How do you guys enforce a minimum Citrix Workspace App version for external, unmanaged devices?

Not that I've tried it, but Client App Management in DaaS perhaps? Unless you're not using DaaS of course. :)

Thanks ! On-Prem infra 😉 I’m checking GACS… Anyone else?

Device Trust can do the same

yes deviceTrust is a good option.

What's your deviceTrust configuration to control CWA ?

there is a "compliance" templates, which has "use latest CWA" - you should be able to copy that to a new template, and set which version is the minimum requirement

Problem with device trust is you need a plugin installed on endpoint no? Or is it part now of CWA?

As I understand, it's part of the CWA now - maybe @Ashish Goyal can answer

yes its part of CWA

That's handy for sure, great 👍

I’d probably treat this more as an access/posture check rather than trying to manage the unmanaged device itself. If deviceTRUST is already in play, then using the CWA version/compliance context to allow, block, or restrict access makes sense. If not, I’d look at whatever EPA/posture checks are available on the Citrix Gateway/NetScaler side and redirect users to upgrade if they’re below the required version. Also worth checking HTML5/browser access, otherwise that could become the easy bypass route.