This message was deleted.

Answered in the discussion thread, but copying here: You get a PRT when using azure ad certificate-based authentication (currently in public preview) but it's only working with Windows 11 Insider Preview Build, at the moment. MS will backport the functionality for Windows 10 and Server OS later this year (no ETA confirmed) see my post about some details https://www.julianjakob.com/citrix-fas-azure-ad-cba-with-primary-refresh-token-prt/ The other workaround is to federate your domain with OnPrem ADFS and connect your ADFS to Azure MFA. This is also supported and generates a PRT. I know, both methods aren't the best, yet... There is also another method, using local credentials for pushing SSO, but you have to use native Workspace App and the clients have to be domain-joined. See https://citrixie.wordpress.com/2022/07/04/citrix-workspace-azure-ad-sso-access-to-vda-desktops-and-apps-without-fas/

Ok, I understand now. For different reasons the customer just ditched ADFS.. I guess we will have to wait for this functionality then. Thanks!