Learn how to prepare for and what to expect before and after the conversion of the
Cloud Classic Console (My Services) to the new Oracle Cloud
Console.
If you received an email with the subject line: Upcoming Quarterly Update and Console
Conversion, your account has been selected for the conversion to the new Oracle Cloud
Console for Fusion Applications environment lifecycle
management.
The new Oracle Cloud
Console provides a single service management platform for
Oracle Cloud Infrastructure and Applications services, providing a "single pane of glass"
visibility across all your Oracle cloud services.
The new Console provides a complete set of self-service capabilities in a new, modern UI. You
can provision environments, install language packs, refresh environments, manage
administrators, initiate data masking, and perform many more tasks without having to engage
Oracle or log Support requests.
Oracle is converting all customer environments to the new Oracle Cloud
Console in phases as part of the standard quarterly update
cycle. When your Fusion Applications environments are scheduled for the Oracle Cloud
Console conversion, you will receive an email with all the
relevant information 30 days in advance of the quarterly update cycle. Also, the Cloud Classic
Console (My Services) will display a banner message with information about the Console
conversion. If you haven't received a notification yet, you will receive one when your
environments are scheduled for the Console conversion.
What Is Happening
During one of your upcoming quarterly updates, your Fusion Applications environment service
management Console will be converted from the Cloud Classic Console (My Services) to the new
Oracle Cloud
Console.
The conversion for each of your environments will occur during its quarterly update downtime
window as mentioned in the announcement email. The announcement email includes the start and
end times of the quarterly update downtime, so please review that email and retain for your
reference.
Console Conversion Cadence
Quarterly updates are applied to your non-production and production environments according
to your selected quarterly maintenance schedule. The Console
conversion occurs during an environment's corresponding quarterly scheduled downtime. As per
the standard practice, quarterly updates are first applied to non-production cadence
environments and then to production cadence environments.
Non-production cadence: Environments on non-production cadence will be converted to
the new Console during the downtime stated in the announcement email. After the downtime
completes, your converted environments are available only in the new Oracle Cloud
Console. Your production cadence environments are still
available in the Cloud Classic Console (My Services). You can switch between the Consoles to
view converted and non-converted environments.
Production Cadence: Environments on the production cadence will be converted to the
new Console during the downtime as stated in the announcement email. After the downtime
completes, you will manage all your environments in the new Oracle Cloud
Console
Sign in to the Oracle Cloud Console to verify your
access.
Sign in to the Console 🔗
Sign in to your Cloud account.
If you do not have credentials to sign in to your Cloud account, contact one of your other Administrators. If there are no Administrators in your organization, file a support request. See also How can I manage Admin users before the conversion?.
Open the navigation menu, under Account Management, point to Users, and then select identity (Primary).
The User Management page displays a message indicating that your
user management has been moved to the new identity and access management experience.
Select the link to open the Users page in the new Console. Prior to the conversion, your Identity Management interface is converted to the new Oracle Cloud console. Verify that your page resembles the screen image below. (Your Domain may be OracleIdentityCloudService.) You can browse through the new Console, though at this time it will not include any of your Fusion Applications services, which will be converted to this new Console after the scheduled quarterly downtime.
Important
If you can't navigate from the Cloud Classic Console (My Services) to
the new Oracle Cloud Console as described in the preceding steps, file a Service Request on
My Oracle Support
(MOS).
If you have policies already set up, ensure that they follow the correct syntax.
Specifically, verify that when the subject of a policy statement includes the identity domain name, the identity domain name and group name are each surrounded in single quotes as follows:
'<identity_domain_name>'/'<group_name>'
For example:
Allow group 'OracleIdentityCloudService'/'FA-Admins' to manage fusion-family in tenancy
If any of your policy statements do not have the single quotes placed as shown above, make the correction and save the policy.
To navigate to the policies page to check your policy statements: Open the navigation menu and select Identity & Security. Under Identity, select Policies.
Inform your Fusion Applications Service Administrators about this upcoming change and share
this information with them.
If your organization works with implementation partners to manage your Fusion Applications,
share this information with them. Ensure to inform them that many environment lifecycle
activities previously handled by Oracle Support (including environment refresh) will be
self-service, and no longer processed by Oracle Support.
If your organization has Oracle Break Glass for Fusion Cloud Service, inform your approvers that after the conversion they will need to log in to the Oracle Cloud Console to approve break glass requests. If the original approvers are no longer with the organization, file a Support Request to have them removed. If you are not sure who your break glass approvers are, file a Support Request to get the list.
The free, one-and-a-half-hour Oracle University course Fusion Applications: Environment Administration will
familiarize you with the new Cloud Console interface and the Fusion Applications environment
provisioning experience.
You will learn:
How to activate your Oracle Cloud Applications subscription.
How to navigate the Cloud Console and the Applications interface, including how to manage
your account, set Console preferences, and troubleshoot common issues.
Key concepts of Fusion Applications environment lifecycle management, including how to
provision, run, and manage your environments.
Note
To take this class, you must have an Oracle University login, which you can get with a free registration. You can register or confirm your login by going to this link https://mylearn.oracle.com/ou/home. Select the Account icon on the top right-hand side and then select Sign in to my account or Sign up for an Oracle Account.
After the Console conversion, the associated Oracle proxy/gateway IPs will change. If you
have set up allow-lists to permit network traffic from Oracle IPs or you have set up a VPN or
FastConnect, you will need to update the values for the Oracle IPs to prepare for the
conversion.
Your Fusion Applications environments are hosted on Oracle Cloud Infrastructure (OCI), so you'll need to update your network
settings to correspond to the IP address ranges for the OCI region where your environment is located. The
data center where your environment is located is the same as the OCI region for your environment.
See IP Address Ranges for information about public IP
address ranges for services that are deployed in Oracle Cloud Infrastructure. Use the IP addresses file to find the CIDR block ranges for your environment's region
(data center). Note the following:
In the file you'll find several types of CIDR IPs. You only need to add the CIDR IPs
with the "OSN" tag.
It is not necessary to poll the published file after you have updated the IP address
values.
This update is required if you have set up your Fusion Applications for egress (for example, transmitting files and reports to external destinations, and external integrations such as Oracle Integration Cloud), and the destination network or server is using IP allow-listing to restrict access from only a trusted source. You must update the settings on the destination server to allow Oracle's proxy/gateway IP to continue receiving these transmissions post conversion. Some of the common application flows that where you might have Oracle IP allow-listing are:
If you are transmitting files to external destinations in any of the above scenarios, you
must also verify the port settings for these transmissions. Ensure that you are using ports
within this list: 21, 22, 70, 80, 210, 280, 443, 488, 591, 631, 777, 993, 1025-65535. If
additional ports are required, open a service request.
BGP dynamic routing - This is the recommended tunnel configuration because the
available routes are learned dynamically through BGP. The Oracle router learns the
routes from your on-premises network, and advertises your VCN's subnets to your on
premises network. If the Fusion Applications IPs change in the future, this tunnel
configuration will not require update.
Static routing - When you set up the IPSec connection to the DRG, you specify the
particular routes to your on-premises network that you want the VCN to know about.
Your network engineer must also configure your CPE device with static routes to the
VCN's subnets. You will likely also need to configure a static route in the
on-premises CPE for your data center OSN CIDR (found in IP Address Ranges) pointing to the proper interface
for VPN Connect. These routes are not learned dynamically.
Policy-based - Use this option for a policy-based CPE device or if you require
multiple encryption domains. When you set up the IPSec connection to the DRG, you
specify the particular routes to your on-premises network that you want the VCN to
know about. You also must configure your CPE device with static routes to the VCN's
subnets. These routes are not learned dynamically. For policy-based routing, you must
update the specified Oracle Cloud CIDR blocks (found in IP Address Ranges).
For information about configuring FastConnect: See the OCI documentation, FastConnect.
Make updates to the following on-premises configurations to the new IP Address Ranges:
Update your security ACLs
Firewall egress rules
Other network egress rules
Test connectivity to Oracle Cloud Infrastructure. To test your updated
settings, test connection to the OCI
Object Storage service endpoint in the same region as your
environment. Object Storage service endpoints are listed
here: Object Storage Service API.
To perform
this connectivity test, for the region you want to test, you must add the CIDR IPs that
include the "OBJECT_STORAGE" tag. IPs are found in IP Address Ranges.
Tip
Need Help?
If you need support with your network configurations,
follow the standard support request process for Fusion Applications help. Provide the
following information in your SR:
If you have embedded the Fusion SSL certificate in external systems that integrate with
Fusion, you might need to import the new root certificate. You can download the new
certificate from the Digicert site. Search for the DigiCert
Global Root G2 certificate in the list. Download and import the certificate.
During the conversion process, subscription updates are not allowed (including orders for
additional ATEs). This restriction will start 4 days prior to your first environment
conversion until the completion of the quarterly update of the last environment. After the
last environment is converted, you can use the self-service process to apply subscription
updates.
IPs Added to Your ACL Prior to Conversion DownTime Will Need To Be Added Again
Post-Conversion 🔗
If you add new IPs to the access control list (ACL) for a Fusion Applications environment
within 1 week of the scheduled downtime for the conversion, you will need to add those
IPs again to the ACL in the converted environment. After conversion, you can add the IPs via
self-service in the new Oracle Cloud Console. See To edit network access control rules for
information on how to manage access control rules post-conversion.
Breakglass Settings Changed Prior to Conversion DownTime Will Need To Be Added Again
Post-Conversion 🔗
If you make any of the following updates to your Breakglass settings within 1 week of
the scheduled downtime for the conversion, you will need make the same updates in the
converted environment:
Do Not Update Compartments or Move Resources During the Conversion 🔗
As part of the conversion process, your Fusion environments are put in a compartment within your Oracle Cloud tenancy. A compartment is a logical grouping of resources to facilitate access control of the resources. (To learn more about compartments, see Understanding Compartments.)
Until the conversion of all your test and production environments is complete:
Do not rename the compartment where your environments are placed.
Do not move your environments to a different compartment.
After the conversion of all your environments is complete, you can rename or move
resources to new compartments as needed.
Post-Conversion Tasks 🔗
After you receive the email notifying you that the scheduled downtime is complete, verify
that you are able to access the new Oracle Cloud Console and
that your environments have been converted. If you have a subscription to Oracle Breakglass
and have configured bring your own key, you need to perform additional post-conversion steps
to reconfigure your keys.
Sign in to the new Console and to your Fusion Applications to
verify your access. Optionally, you can create Console users
for implementation partners.
Sign in to Oracle Cloud. For all commercial regions, sign in at https://cloud.oracle.com. For other regions, find the sign-in URL in the following table:
EU Sovereign Central (Frankfurt)/ Frankfurt, Germany
Enter the Cloud Account Name and select Next.
In the Sign in with an identity domain box, select your primary identity domain. This value can be either OracleIdentityCloudService or Default. Select Next.
Enter your User Name and Password and select Sign In.
After you sign in, you'll see the new Cloud Console with your Fusion Applications environments listed.
Select Go to service to open the Fusion Applications Overview page. Select Environments to see your environments.
After the non-production cadence update, your environments associated with the non-production cadence will be available in the new Console
After the production cadence update, your environments associated with the production cadence will be available in the new Console.
To navigate back to the Cloud Classic Console (My Services), open the navigation menu in the upper left, select My Applications, and then select Cloud Classic Console.
If your organization works with implementation partners to manage your Fusion Applications,
you can create user accounts for them in the new Oracle Cloud
Console and grant them access to perform the self-service
tasks that were previously performed by Oracle Support. For example, environment refreshes can
now be perform via self-service in the Console.
Break glass approvers must be able to log in to the Oracle Cloud Console to approve or reject access requests in Oracle Managed Access. Individuals on the approver's list will
have a user automatically created for them in the Default domain in the Oracle Cloud Console, if the user does not already exist, with the
appropriate permissions to approve or deny break glass requests. These users will be notified
by email with instructions to sign in to activate their account and set up their password. If
SSO is setup for the Default domain, they can use SSO to sign in. Ensure that you notify
these users to respond to their account activation email so that their access is not
interrupted. For more information about managing access requests in the new Console, see Managed Access.
If you recently purchased Oracle Break Glass and the encryption was scheduled to be
applied in this upgrade cycle, it will not be applied. After conversion is complete, you can
follow the instructions in Customer-Managed Keys for Oracle Break Glass to create the
vaults and keys required for your environments. The encryption will be applied in the next
quarterly update. If you need encryption applied before the next scheduled quarterly update,
create the vaults and keys as described in the instructions, and then file a support
request.
If you have subscribed to Oracle Break Glass for your Fusion Applications and have brought
your own key (BYOK), you need to perform these additional steps to import your external key
again.
When your environments are converted, Oracle creates a new key for you in your tenancy. You
can manage your own vaults and keys through the OCI
Vault service.
To add your own key to a Fusion Applications environment post-conversion:
Follow the steps in the preceding section to sign in to the Oracle Cloud Console and locate your environments.
Select the name of the environment where you configured bring your own key.
Under Resources, select Security. The key that has been set up for you is displayed.
Select the key link to go to the details page for the key in the Vault service.
On the key details page, under Resources, select Versions, then select Rotate Key. Select Import External key version and follow the instructions in Importing Keys and Key Versions to upload your wrapped external key.
For more information on managing keys in OCI for
Fusion Applications, see the following documentation:
The Console conversion occurs during the standard quarterly maintenance downtime window.
During the downtime, you will be unable to access your Fusion Applications service instance.
Refer to the announcement email for details of the downtime duration.
All users of the Cloud Classic Console (My Services) will have their access configured to
access the new Cloud Console with the appropriate permissions. Fusion Applications
Administrators may need to add permissions to view usage metrics reports. See Where do I view Usage Metrics Reports in the new Cloud Console?
There is no impact if you are accessing Fusion Applications from any of the latest internet browsers. If the certificate is not already in the browser, the browser will auto-detect the update. You can verify the browser certificate on the Digicert site. Search for DigiCert Global Root G2 in the list and select the link Demo Sites for Root: Active Certificate. If you need assistance, work with your system administrator.
No. There are no changes to either the quarterly update schedules or to any other
maintenance activities performed on these environments post-conversion.
You can perform self-service refreshes between environments (source and target) that are in
the non-production cadence and have been converted to the new Oracle Cloud Console. You
can't perform a refresh that uses an environment mapped to the production cadence (not yet
converted) as a source to refresh an environment (target) that has already been
converted.
Oracle Support will continue to process your logged SRs. Going forward, please leverage the
self-service capabilities available in the new Oracle Cloud Console. You no longer need to
log Support requests to provision environments, update language packs, or refresh
environments. If you have SRs in progress, check on the status of them before performing
self-service activities. If you have a request in progress for one of these operations, you
can cancel it and use the self-service feature instead. Ensure that you cancel the pending
SR to avoid conflicts. See the Fusion Applications Environment
Management documentation for details.
Refresh requests that have been approved will be displayed as scheduled requests in the new Console on the environment details page. To manage the request, go to the environment details page, then under Resources, select Refresh. For more information, see Environment Refresh Management Tasks.
Standalone data masking requests that have been approved can be viewed as follows: On the environment details page, under Resources, select Security, and then select the Data Masking tab. For more information on running self-service data masking, see Data Masking.
All existing environments are part of a Cloud account. The converted environments remain in
the same Cloud account and show up on the Console for this Cloud account.
Customers will be converted to the new Oracle Cloud Console over the course of the next
several months. Customers will automatically be scheduled for conversion based on technical,
operational, and other dependency considerations. As these technical considerations are
enhanced, more customers will be added to the conversion schedule. No action is required on
the part of the customer or the customer accounts teams for conversion. Also, there is no
exception process to expedite the conversion for any one customer.
EU Sovereign Central (Frankfurt)/ Frankfurt, Germany
Enter the Cloud Account Name and select Next.
In the Sign in with an identity domain box, select the primary identity domain. This value can be either OracleIdentityCloudService or Default. Select Next.
Enter your User Name and Password and select Sign In.
To view your subscriptions in the new Console: Open the navigation menu in the upper left corner of the page, select Billing & Cost Management, and then select Subscriptions.
Invoices, notifications, and metrics generated prior to the conversion are not imported to
the new Console. These items will continue to be available
in the Cloud Classic Console (My Services).
To view new invoices after the conversion: Open the navigation menu in the upper left corner of the Console, select Billing & Cost Management, and then select Invoices.
To view new notifications after the conversion: Select the Announcements icon () at the top right of the Console header. If you are not an administrator, you must have the proper permissions to view announcements. For more details on viewing announcements, see Enabling and Viewing Notifications.
To view monthly metrics for production environments after the conversion: On the Applications Home of the Console, select Fusion Applications. On the Overview page, find the environment family for the environment, and then select the environment name. Metrics are displayed for production environments. New metrics are displayed in the new Console only. For more information, see Monthly Performance Metrics.
You must be a member of a group with the appropriate policy permissions to view the
reports. Users assigned to the OCI_Administrators group in the new Oracle Cloud Console have
the appropriate permissions. Fusion Applications Administrators that have been assigned only
to the fusion_console_upgrade_admin_role group may need to have an additional policy added
to grant them the correct permissions.
To grant the members of the fusion_console_upgrade_admin_role group the permissions to
view the usage metrics report, create a policy with the following statements:
Copy
Define tenancy usage-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
Endorse group fusion_console_upgrade_admin_role to read objects in tenancy usage-report
If you have users (such as implementation partners) who will need the ability to refresh
your environments, but need no other access, you can create a user with just this required
capability. See Managing Oracle Cloud Users with Specific Job Functions for general information about creating
users and Environment Read-Only + Refresh User for the details to create this
specific type of role.
After the conversion is complete for the environments on the non-production cadence, you
will be automatically redirected to the new Oracle Cloud Console whenever you sign in.
To access the Cloud Classic Console: Open the navigation menu on the top left corner of your Oracle Cloud Console, select My Applications and then select Cloud Classic Console.
If you don't see the "Fusion Applications" heading on the home page of the new Console, you
may need to perform an additional set up step. Perform this step when the following
conditions are met:
You are signed in through the OracleIdentityCloudService identity domain. To verify, open the Profile menu in the Console. Your identity domain is displayed:
Your home region is different from the region (also called data center region) where
your Fusion Applications environment is located.
To verify your home region: In the
Oracle Cloud Console, open the Regions menu at the top of the
Console page. Your home region is displayed at the top:
To resolve this issue, perform these steps:
Open the Profile menu and select the identity domain name.
In the domain Overview page, select the More actions menu at the top of the page, and choose Manage regions.
On the Manage regions page, select Enable replication for the data center region where your Fusion Applications environment is located.
After the replication is complete, you'll see the region listed in the
Domain replication field for the OracleIdentityCloudService
domain.
Usage reports and other documents generated before the conversion will continue to be
available in the Cloud Classic Console (My Services).
If you have a bookmarked link to the Service page it will continue to work. If you don't
have a bookmarked link, because the service has been moved, you can no longer navigate
directly to the Service page from the Cloud Classic Console home page. To get to the
historical reports and documents, follow the steps below. This will give you access to all
historical data including usage data. You can then bookmark the link for future
reference.
To navigate to these documents after the conversion:
Open the navigation menu on the top left corner of the Oracle Cloud Console, select My Applications and then select Cloud Classic Console to switch to the My Services Console.
Open the navigation menu on the left and select Notifications
to see the list of all notifications.
In the list of notifications, find one for which the Service Affected displayed is the environment for which you want to see historical documents. Select the environment name (the name will begin with "CRM", "ERP", or "HCM").
On the Service page, select the Documents tab to view the list of all historical documents.
To view documents specific to a service instance (such as the User Activity Report), select the For Service Instances subtab.
If a user who needs Admin access does not already have sign in credentials, add them as a user.
Add the users needing Admin access to either the OCI_Administrators group or the Administrators group.
Be aware that this is the highest level of permissions in the tenancy. To grant fewer permissions, after the conversion you can create new policies and groups with just the required permissions. You can then add the users to those groups. For information on setting up policies and groups see Policy Reference for Job Roles.