There will be up to 5 Enterprise Apps needed depending on what you want. I did these a couple weeks ago, and each part prompted to grant access for each App that was needed. The person settings this up will need to have the Global Admin rights like @dready stated.
Here are some screenshot I have when I did this
Note when adding this part, each one will require a Enterprise application
1. Azure AD connection allows you to tie it into Azure AD – It will only create the Enterprise app for this portion, this is the first part of the grand scheme. This will ask for permissions to be setup for the Enterprise App
2. Workspace Subscriber Login, allows users to use Workspace Service(Like the StoreFront URL for Example). The first time it you use it, will require permission to be set to create an Enterprise App. Which was integrated in Step 1. This will ask for permissions to be setup for the Enterprise App as well.
3. When sending invitations to Citrix Admin using Azure AD. When the first user(Citrix Admin) gets this. It will require permission to be set for another Enterprise App. This is only if you want to allow Azure AD users to use DaaS. This is different from the Citrix Identity one. Which will ask for the permissions to be setup for the Enterprise Application.