This article gives an overview of the Citrix Workspace user experience, including recent changes.
The following addresses need to be contactable to properly operate and consume Citrix Workspace:
For a full listing of Citrix Cloud connectivity requirements, see Internet Connectivity Requirements.
What’s new in the workspace experience
Okta authentication (Technical Preview)
Subscribers can authenticate to Workspace through Okta.
Citrix Gateway authentication
Subscribers can authenticate to Workspace through an on-premises Citrix Gateway to securely access their resources. They can use features such as RADIUS, pass-through authentication, smart cards, conditional access policies, federation, and many others by integrating them into Workspace using the Gateway’s authentication, authorization, and auditing (AAA) feature.
To ensure a visually consistent sign-in experience for subscribers, you can also customize the Gateway sign-in page to mimic the Workspace sign-in page. For more information, see CTX258331.
Active Directory plus token authentication
For additional security, subscribers can use a token as a second factor of authentication in addition to Active Directory sign-in. Workspace prompts all subscribers during every sign-in to enter a token that’s generated from their enrolled device.
Access workspace using Internet Explorer 11, or the latest version of Edge, Chrome, Firefox, or Safari.
Apps and desktops in your workspace are represented in a “card” layout. A pop-up window shows more details and actions.
Search everything in your workspace, open apps directly from the search results.
Search currently requires a minimum of three characters.
Recents displays recently opened apps, desktops, and files. For apps and desktops, depending on screen size, you see up to 30 (in each). For files, you see up to 15.
Select the star icon to add an app to Favorites (max 250). This option is configurable by your administrator, and may not be available.
Access settings from the drop-down menu. The menu contains the user name. The user name comes from the Active Directory display name. If the display name is left blank (we do not recommend this), the domain and account name display.
Select Account Settings for more options.
- Activate Citrix Workspace. Downloads a file that adds this workspace to your local Citrix Receiver app.
Change Citrix Workspace. Opens a page that checks for a local Citrix Workspace app. Not available in Internet Explorer 11.
This option is only available with Citrix Virtual Apps and Desktops services. Change Citrix Workspace is not available if, for example, you are only using SaaS apps through the Citrix Gateway service.
- Download Citrix Workspace. Downloads a Citrix Receiver installation file to your machine. Run the file to install a local Citrix Workspace app for Windows or Mac.
Citrix Workspace app
Citrix recommends that Workspace subscribers use the latest version of Citrix Workspace app.
You can also access workspaces using Internet Explorer 11, or the latest version of Edge, Chrome, Firefox, or Safari.
Currently, some customers continue to use Citrix Receiver. Citrix Receiver is supported for any of the desktop platforms (Windows, Mac, and Linux). Citrix Receiver for HTML5 and Citrix Receiver for Chrome are also supported.
Communication over Transport Layer Security (TLS) 1.0 and 1.1 will be blocked on March 15, 2019. If you are using earlier versions of Citrix Receiver that do not support TLS 1.2, any user trying to connect to Citrix Workspace will not be able to connect. Please make sure you update Citrix Receiver or upgrade to Citrix Workspace app by March 15, 2019. For an overview of TLS and SHA2 support with Citrix Receivers, see CTX23226.
For more information about supported features by app platform, refer to the Workspace app feature matrix.
Supported authentication methods for Citrix Workspace app
The following table shows the authentication methods supported by Citrix Workspace app.
|Citrix Workspace app||Active Directory Authentication||Active Directory plus Token Authentication||Azure Active Directory authentication|
|Citrix Workspace for Windows||Yes||Yes||Yes (Workspace app; Receiver 4.9 LTSR CU2 and later only; Receiver 4.11 CR and later only)|
|Citrix Workspace for Linux||Yes||Yes||Yes (Workspace app; Receiver 13.8 or and later only)|
|Citrix Workspace for Mac||Yes||Yes||Yes|
|Citrix Workspace for iOS||Yes||Yes||Yes|
|Citrix Workspace for Android||Yes||Yes||Yes (Workspace app; Receiver 3.13 and later only)|
For more information about Workspace app support for specific features, refer to the Workspace app feature matrix.
Currently, some customers continue to use Citrix Receiver. Citrix Receiver is supported for any of the desktop platforms (Windows, Mac, and Linux). Citrix Receiver for HTML5 and Citrix Receiver for Chrome are also supported. For an overview of TLS and SHA2 support with Citrix Receivers, see CTX23226.
Citrix Receiver and Citrix Workspace app
This section guides existing customers, who are working with Citrix Receiver, through the change to Citrix Workspace app.
The latest Citrix Workspace experience is available with the following services in Citrix Cloud:
- Virtual Apps Essentials
- Virtual Desktops Essentials
- Virtual Apps and Desktops service (includes Site aggregation from Virtual Apps and Desktops on-premises resources)
- Citrix Gateway service (delivering secure web and SaaS apps)
- Content Collaboration (formerly ShareFile)
- Secure Browser service
New customers. If you are new to the workspace experience, you’ll get the latest version of the user interface as soon as it is available. You can access the workspace experience from your browser or from a local Citrix Workspace app.
Existing customers. If you have been working with an earlier version of Citrix Workspace, it can take around five minutes for the updated user interface to display in local Citrix Workspace apps. You may temporarily see an older version of the user interface. Alternatively, you can click the Refresh button in your web browser to update the user interface as needed. If you have been working with Citrix Receiver as your local app, you will need to guide your users to upgrade to Citrix Workspace app to use all the features of the Citrix Cloud services.
The scenarios below illustrate what users are likely to see.
If your users are accessing Workspace with Citrix Receiver, with the above service integrations enabled, users will see the “purple” user interface shown below. They will see Virtual Apps and Desktops apps as well as web and SaaS apps from the Citrix Gateway service. Files are not supported in Citrix Receiver and users will not be able to access them this way.
With the same services enabled and access control enabled, users will still see the purple user interface, however without web and SaaS apps, as the access control feature is not supported in Citrix Receiver.
Access control is a feature that delivers access for end users to SaaS, web, and virtual apps with a single sign-on (SSO) experience.
Citrix Workspace app or browser
When your users upgrade to Citrix Workspace app or use a web browser to access Workspace, they will see the new user interface and can use of all the new functionality including Files.
Azure Active Directory (AAD)
This scenario is for either AAD enabled as the Workspace authentication method. If your users try to log on using Citrix Receiver, they will see a message that the device isn’t supported and to try from a browser instead. Once they have upgraded to Citrix Workspace app, they can access Workspace. For the matrix showing authentication methods supported with Citrix Workspace app, see the table at the end of this article.
StoreFront (on-premises deployment)
If you have a StoreFront on-premises environment and users choose to upgrade from Citrix Receiver to Citrix Workspace app, the only change will be the icon to open Citrix Workspace app.
Citrix Cloud Government users will continue to use their “purple” user interface when using the Workspace app or when accessing from a web browser.
Changes to your service subscription
If you have changed your service subscription, you may need to refresh the local Workspace app manually. In Citrix Workspace app for Windows:
- From the Windows system tray, right-click the Citrix Workspace icon, and click Advanced Preferences > Reset Citrix Workspace.
- Open Citrix Workspace app for Windows, then select Accounts > Add, and enter the workspace address, for example,
As an alternative to step 2, you can use a browser to enter the workspace URL and sign in. Then, activate Citrix Receiver from Settings > Account Settings > Activate Citrix Workspace. Activating Citrix Workspace downloads a file with a .CR extension that adds the workspace to your local Citrix Workspace app.
Changes to authentication
If you are logged on to Citrix Workspace and your administrator makes a change to the authentication method - for example, from Active Directory to Azure Active Directory - you may see errors in Citrix Workspace. If this happens to you, log off Citrix Workspace and close the browser or Citrix Workspace app. Wait approximately 5 minutes and log back on again. Citrix Workspace should be available to you again. You can log on using the new authentication method.
Authentication with Active Directory plus token
Before Workspace subscribers can use two-factor authentication with a token, they must first register their device. During registration, subscribers are presented with a QR code they can scan with an app that follows the Time-Based One-Time Password standard, such as Citrix SSO or Google Authenticator. For a smooth registration process, Citrix recommends downloading and installing this app on the device beforehand.
- From a computer, open a browser, navigate to the Workspace sign-in page, and click Don’t have a token?
- Enter your user name in domain\username format or your company email address and click Next. Citrix Cloud sends you an email with a verification code.
- After you receive the email, enter the verification code and your Active Directory account password when prompted. Click Next.
- From the authenticator app, scan the QR code or enter the verification code manually.
- Click Finish and Sign In to complete the registration.
After completing registration, subscribers can return to the Workspace sign-in page and enter their Active Directory credentials, along with the token displayed in their authenticator app.
Authentication with Citrix Gateway
When authentication with Citrix Gateway is enabled, subscribers experience the following workflow:
- The subscriber navigates to the Workspace URL in their browser or launches Workspace app.
- The subscriber is redirected to the Citrix Gateway logon page and is authenticated using any method configured on the Gateway (for example, RADIUS MFA, smart card, federation, conditional access policies, and so on). You can customize the Gateway logon page so that it looks the same as the Workspace sign-in page using the steps described in CTX258331.
- After successful authentication, the subscriber’s workspace appears.
Authentication with Okta (Technical Preview)
Note: This feature is currently available as a technical preview. Citrix recommends using technical preview features only in test environments.
When authentication with Okta is enabled, subscribers experience the following workflow:
- The subscriber navigates to the Workspace URL in their browser or launches the Workspace app.
- The subscriber is redirected to the Okta sign-in page and is authenticated using the method configured in Okta (for example, multifactor authentication, conditional access policies, and so on).
- After successful authentication, the subscriber’s workspace appears.
In this article
- What’s new in the workspace experience
- Citrix Workspace app
- Supported authentication methods for Citrix Workspace app
- Citrix Receiver and Citrix Workspace app
- Changes to your service subscription
- Changes to authentication
- Authentication with Active Directory plus token
- Authentication with Citrix Gateway
- Authentication with Okta (Technical Preview)