Running FAS for Entra ID sign-in today? With CVAD 2607 LTSR you can drop it on-prem: NetScaler OIDC, StoreFront and hybrid joined VDAs give real SSO into the session, with no FAS servers, CA or logon certificates. I've written up a production rollout, including the NetScaler config and the two issues that bit us.
poppelgaard.com/bye-bye-fas-achieving-pure-citrix-sso-with-netscaler-and-entra-id