Did somebody already successfully setup Modern Entra SSO on-prem without any issues? I know it is not officially supported for Server OS 2022, but did somebody get this to work technically? I have seen a blog post from the tech preview, where Julian Jakob got it to work with OS22: Citrix DaaS - Entra ID SSO with PRT and without FAS Haven't read anywhere that SAML + Entra SSO is not supported, but I think it wasn't in the past... do we necessarily need OAuth or does SAML also work with this combination?

If there's a need to have it on WS2022, you could reach out to Microsoft to have the Windows KB backported 🙂

would this documentation be more helpful for you? docs.citrix.com/en-us/…/entra-id-oidc.html

No it doesnt work on 2022 but you can use FAS for that while using entra sso on 2025 and w11

The problem is we have an issue with FAS and CBA in our Tenant, where when we enable it, it will enforce Cert-Authentication for every user with Citrix access (so they have it as their top option, as it counts as more secure and it will default choose the most secure option in our Entra tenant). Also when reseting their MFA method, they also need a cert we don't have, so we need to give them a TAP for it to work. The only workaround for this we found is, enabling CBA but "disabling" the option to log in like that over Conditional Access policies, but we have over 20 Conditional Access policies, which we would have to change from "Require MFA" to "Require Authentication Strength" to achieve this 😄

What happens if you make cba single factor rather than multifactor