hi Guys, any working setups where workspace app could SSO - authenticate to storefront (just storefront , not AG) when users logging into their windows laptops using Windows Hello for business (via Cloud Kerberos)? all worked when logging with username /password but now testing WHfB and logs from authmanager service say that Windows Integrated auth failed and it is switching to forms. amLogonResult=LogonResult_UnsuitableProtocol Wed Sep 9 020556 2026 < T:00001D9C . . . . . . . . . . } Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . CProtocolSelector::MoveNextOrThrow Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . { Wed Sep 9 020556 2026 T:00001D9C . . . . . . . . . . . ‘IntegratedWindows’ allows fallback for ‘UnsuitableProtocol’. Wed Sep 9 020556 2026 T:00001D9C . . . . . . . . . . . Next choice is ‘ExplicitForms’. Wed Sep 9 020556 2026 < T:00001D9C . . . . . . . . . . } Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . CProtocolSelector::Current Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . { Wed Sep 9 020556 2026 T:00001D9C . . . . . . . . . . . Current protocol choice for authentication is ‘ExplicitForms’

we seem to have same issue. Any fixes identified yet pls?

Are they hybrid? Or pure Entra joined?

we have this issue on both hybrid and cloud only laptops. I am mostly testing on a hybrid. I understand that OK ssonsvr wouldn’t work for this case. but we have cloud kerberos and it is set to “Use Cloud Trust for on-premises authentication” and overall that works with mounting user shared folders etc, so Kerberos part seems to be working, just doesn’t play well with Storefront.

Did you do the extra config in latest storefront? docs.citrix.com/en-us/…/entraid-sso

interesting in my case started working after adding this regkey on both hybrid joined and cloud only laptops [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\AuthManager\protocols\integratedwindows] “SSONCheckEnabled”=“False” still not exactly clear why and how. I thought that works automatically if it senses you are logged on not using username and password.