This message was deleted.

Don’t do it to yourself - if you have any direction in the future to leverage conditional access, NPS will block your direction entirely - it’s the devil for those with more than a simple MFA need for Citrix (think strategy).... use SAML, FAS and AzureAD instead - same infrastructure overhead, less blocking of your future strategy

We have the standard edition ADC. I thought in order to use FAS it has to be enterprise or higher edition? What other options do I have with Standard?

nope, FAS has naught to do with ADC, ADC just needs to have a SAML profile configured (ideally nFactor for Enterprise). For standard, you can still use a simple SAML profile, however it wont work with Workspace App Natively, only Web....this is where Enterprise ADC comes into play with nFactor

Ok sounds good. Yep we are only using web. Thanks!

Carl’s post is closer to your needs https://www.carlstalhood.com/citrix-federated-authentication-service-saml/#azureadsaml and check @Ryan Gallier cugc post for updated logoff detail to make sure you logoff everything properly in both places (ADC and Azure)

Ok. Will do. I was just not sure on the requirement for enterprise license in the beginning is why I kind of dismissed it until I posted here. Thanks for all the replies. Very helpful. I will try to implement this coming week and see how it goes.

You can create a simple Radius LB for your NPS server so that you can use the SNIP as Radius Client on the NPS Server.

@Ben B We have recently implemented web-only AAD/saml/FAS with Conditional Access (MFA) to on-prem 1912, using ADC Standard edition. Works great but yes the inability to use workspace app is a major pain. I’m currently groveling internally for upgrade to Enterprise :( Although somebody here rumoured that the functionality might be released to Standard Edition but I’ve heard nothing :(

Thanks @David Inglis I will probably give it a shot. I'm on 7.15 CU3 right now, Standard ADC license. I did get this working going the original NPS route but not sure I am a fan of it and hearing it can cause issues down the road with conditional access, maybe I should try the route you described.

Yes the issue is that you’re going to want to use Conditional Access to require your MFA with more granularity (eventually, even if you don’t know it yet), but the NPS server doesn’t work with CA policies, so is an ‘all or nothing’ for your users. By doing the auth at Microsoft’s end using ‘modern auth’ and the Enterprise App route, as above, you’ll be able to integrate it nice and granularly into Conditional Access policies that require (or not) MFA.