World of EUC

Gpo must applied to fas, storefront and worker

interesting...its not in this environment

it is a requirement.  perhaps they used lgpo or simply the registry keys?  easy to check, just look at hklm:\\softwarepolicies\citrix\Authentication\UserCredentialService\Addresses for the fas server names.

Exactly. Maybe they put it directly in the registry

<https://www.deyda.net/index.php/en/2022/08/18/saml-authentication-between-citrix-microsoft-with-azure-mfa/|https://www.deyda.net/index.php/en/2022/08/18/saml-authentication-between-citrix-microsoft-with-azure-mfa/>

TechZone link as well. But yea, GPO or another method of applying it goes to the FAS,SF, and VDA.
<https://docs.citrix.com/en-us/tech-zone/design/reference-architectures/federated-authentication-service.html#active-directory>

You can check this location as well
*HKLM\Software\Policies\Citrix\Authentication\UserCredentialService\Addresses*

Oops looks like <@U014U1UPHDW> already put that on there. Sorry.