Hi everyone, We got a weird problem that started yesterday. This is a DaaS service with on-premise resources, using EntraID and FAS for authentication. There are conditional access policies in place in EntraID as well. Yesterday, some users lost their applications in Citrix Workspace, both via browser and in the Citrix Workspace App. No apps are visible, and their names are replaced with the EntraID OID for their user account. The number of users that are affected by this seems to increase over time. We can find no faults, errors or other symptoms on the on-premise servers. The cloud connectors and FAS servers seem to work fine, and there are users that can login fine. There does not seem to be anything different between the users that are able to log in and those that can't. We have an alternate URL to a Store in Citrix Cloud that was set up previously. This uses a different Entra ID tenant, but is related to the same Active Directory domain. If we use that URL and log in with the same users, the applications show up as expected. Unfortunately, SSO does not currently work here, so we are hesitant to tell the users to use that as a workaround. We have opened a case with Citrix, but so far we have not had much progress there. Anyone that has seen the same issue?

Are you using the native Entra Authentication in DaaS (which is OIDC) or SAML? When it's OIDC, checkout this, your Entra tenant might be affected by that change of Microsoft julianjakob.com/microsoft-entra-ca-baseline-changes-affecting-citrix-authentication

The issue was resolved about an hour after I posted here. Turns out that the Entra ID tenant admins had disabled two of the three Citrix Enterprise apps a while ago. They assumed they weren't in use since the logs didn't show any recent activity. It has worked for a while, not sure how long yet. But as soon as the apps where enabled again, the users started to successfully log in again. Some users still have issues, but it seems to improve over time now.

@Julian Jakob that was exactly where my mind went. I am amazed that transition hasn't been a bigger deal (only one of my clients was affected). I guess because its just around CA Design. Thank you for that blog though - it was a huge help

In my case, I believe SAML is used for authentication, but I am not 100% sure about that. That is indeed an interesting blogbost, for sure.