I'm not sure if this question belongs here or in the Microsoft 365 channel, or the citrix cloud channel, so please let me know where it would fit best. Currently running Onprem CVAD and wanting to do Windows 11 nonpersistent VDI. Easy enough. However, the request is that the user logs in with their email, so that O365 credentials will passthru to Office/Outlook. They physical device landscape is moving to intune managed, entraid only joined machines, so I think the goal is to mimic that. From what I can tell so far from reading up on everything entra - entra only joined is only supported in Citrix DAAS, not CVAD onprem. It also appears that only Citrix Workspace login supports Entra joined, and not Storefront. From MS documentation, it appears that nonpersistent entra-joined is not supported, only persistent, but Citrix DAAS says persistent and nonpersistent are supported, and it says Hosting Platform is Azure only. Basically, how, if possible, would a user login to a Windows 11 nonpersistent VDI in onprem CVAD with Storefront using O365 credentials? FAS is currently in use for netscaler connections with SAML using OKTA as the IDP, so I expected using my email login there would translate to the Win11 desktop, but it shows the UPN in system and not the email, and on first run of Outlook, the user gets the Okta credential prompt. Would hyrbid joined win11 onprem CVAD with SAML (but entra as the IDP) do it? (internal uses storefront, so that would need to go to SAML as well, and netscaler change to entra instead of Okta)

Hybrid joined is the best solution. Using Netscaler, FAS with Cert based authentication can do sson with all the office applications. I did a write-up on my design here. https://www.jeffriechers.com/wiki/azuread-prt-with-fas-certificates/

Thanks Jeff. Just so I understand fully - this just enables SSO access to O365 apps and eliminates the login prompt when launching them, correct?

Yup.

Awesome - thanks. Checking out your blog on it now.