This message was deleted.

The Citrix Gateway session policy has a “Groups Allowed to Login” setting where you can put the name of a group allowed to login. This is always my first choice in a request like this. You might be able to set an authorization to deny based on the group that you have setup, but you would need to test that.

@Joel Donaldson My issue is, the users will be in the allowed and disallowed groups. This is a modification to existing settings that will contain users who have been furloughed 😢

If they're furloughed, wouldn't the easiest way to accomplish this to be to disable their AD account? If that won't work for the org, you could probably just add something like && aaa.user.IS_MEMBER_OF("DenyGroup").NOT to the existing session policies and make sure the global defaults are set to deny access.

Disabling would be the easiest. But that is not on the table.