We are trying to setup a MacOS VDA for the first time. We have an intune policy that sets a screen lock time out on the Mac. It works when logged on at the console. However, when logging on over the VDA it never activates the screen lock. Citrix support said this is currently expected behavior. Security won't let us deploy without a screen lock. Anyone else dealing with this?

Screen lock is probably used for idle behavior, just set a timeout for idle sessions a bit aggressive to compensate. But honestly, both can be ignored easily (open a notepad, but a glass on your keyboard....)

Our problem is that when connected with VDA, it never locks. We are just using a test machine. If I am logged in at the console, and leave it idle, it locks after 15 minutes like it should. If I connect to it with the Citrix client, it stays unlocked for hours.

What about a Citrix policy for that "set a timeout for idle sessions"?

I'm not aware of a Citrix Policy to lock the screen. There is only a policy to disconnect the session. The problem with that is the user would likely have to log back into the portal with MFA and restart their session.

The phone sees it active when a session is running, it kind of makes sense. You will have to put a idle + disconnect session timeout matching your lock screen policy or very similar. Users will have to stay active or will have to re-authenticate, that's the trade-off of security.