Hi, issue with Yubikey. I've tested in two separate sites now, from the same local client. Same redirect policies in Citrix studio. When I attempt to authenticate in one of the sessions, the Windows Login for security key pops up outside the session, and I can use the Yubikey locally without redirecting it into the session. In the other session, I attempt the same thing, but the pop-up doesn't appear outside the session. I'm not sure what triggers this, I was under the impression I had to redirect the Yubikey inside the session for this to work. Any tips/tricks?

You don't need to redirect Yubikey into the session..local Workspace app supports native redirection of the FIDO authentication tokens. I've used it with Entra MFA and CWA successfully

Thank you, yeah, I've been trying to USB redirect it for so long without success so I just typed it in here 🙂 No redirection policies, I'm not using the yubikey for authentication on the citrix store, just using it inside the session.

For the non-working one, has the Yubikey been setup in FIDO mode?

yes, it's the same yubikey I attempt to use

what auth type is used via Netscale vs StoreFront?

Netscaler = Radius (Windows Authentication) Storefront = User name and password

Could there be a different session policy applying to sessions via NSG that's blocking Fido auth or the Virtual Channel required?

It's the session launched via NSG that's working

ah OK..will the same could apply inversely. You can filter session policies for internal/external. Check Citrix Director for the applied policies to see if there are differences?

So the two desktops are in two different sites, the one where it's not working has no NSG, only storefront. The one where it's working has it's own NSG, storefront etc.

Run RSOP against both and look for differences?