Two questions regarding Entra SSO in Citrix DaaS: 1. Based on the new CTX article, it looks like FAS and Entra ID SSO can coexist, and only the Delivery Group "Logon Type" determines whether FAS or Entra ID SSO is used. If that's the case, is there any reason to disable FAS on the Resource Location itself? I already removed the FAS GPO from the VDA OU, but I'm not sure if that was actually required. 2. Does Entra ID SSO require the endpoint device to be Entra joined or Hybrid Entra joined, even when using the Citrix Web Extension? (Thinking about BYOD)

1: It seems like you want to disable FAS completely? If that's the case. I would just remove the FAS configuration from citrix cloud. 2: No. That's the benefit of using EntraID SSO. No shadow users. Just remember that you need to assign Entra ID groups to the delivery groups, otherwise users can see the desktop/applications.

1: No i have some legacy VDAs which still need FAS. 2: So this should work with somebodys computer at home with CWA installed and Web Extension in thr Browser?

1: if a resource inside the Resource Location needs FAS, then I wouldn't disable FAS. 2: Yes. I have a couple of customers using EntraID SSO that way. Did you follow the citrix article explaining the configuration?

I think so but I am still getting a logon prompt after the session start. The only event I am seeing is that the VDA is expecting a FAS configuration, which is obviously not needed:

Did you configure the Logon Type, for the EntraID Delivery Group? When a user, logs in from e.g. dennishirsch.cloud.com, do they see a popup in the browser? This popup does the log in part for the user.

Yes I have set the Logon Type. There is no Popup in the browser. It does not work via native CWA as well.

Did you do the dynamic group in EntraID?

Is that really necessary? I just used a synced OnPrem Group COntaining the VDAS

I haven't set it up w/o it 🙂

No, since I am using MCS 🙂

Remember beer or wine, with that 😉

The point with "when you use MCS" - watch out if you deployed the machine catalog with MCS with the new setting "Hybrid joined" ! If that's NOT the case, you need the mentioned Regkeys on the VDA. If you don't want to deploy the Regkey, you need to recreate the machine catalog with the setting "Enable hybrid join" - this will prevent also the VDA from registration, if the host isn't hybrid joined, yet. So don't be confused after a reboot of the VDA it will took some time for the VDA to be registered, as it waits for the success of hybrid join. The docs are a bit confusing regarding these settings... 🙂

OK i configured the logon type for the wrong delivery group, it is working now even without the dynamic group 😄

But I'm also interested if the filtering between FAS and EntraID-SSO on different delivery groups is working fine

Yep, this is working. I had the same scenario with another customer while migrating to Entra ID SSO. There’s also a Citrix article covering this scenario: https://support.citrix.com/external/article/CTX696865/citrix-coexistence-of-fas-and-nonfas-en.html

Looking at implementing this soon and all this is very helpful. Been procrastinating on it as it seemed to be a lot more difficult than than maybe it is. 🙂

If all requirements are met it takes less than an hour to set up

Is anyone running co-exist in prod? Is the Regkey AzureADJoinType = 1 in HKLM\SYSTEM\CurrentControlSet\Control\Citrix which is needed for EntraID SSO breaking the FAS-Fallback? Just asking if I should watch out to which delivery group I'm rolling out that key. Thanks all