We want to use the Open Intune Baseline and get rid of NTLM. See: github.com/SkipToTheEndpoint/OpenIntuneBaseline/blob/…/SETTINGSOUTPUT.md#… When we import and enable the policy, this breaks SSO of the CWA. Now I wondered if we can switch Storefront from NTLM to Kerberos, by using a gMSA and setting a SPN, but I can't find any guide, nor I can get it to work. Has somebody done something like this, are there any guides?

For favourites synchronization you need 2511 or 2507 CU1 or 2402 CU3 or higher. They have a change that will hopefully get Windows to use Kerberos rather than NTLM. Please let me know if this is successful. If you're using domain pass-through authentication to StoreFront via a load balancer then with the default configuration IIS is unable to use Kerberos so falls back to NTLM. To get it to use Kerberos, follow these steps. • run the Citrix IIS app pools under a domain service account. (gMSA is the cleanest option and gives you AES by default) • register the load balancer SPNs on that account, and check there are no duplicate SPNs • set useAppPoolCredentials=true at the app root (Citrix/StoreWeb and Citrix/StoreAuth) and useKernelMode=false, then do a full W3SVC restart (not just a recycle) • Ensure you are using sticky load balancing (you probably already are). This is not an officially supported configuration. Please let me know if you have any success with this. None of this will help with SSO to VDAs which has nothing to do with StoreFront.