This message was deleted.

Have you checked this one https://support.citrix.com/article/CTX227673

Thanks Kari! Going to play with that shortly.

It is not using FAS but the login page is on the ADC, even if it SAML: https://www.ferroquesystems.com/resource/howto-azure-mfa-saml-and-citrix-gateway-with-sso-without-fas/ Maybe this could help

Thanks Steven - I'll take a look!

The SAML policy on the Netscaler for Azure AD MFA will always redirect you to Microsoft as that is your IDP no way round that altho u can add your company logo ect i also not seen a way to remove the stay logged in box. Closing the browser with SAML is by design so what your seeing is all typical behaviour

to prevent the popup “stay logged in“ - Look in azure Portal - Azure active Directory - Company Branding. There you can disable this.

Thanks Christian. I poked around and saw that. Looks like it might break other applications, though. Looking next for Azure sign-in time out.

The stay signed in generates a persistent token on the device. More Info https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes