image.png

For Entra SSO, this setting regarding AzureADSSOEnabled being globally applied to all stores; This is a global setting that will be applied to all the stores in your Citrix Cloud tenant. At this time, it is not possible to enable or disable this setting on specific stores based on the store URL provided in the command. Does this impact other delivery groups? If we use FAS now and want to POC this AzureADSSO, can we have some DG using Azure and others using FAS? Does AzureADSSOEnabled at the Store level affect other delivery groups?

FAS is enabled at the Store level as well. If you want to run both for different delivery groups (essentially different user personas), you would need dedicated stores for each authentication method. What you make available behind that store can be configured with Keywords and Storefront settings, where you can hide desktops or published apps by including or excluding keywords. (there are probably other methods as well)

right but for Storefront Cloud it says it is all stores, not store specific, that you can enable/disable and wanted to know if we break FAS DGs versus our testing AzureADSSO DG

yeah so, no.... you can't.

one practical mitigation you might be able to leverage would be to Rely on the client/VDA prerequisites as a de facto filter. The Entra SSO path only actually engages when the full chain is satisfied — required Workspace app version, required VDA version and Windows build on the session hosts, Entra hybrid/native join state, RDS AAD auth protocol enabled. Sessions to VDAs that don't meet the requirements fall back to standard authentication. That's workable, but you're relying on fallback behavior rather than a hard scope, and the "delayed or failed launches" warning applies exactly to environments where the config is partially complete — so validate the fallback with your actual mixed workloads before broad enablement.

the only downside I see here is that it may not fail back to FAS since it's also not standard authentication.

I'm not sure if you are working with a partner or have one related to your licensing, but the only other option would be to do a POC citrix cloud tenant, but Citrix doesn't give them out like candy anymore, and the only other option I could think of would be to leverage a CSP partner to grant you a csp customer tenant, but that has some other limitations.

In DAAS monitor Under Trends > Logon and reconnect (This is new) does the values match up for anyone else ? i got users who are listed as having a session reconnect but when you check the Trends > Session view it doesn't show any Session auto reconnect values for the same user and when you analyse the session with Adrian AI it also doesn't report any session reconnect

In autoscale in DaaS - are the times in UTC?

This message was deleted.

hey gang. for your non-persistent mcs machines that are AZ hybrid joined, are you setting this reg key on the master? docs.citrix.com/en-us/…/identity-pool-haad-joined-machine…#… "*DeviceKeyPairRestored" =1 ?* these are win11 multisession

Has anyone run into an issue with Citrix Host-to-Client/URL File Type Association (FTA) redirection on Windows Server 2025? We have the Citrix FTA configuration in place (ServerFTAHTML) and have also tried Default Associations XML via GPO and DISM import. Initially, the associations are correct, but they keep getting reverted to: http = MSEdgeHTM https = MSEdgeHTM ProcMon shows the registry write coming from svchost.exe (ProfSvc - User Profile Service): HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice With the value being set to: MSEdgeHTM We are not using FSLogix. Users are using a mandatory profile stored locally on C:. Curious if anyone has seen ProfSvc overwrite the UserChoice key during logon and cause Citrix FTA/Host-to-Client redirection to stop working. If so, what was the root cause and fix?

Greetings everyone. I have been doing some research past days around FSLogix. I know that this is a very famous topic and I have mentioned something similar before but the customer doesn't care if FSLogix is ment to take a lot of space, they see costs and want to optimize if possible, as much as possible. They are at around 30TB with around 6000 profiles and I see apps like teams, taking up around 3GB just from launching teams. Edge is taking up 500MB-1GB as well, per profile. Now imo, this is quite normal but for the customer an average 10GB per profile is not acceptable, they want to take it down even more, preferably to 5GB or less. I found this from microsoft which is latest and greatest but this is not the teams folder that takes up the most space. So I am simply not going to save 2GB space per user on this configuration. How does your FSLogix XML look today(the ones that are up2date) ? I feel like its either go ham and start excluding big parts of teams (which will have a direct user experience hit) or give them a different solution which will be very messy. They do have a disc compact script running every night which frees up around 1TB for the next morning and then during the day they end up at around 200GB, rinse and repeat. There is also a lot of white space or empty space that is taking up space which the disc compact hopefully frees up. A profile can be around 10GB but actual size might be around 3-6GB when checking through treesize. I also see a lot of logs like "There is a mismatch in the identifiers of the parent virtual hard disk and differencing disk." in the FSLogix logs. So not sure what they have been doing here learn.microsoft.com/en-us/fslogix/tutorial-redirections-xml

Hi Everyone, Is anyone else running into issues with the WEM agent getting bound to multiple configuration sets in Citrix DaaS? It looks like a recent update forces a new default setting during catalog setup. In our environment, we map one Machine Catalog to multiple Delivery Groups. When building a new catalog now, the "Experience Optimization" section defaults to "Apply default settings". This auto-binds the VDAs to WEM's "Unbound Agents" config set. The issue is that we already assign specific config sets by linking our Active Directory OUs inside WEM. Because of this new feature, our recent agents are getting choked up by binding to two configuration sets at once. We only see this on catalogs built over the last few weeks—older catalogs have that optimization field completely blank and work perfectly. Has anyone seen this and found a workaround to prevent this auto-assignment? Changing it to "Apply Custom Settings" will not solve it for us. Because a single catalog supplies VDAs to different delivery groups, we can't just pick one blanket WEM config set for the whole catalog.

Good morning / afternoon. I am looking for a modern configuration of profile management which is a combination of containers and file based. I have heard this being mentioned but I can't find a configuration out there that I can test. Something that you would configure today and that takes bloating to consideration. I am trying to configure something that is very minimal. Its not a very large customer, medium. I already have good and stable FSLogix configuration ideas but thats not a combination of file and VHDX.

Has anyone been testing Non-persistent Hybrid Entra ID joined with Intune Enrollment? It looks like it has been in preview for over a year docs.citrix.com/en-us/…/haad-intune-enrolled.html

Anyone hosting cloud connectors in Azure? What machine type are you guys using? Citrix advisor says it wants 4 cores per socket.

anyone use SSL certs on Cloud connectors/DDC's with a key size of 4096 ? currently use 2048 but our CA guy wants me to use a key size of 4096. I cant find any official doc with guidance/recommendations relating to the key size of the certs issued to Delivery controllers/Cloud connectors. Obviously the bigger the key size the bigger performance impact which is my concern

Two questions regarding Entra SSO in Citrix DaaS: 1. Based on the new CTX article, it looks like FAS and Entra ID SSO can coexist, and only the Delivery Group "Logon Type" determines whether FAS or Entra ID SSO is used. If that's the case, is there any reason to disable FAS on the Resource Location itself? I already removed the FAS GPO from the VDA OU, but I'm not sure if that was actually required. 2. Does Entra ID SSO require the endpoint device to be Entra joined or Hybrid Entra joined, even when using the Citrix Web Extension? (Thinking about BYOD)

Has anyone seen an issue where FileZilla in a Citrix session can’t detect mapped network drives from the local machine? Any workaround?

Anyone having an issue in DaaS monitor where individual capacity management resource use (desktop or app) cannot be zoom in on? If I click on a resource and try to adjust time the apply button is greyed out. Also some resources dont show user names.

Anyone having gateway protocol issues the last couple of days with daas / gateway?

anyone able to confirm that shadowing works on 2607 and isnt affected by this? Citrix Director - unable to shadow session (remote assist) after OS patching in January I assume its fine as it was fixed in 2603 just wanted to double check

Has anyone tested Numecents Cloudpaging application containers yet? I'm curious how this works in a fully on-prem environment (not DaaS).

Hi, since yesterday, we've been having an issue with EntraSSO in Citrix DaaS where users can't connect. Workers are joined to EntraID Hybrid and registered. A reboot fixes it temporarily

Hi everyone, Are you aware that Citrix may have changed the administrator permissions structure in the Citrix DaaS? Here’s the background: I wanted to create a new machine catalog, but a warning triangle appears next to all “Hosting Units” with the message: “You do not have permission to access the zone for this resource; the catalog will be placed in the default zone.” When I click through the steps to create the machine catalog and the process begins, the following error message appears immediately: _Action Name: MC_CreateMachineCatalogInitialization_ Exception: StudioErrorId : NoZoneAvailable Error Source : CitrixBrokerService Sdk Error Message : No available zones Sdk Error ID : Citrix.XDPowerShell.Broker.NoZoneAvailable,Citrix.Broker.Admin.SDK.NewBrokerCatalogCommand ErrorCategory : NotSpecified Do you know more about this? My permissions in DaaS haven't changed. But I'm anything but a “cloud administrator.”

Hi everyone, We got a weird problem that started yesterday. This is a DaaS service with on-premise resources, using EntraID and FAS for authentication. There are conditional access policies in place in EntraID as well. Yesterday, some users lost their applications in Citrix Workspace, both via browser and in the Citrix Workspace App. No apps are visible, and their names are replaced with the EntraID OID for their user account. The number of users that are affected by this seems to increase over time. We can find no faults, errors or other symptoms on the on-premise servers. The cloud connectors and FAS servers seem to work fine, and there are users that can login fine. There does not seem to be anything different between the users that are able to log in and those that can't. We have an alternate URL to a Store in Citrix Cloud that was set up previously. This uses a different Entra ID tenant, but is related to the same Active Directory domain. If we use that URL and log in with the same users, the applications show up as expected. Unfortunately, SSO does not currently work here, so we are hesitant to tell the users to use that as a workaround. We have opened a case with Citrix, but so far we have not had much progress there. Anyone that has seen the same issue?

Running FAS for Entra ID sign-in today? With CVAD 2607 LTSR you can drop it on-prem: NetScaler OIDC, StoreFront and hybrid joined VDAs give real SSO into the session, with no FAS servers, CA or logon certificates. I've written up a production rollout, including the NetScaler config and the two issues that bit us. poppelgaard.com/bye-bye-fas-achieving-pure-citrix-sso-with-netscaler-and-entra-id

We are unable to perform an MCS image update because the master VM has been moved to a different folder in vCenter, and the original folder referenced by the Citrix Hosting Connection is no longer available. Is there a supported way to update the existing Hosting Connection or MCS provisioning configuration to reflect the master VM's new vCenter folder path, without having to recreate the Hosting Connection? Has anyone encountered a similar scenario or know of a way to update the folder mapping in Citrix Studio?