Citrix Endpoint Management

Prepare to enroll devices and deliver resources


Before proceeding, be sure to complete all the tasks described in Onboarding and resource setup.

Keep your users informed about upcoming changes. See Welcome to your Citrix Endpoint Management User Adoption Kit.

Endpoint Management supports various enrollment options. This article covers the basic setup required to enable all supported devices to enroll. The following diagram summarizes the basic setup.

Workflow diagram for preparing an environment for device enrollment

For a list of supported devices, see Supported device operating systems.

Set up an Apple Push Notification service (APNs) certificate for iOS devices


Apple support for the APNs legacy binary protocol ends as of March 31, 2021. Apple recommends that you use the HTTP/2-based APNs provider API instead. As of release 20.1.0, Citrix Endpoint Management supports the HTTP/2-based API. For more information, see the news update, “Apple Push Notification Service Update” in For help with checking connectivity to APNs, see Connectivity checks.

Endpoint Management requires an Apple Push Notification service (APNs) certificate from Apple to enroll and manage iOS devices. Endpoint Management also requires an APNs certificate for Secure Mail for iOS push notifications.

Set up Firebase Cloud Messaging (FCM) for Android devices

Firebase Cloud Messaging (FCM) controls how and when Android devices connect to the Endpoint Management service. Any security action or deployment command triggers a push notification. The notification prompts users to reconnect to Endpoint Management.

  • FCM setup requires that you configure your Google account. To create Google Play credentials, see Manage your developer account information. You also use Google Play to add, buy, and approve apps for deployment to the Android Enterprise workspace on a device. You can use Google Play to deploy your private Android apps, public apps, and third-party apps.

  • To set up FCM, see Firebase Cloud Messaging.

Set up Endpoint Management AutoDiscovery service


As of June 1, 2020, Citrix will change to, for iOS and Android devices. For Windows Phone devices, changes to as well. When those changes occur, you must update the related CNAME records.

Discovery is an important part of many Endpoint Management deployments. The AutoDiscovery service simplifies the enrollment process for users. Users:

  • Can use their network user names and Active Directory passwords to enroll their devices.
  • Can connect without typing details about Endpoint Management.
  • Enter their user name in user principal name (UPN) format. For example,

The Endpoint Management AutoDiscovery service enables you to create or edit an AutoDiscovery record without assistance from Citrix support.

AutoDiscovery is recommended for high security environments. AutoDiscovery supports certificate pinning, which prevents man-in-the-middle attacks. Certificate pinning ensures that the certificate signed by your enterprise is used when Citrix clients communicate with Endpoint Management. For information about certificate pinning, see Certificate pinning.

To access the Endpoint Management AutoDiscovery service, navigate to (commercial) or (government) and then click Request AutoDiscovery.

The AutoDiscovery Service

Request AutoDiscovery

  1. On the AutoDiscovery service page, claim a domain. Click Add Domain.

    The ADS List screen

  2. In the dialog box that opens, enter the domain name of your Endpoint Management environment and then click Next.

    The Domain name field

  3. The next screen provides instructions on verifying that you own the domain.

    The Verify your domain screen

    1. Copy the DNS token provided in the Endpoint Management Tools portal.

    2. To create a DNS TXT record in the zone file for your domain in your domain hosting provider portal:

      Log in to the domain hosting provider portal for the domain. You can edit your domain name server records and add a custom TXT record. The following screenshot shows a domain hosting provider portal. Your portal may look different.

      Example domain hosting provider portal, showing a txt record

    3. Paste the domain token in your DNS TXT record and save your domain name server record.

    4. In the Endpoint Management Tools portal, click Done to start the DNS check.

    The system detects your DNS TXT record. Alternatively, you can click I’ll update later to save the record. The DNS check doesn’t start until you select the record that has a status of “Waiting” and then click DNS Check.

    This check generally takes about an hour. However, it can take up to two days to return a response. The status change might not reflect in the Tools portal until you log out and log in again.

    Waiting status in the ADS List screen

  4. After you claim your domain, you provide information about the AutoDiscovery service. Right-click the domain record for which you want to request AutoDiscovery and then click Add ADS.

    Claimed status in ADS List screen

  5. Enter the requested information and then click Next. If you are unsure about your instance name, add the default instance of zdm.

  6. Enter the following information for Secure Hub and then click Next.

    The Secure Hub Info settings

    • User ID Type: Select the type of ID with which users sign on as either E-mail address or UPN.

      To prompt users to enter their user name and password, choose E-mail address. To prompt users to enter their password, choose UPN. Use UPN when the User Principal Name matches the email address. Both methods use the domain entered to find the server address.

    • HTTPS Port: Enter the port used to access Secure Hub over HTTPS. Typically, the HTTPS port is 443.

    • iOS Enrollment Port: Enter the port used to access Secure Hub for iOS enrollment. Typically, this port is 8443.

    • Required Trusted CA for Endpoint Management: Indicate whether a trusted certificate is required to access Endpoint Management or not. This option can be Off or On. To use a trusted certificate, contact Citrix Support to upload the certificate. To learn more about certificate pinning, see the section on certificate pinning in Secure Hub. To read about the ports required for certificate pinning to work, see the support article on Endpoint Management Port Requirements for ADS Connectivity.

  7. A summary page displays all the information you entered in the preceding steps. Verify that the data is correct then click Save.

    The summary page

Request AutoDiscovery for Windows devices

If you plan to enroll Windows devices, do the following:

  1. Contact Citrix Support and create a support request to enable Windows AutoDiscovery.

  2. Obtain a publicly signed, non-wildcard SSL certificate for The portion is the domain that contains the accounts that users use to enroll. Attach the SSL certificate in .pfx format and its password to the support request created in the previous step.

    To use more than one domain to enroll Windows devices, you can also use a multi-domain certificate with the following structure:

    • A SubjectDN with a CN that specifies the primary domain it serves (for example,
    • The appropriate SANs for the remaining domains (for example,,, and so on).
  3. Create a canonical name (CNAME) record in your DNS and map the address of your SSL certificate ( to

    When a Windows device user enrolls using a UPN, the Citrix enrollment server:

    • Provides the details of your Endpoint Management server.
    • Instructs the device to request a valid certificate from Endpoint Management.

At this point, you can enroll all supported devices. Proceed to the next section to prepare to deliver resources to devices.

Default device policies and mobile productivity apps

If you onboard starting with Endpoint Management 19.5.0 or later, we preconfigure a few device policies and mobile productivity apps. That configuration enables you to:

  • Immediately deploy basic functionality to devices
  • Start with the recommended baseline configurations for a secure workspace

For the Android, Android Enterprise, iOS, macOS, and Windows Desktop/Tablet platforms, your site contains these preconfigured device policies:

  • Passcode device policy: The Passcode device policy is On, with all default passcode settings enabled.

  • App inventory device policy: The App inventory device policy is On.

  • Restrictions device policy: The Restrictions device policy is On, with all default restrictions settings enabled.

Those policies are in the AllUsers delivery group, which contains all Active Directory and local users. We recommend that you use the AllUsers delivery group only for initial testing. Then, create your delivery groups and disable the AllUsers delivery group. You can reuse the preconfigured device policies and apps in your delivery groups.

All Endpoint Management device policies are documented under Device policies. That article includes information about how to use the console to edit device policies. For information about some commonly used device policies, see Device policies and Use Case Behavior.

For the iOS and Android platforms, your site contains these preconfigured mobile productivity apps:

  • Secure Mail
  • Secure Web
  • Citrix Files

Those apps are in the AllUsers delivery group.

For more information, see About mobile productivity apps.

Continue your Endpoint Management configuration

After you complete the basic setup for device enrollment, how you configure Endpoint Management varies widely based on your use cases. For example:

  • What are your security requirements and how do you want to balance those requirements with user experience?
  • Which device platforms do you support?
  • Do users own their devices or use corporate-owned devices?
  • What device policies do you want to push to devices?
  • What types of apps do you provide users?

This section helps you navigate through the many configuration choices by directing you to articles in this documentation set.

As you complete configuration in third-party sites, make note of the information and its location, for reference when you configure Endpoint Management console settings.

Security and authentication

Endpoint Management uses certificates to create secure connections and authenticate users. Citrix provides wildcard certificates for your Endpoint Management instance.

Recommended background reading:

For a discussion of authentication components and recommended configurations by security level, see the “Advanced concepts” article, Authentication.

See also, Security and user experience.

For an overview of the authentication components used during Endpoint Management operations, see Certificates and authentication.

You can choose from the following types of authentication. Configuring authentication includes tasks in the Endpoint Management and Citrix Gateway consoles.

To deliver certificates to users, configure:

For other authentication options, see other articles under Certificates and authentication.

Device enrollment

Device enrollment modes specify the credential types required for users to enroll their devices in Endpoint Management. Device enrollment modes have varying levels of security and determine the required user enrollment steps.

Azure Active Directory enrollment is supported for iOS, Android, and Windows 10 devices. For information about configuring Azure as your identity provider (IdP), see Authenticate with Azure Active Directory through Citrix Cloud.

Device policies and management

Prepare apps for deployment

For information about the apps supported by Endpoint Management, see Add apps.

Other configuration

  • The Role-Based Access Control (RBAC) feature in Endpoint Management lets you assign predefined roles, or sets of permissions, to users and groups. These permissions control the level of access users have to system functions. For information, see Configure roles with RBAC.

  • You create automated actions in Endpoint Management to specify the action to take in reaction to events, certain settings, or the presence of apps on user devices. For information, see Automated actions.