing type. Consult the OCI documentation, Site-to-Site VPN Overview and Securely Accessing Fusion Applications for set up instructions.
The routing types are:
- BGP dynamic routing - This is the recommended tunnel configuration because the available routes are learned dynamically through BGP. The Oracle router learns the routes from your on-premises network, and advertises your VCN's subnets to your on premises network. If the Fusion Applications IPs change in the future, this tunnel configuration will not require update.
- Static routing - When you set up the IPSec connection to the DRG, you specify the particular routes to your on-premises network that you want the VCN to know about. Your network engineer must also configure your CPE device with static routes to the VCN's subnets. You will likely also need to configure a static route in the on-premises CPE for your data center OSN CIDR (found in IP Address Ranges) pointing to the proper interface for VPN Connect. These routes are not learned dynamically.
- Policy-based - Use this option for a policy-based CPE device or if you require multiple encryption domains. When you set up the IPSec connection to the DRG, you specify the particular routes to your on-premises network that you want the VCN to know about. You also must configure your CPE device with static routes to the VCN's subnets. These routes are not learned dynamically. For policy-based routing, you must update the specified Oracle Cloud CIDR blocks (found in IP Address Ranges).
-
For information about configuring FastConnect: See the OCI documentation, FastConnect.
-
Make updates to the following on-premises configurations to the new IP Address Ranges:
- Update your security ACLs
- Firewall egress rules
- Other network egress rules
- Test connectivity to Oracle Cloud Infrastructure. To test your updated
settings, test connection to the OCI
Object Storage service endpoint in the same region as your
environment. Object Storage service endpoints are listed
here: Object Storage Service API.
To perform this connectivity test, for the region you want to test, you must add the CIDR IPs that include the "OBJECT_STORAGE" tag. IPs are found in IP Address Ranges.
Need Help?
- Issue = FAaaS conversion related VPN full FA VPN
- Provide the OCIDs for your:
- Tenancy
- IPSec/VPN
- VCN
For help finding these, see Locating Oracle Cloud Infrastructure IDs.
If you have embedded the Fusion SSL certificate in external systems that integrate with Fusion, you might need to import the new root certificate. You can download the new certificate from the Digicert site. Search for the DigiCert Global Root G2 certificate in the list. Download and import the certificate.
Do Not Add or Update Your SaaS Subscriptions
During the conversion process, subscription updates are not allowed (including orders for additional ATEs). This restriction will start 4 days prior to your first environment conversion until the completion of the quarterly update of the last environment. After the last environment is converted, you can use the self-service process to apply subscription updates.
IPs Added to Your ACL Prior to Conversion DownTime Will Need To Be Added Again Post-Conversion
If you add new IPs to the access control list (ACL) for a Fusion Applications environment within 1 week of the scheduled downtime for the conversion, you will need to add those IPs again to the ACL in the converted environment. After conversion, you can add the IPs via self-service in the new Oracle Cloud Console. See To edit network access control rules for information on how to manage access control rules post-conversion.
Breakglass Settings Changed Prior to Conversion DownTime Will Need To Be Added Again Post-Conversion
If you make any of the following updates to your Breakglass settings within 1 week of the scheduled downtime for the conversion, you will need make the same updates in the converted environment:
- Added or removed approvers
- Support access duration
To manage these settings via self-service in the new Oracle Cloud Console, see Updating Break Glass Settings.
Do Not Update Compartments or Move Resources During the Conversion
As part of the conversion process, your Fusion environments are put in a compartment within your Oracle Cloud tenancy. A compartment is a logical grouping of resources to facilitate access control of the resources. (To learn more about compartments, see Understanding Compartments.)
Until the conversion of all your test and production environments is complete:
- Do not rename the compartment where your environments are placed.
- Do not move your environments to a different compartment.
Post-Conversion Tasks
After you receive the email notifying you that the scheduled downtime is complete, verify that you are able to access the new Oracle Cloud Console and that your environments have been converted. If you have a subscription to Oracle Breakglass and have configured bring your own key, you need to perform additional post-conversion steps to reconfigure your keys.
Sign in to the new Console and to your Fusion Applications to verify your access. Optionally, you can create Console users for implementation partners.
If you are a U.S. Government customer, see Reset Password and Sign in to the new Cloud Console for specific sign in steps.
- Sign in to Oracle Cloud: Go to https://cloud.oracle.com.
- Enter the Cloud Account Name and click Next.
- In the Sign in with an identity domain box, select your primary identity domain. This value can be either OracleIdentityCloudService or Default. Click Next.
- Enter your User Name and Password and click Sign In.
- After you sign in, you'll see the new Cloud Console with
your Fusion Applications environments listed.
If you do not see Fusion Applications listed as shown above, see Why can't I see Fusion Applications in the home page of the new Console?
- Click Fusion Applications to open the Fusion Applications Overview page. Click Environments to see your environments.
After the non-production cadence update, your environments associated with the non-production cadence will be available in the new Console
After the production cadence update, your environments associated with the production cadence will be available in the new Console.
-
To navigate back to the Cloud Classic Console (My Services), open the navigation menu in the upper left, click My Applications, and then click Cloud Classic Console.
Sign in to your Fusion Applications using the URL and steps you normally use.
If your organization works with implementation partners to manage your Fusion Applications, you can create user accounts for them in the new Oracle Cloud Console and grant them access to perform the self-service tasks that were previously performed by Oracle Support. For example, environment refreshes can now be perform via self-service in the Console.
To create a user with the ability to perform refreshes, and no other access, see Managing Oracle Cloud Users with Specific Job Functions for general information about creating users and Environment Read-Only + Refresh User for the details to create this specific type of role.
Break glass approvers must be able to log in to the Oracle Cloud Console to approve or reject access requests in Oracle Managed Access. Individuals on the approver's list will have a user automatically created for them in the Default domain in the Oracle Cloud Console, if the user does not already exist, with the appropriate permissions to approve or deny break glass requests. These users will be notified by email with instructions to sign in to activate their account and set up their password. If SSO is setup for the Default domain, they can use SSO to sign in. Ensure that you notify these users to respond to their account activation email so that their access is not interrupted. For more information about managing access requests in the new Console, see Managed Access.
If you recently purchased Oracle Break Glass and the encryption was scheduled to be applied in this upgrade cycle, it will not be applied. After conversion is complete, you can follow the instructions in Customer-Managed Keys for Oracle Break Glass to create the vaults and keys required for your environments. The encryption will be applied in the next quarterly update. If you need encryption applied before the next scheduled quarterly update, create the vaults and keys as described in the instructions, and then file a support request.
If you have subscribed to Oracle Break Glass for your Fusion Applications and have brought your own key (BYOK), you need to perform these additional steps to import your external key again.
When your environments are converted, Oracle creates a new key for you in your tenancy. You can manage your own vaults and keys through the OCI Vault service.
To add your own key to a Fusion Applications environment post-conversion:
- Follow the steps in the preceding section to sign in to the Oracle Cloud Console and locate your environments.
- Click the name of the environment where you configured bring your own key.
- Under Resources, click Security. The key that has been set up for you is displayed.
- Click the key link to go to the details page for the key in the Vault service.
- On the key details page, under Resources, click Versions, then click Rotate Key. Select Import External key version and follow the instructions in Importing Keys and Key Versions to upload your wrapped external key.
For more information on managing keys in OCI for Fusion Applications, see the following documentation:
- Rotating Keys for Fusion Applications environments.
- Importing Keys and Key Versions.
- To use the API to manage keys, see CreateKeyVersion.
- To use the CLI to manage keys, see Generate new key version.
How to Get Help
To get help:
- Open a support request (SR) through the Console or by visiting My Oracle Support (MOS).
- Contact your Customer Success Manager (CSM), Account Manager, or Oracle point of contact, if you have one assigned for your account.
FAQs
Get answers to common questions about the conversion to the new experience.
What to expect
The Console conversion occurs during the standard quarterly maintenance downtime window. During the downtime, you will be unable to access your Fusion Applications service instance. Refer to the announcement email for details of the downtime duration.
No. There is no change to the applications URL.
All users of the Cloud Classic Console (My Services) will have their access configured to access the new Cloud Console with the appropriate permissions. Fusion Applications Administrators may need to add permissions to view usage metrics reports. See Where do I view Usage Metrics Reports in the new Cloud Console?
No. Users of your Fusion Applications will not be impacted by this conversion.
-
On the Oracle Cloud Classic (My Services) home page, click the panel for your Fusion Applications environment.
-
The Data Center is listed on the Service Environments details page, as shown in the following image:
There is no impact if you are accessing Fusion Applications from any of the latest internet browsers. If the certificate is not already in the browser, the browser will auto-detect the update. You can verify the browser certificate on the Digicert site. Search for DigiCert Global Root G2 in the list and click the link Demo Sites for Root: Active Certificate. If you need assistance, work with your system administrator.
No. There are no changes to either the quarterly update schedules or to any other maintenance activities performed on these environments post-conversion.
Yes. See Subscribing to Announcements for details on how to view them.
You can perform self-service refreshes between environments (source and target) that are in the non-production cadence and have been converted to the new Oracle Cloud Console. You can't perform a refresh that uses an environment mapped to the production cadence (not yet converted) as a source to refresh an environment (target) that has already been converted.
Oracle Support will continue to process your logged SRs. Going forward, please leverage the self-service capabilities available in the new Oracle Cloud Console. You no longer need to log Support requests to provision environments, update language packs, or refresh environments. If you have SRs in progress, check on the status of them before performing self-service activities. If you have a request in progress for one of these operations, you can cancel it and use the self-service feature instead. Ensure that you cancel the pending SR to avoid conflicts. See the Fusion Applications Environment Management documentation for details.
Refresh requests that have been approved will be displayed as scheduled requests in the new Console on the environment details page. To manage the request, go to the environment details page, then under Resources, click Refresh. For more information, see Environment Refresh Management Tasks.
Standalone data masking requests that have been approved can be viewed as follows: On the environment details page, under Resources, click Security, and then click the Data Masking tab. For more information on running self-service data masking, see Data Masking.
All existing environments are part of a Cloud account. The converted environments remain in the same Cloud account and show up on the Console for this Cloud account.
Customers will be converted to the new Oracle Cloud Console over the course of the next several months. Customers will automatically be scheduled for conversion based on technical, operational, and other dependency considerations. As these technical considerations are enhanced, more customers will be added to the conversion schedule. No action is required on the part of the customer or the customer accounts teams for conversion. Also, there is no exception process to expedite the conversion for any one customer.
Navigating the new Console
Open the navigation menu on the top left corner of the Oracle Cloud Console, click My Applications and then click Cloud Classic Console to switch.
To find the region where a Fusion Applications environment is located in the new Oracle Cloud Console:
- Sign in to the new Oracle Cloud Console.
-
On the home page, under My Applications, expand the Fusion Applications list to display details about the environments, including region.
To view your subscriptions in the new Console: Open the navigation menu in the upper left corner of the page, click Billing & Cost Management, and then click Subscriptions.
Invoices, notifications, and metrics generated prior to the conversion are not imported to the new Console. These items will continue to be available in the Cloud Classic Console (My Services).
-
To view new invoices after the conversion: Open the navigation menu in the upper left corner of the Console, click Billing & Cost Management, and then click Invoices.
-
To view new notifications after the conversion: Click the Announcements icon (
) at the top right of the Console header. If you
are not an administrator, you must have the proper permissions to view announcements.
For more details on viewing announcements, see Enabling and Viewing Maintenance Notifications. -
To view monthly metrics for production environments after the conversion: On the Applications tab of the Console, click Fusion Applications. On the Overview page, find the environment family for the environment, and then click the environment name. Metrics are displayed for production environments. New metrics are displayed in the new Console only. For more information, see Monthly Performance Metrics.
The User Activity Report is not yet available in the new Cloud Console.
To view compliance documentation in the new Cloud Console:
- Open the navigation menu, click Identity & Security, and then click Compliance.
- From the Service filter, select SaaS. The secondary filter lets you view only Fusion CRM, Fusion HCM, or Fusion ERP documents.
For more information about viewing compliance documentation, see Overview of Compliance Documents.
To change your time zone, see Setting the Console Time Zone for Fusion Applications.
Troubleshooting
After the conversion is complete for the environments on the non-production cadence, you will be automatically redirected to the new Oracle Cloud Console whenever you sign in.
To access the Cloud Classic Console: Open the navigation menu on the top left corner of your Oracle Cloud Console, click My Applications and then click Cloud Classic Console.
If you don't see the "Fusion Applications" heading on the home page of the new Console, you may need to perform an additional set up step. Perform this step when the following conditions are met:
- You are signed in through the OracleIdentityCloudService identity domain. To verify,
open the Profile menu
in the Console. Your identity
domain is displayed:
- Your home region is different from the region (also called data center region) where
your Fusion Applications environment is located.
To verify your home region: In the Oracle Cloud Console, open the Regions menu at the top of the Console page. Your home region is displayed at the top:
- Open the Profile menu and click the identity domain
name.
- In the domain Overview page, click the More
actions menu at the top of the page, and choose Manage
regions.
- On the Manage regions page, click Enable replication for the data center region where your Fusion Applications environment is located.
- After the replication is complete, you'll see the region listed in the
Domain replication field for the OracleIdentityCloudService
domain.
Usage reports and other documents generated before the conversion will continue to be available in the Cloud Classic Console (My Services).
If you have a bookmarked link to the Service page it will continue to work. If you don't have a bookmarked link, because the service has been moved, you can no longer navigate directly to the Service page from the Cloud Classic Console home page. To get to the historical reports and documents, follow the steps below. This will give you access to all historical data including usage data. You can then bookmark the link for future reference.
- Open the navigation menu on the top left corner of the Oracle Cloud Console, click My Applications and then click Cloud Classic Console to switch to the My Services Console.
- Open the navigation menu on the left and select Notifications to see the list of all notifications.
- In the list of notifications, find one for which the Service Affected displayed
is the environment for which you want to see historical documents. Click the environment
name (the name will begin with "CRM", "ERP", or "HCM").
- On the Service page, click the Documents tab to view the list of all historical documents.
- To view documents specific to a service instance (such as the User Activity Report),
click the For Service Instances subtab.
If a user who needs Admin access does not already have sign in credentials, add them as a user.
Add the users needing Admin access to either the OCI_Administrators group or the Administrators group.
Be aware that this is the highest level of permissions in the tenancy. To grant fewer permissions, after the conversion you can create new policies and groups with just the required permissions. You can then add the users to those groups. For information on setting up policies and groups see Policy Reference for Job Roles.