This message was deleted.

https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/policies-create.html An assignment’s mode determines if the policy is applied only to connections that match all the assignment criteria. If the mode is set to Allow (the default), the policy is applied only to connections that match the assignment criteria. If the mode is set to Deny, the policy is applied if the connection does not match the assignment criteria. The following examples illustrate how assignment modes affect Citrix policies when multiple assignments are present. • Example: Assignments of like type with differing modes - In policies with two assignments of the same type, one set to Allow and one set to Deny, the assignment set to Deny takes precedence, provided the connection satisfies both assignments. For example: • Policy 1 includes the following assignments: ◦ Assignment A specifies the Sales group. The mode is set to Allow. ◦ Assignment B specifies the Sales manager’s account. The mode is set to Deny. • Because the mode for Assignment B is set to Deny, the policy isn’t applied when the Sales manager logs on to the Site, even though the user is a member of the Sales group. • Example: Assignments of differing type with like modes - In policies with two or more assignments of differing types, set to Allow, the connection must satisfy at least one assignment of each type for the policy to be applied. For example: • Policy 2 includes the following assignments: ◦ Assignment C is a User assignment that specifies the Sales group. The mode is set to Allow. ◦ Assignment D is a Client IP Address assignment that specifies 10.8.169.* (the corporate network). The mode is set to Allow. • When the Sales manager logs on to the Site from the office, the policy is applied because the connection satisfies both assignments. • Policy 3 includes the following assignments: ◦ Assignment E is a User assignment that specifies the Sales group. The mode is set to Allow. ◦ Assignment F is an Access Control assignment that specifies NetScaler Gateway connection conditions. The mode is set to Allow. • When the Sales manager logs on to the Site from the office, the policy isn’t applied because the connection does not satisfy Assignment F.

Ah.. that was the piece I missed.. I was trying to find exactly that 🙂 thanks!