Citrix aims to deliver new features and product updates to Citrix Endpoint Management customers when they’re available. New releases provide more value, so there’s no reason to delay updates.
- Rolling updates to Citrix Endpoint Management go out approximately every two weeks.
- These updates don’t result in any downtime for your instance or device users.
- Not every release has new features and some updates include fixes and performance enhancements.
To you, the customer, this process is transparent. We apply initial updates to Citrix internal sites only, and then to customer environments gradually. Delivering updates incrementally in waves helps to provide product quality and to maximize availability.
You also receive Citrix Endpoint Management updates and communications directly from the Citrix Endpoint Management Cloud Operations Team. Those updates keep you current with new features, known issues, fixed issues, and so on.
For more details, including cloud scale, and service availability, see the Citrix Endpoint Management Service Level Agreement. To monitor service interruptions and scheduled maintenance, see the Service Health Dashboard.
Continued support for the Classic policies deprecated from Citrix ADC
Citrix recently announced the deprecation of some Classic policy-based features starting with Citrix ADC 12.0 build 56.20. The Citrix ADC deprecation notices have no impact to existing Citrix Endpoint Management integrations with Citrix Gateway. Citrix Endpoint Management continues to support the Classic policies and no action is needed.
Before upgrading endpoints to iOS 14.5
Before upgrading any endpoint to iOS 14.5, Citrix recommends that you do the following to mitigate app crashes:
- Upgrade Citrix Secure Mail and Citrix Secure Web to 21.2.X or higher. See Upgrade MDX or enterprise apps.
- If you use the MDX Toolkit, wrap all third-party iOS applications with MDX Toolkit 21.3.X or higher and upgrade those apps in the Citrix Endpoint Management console. Check the MDX Toolkit download page for the latest version.
Before you upgrade an on-premises Citrix ADC to 13.0-64.35+
If you use the on-premises version of Citrix ADC and upgrade to version 13.0–64.35+: use the workaround described in Known issues in Citrix Endpoint Management 20.10.1.
Citrix Endpoint Management 23.12.0
Added a new mandatory field “Domain” in the 802.1x settings for Android: A new field Domain is added in the Android Enterprise platform network policy settings page for 802.1x EAP authentication type. For more information, see 802.1x settings for Android.
Citrix Endpoint Management 23.9.0
The documentation updates for Citrix Endpoint Management 23.9.0 has been rolled back due to product release rollback.
Citrix Endpoint Management 23.7.0
- Play Integrity API: The Play Integrity API replaces the soon to be deprecated SafetyNet Attestation API as per the deprecation timeline by Google. For more information and steps to enable this API, see Enable the Play Integrity API.
- Support for eSIM and dual SIM capabilities on iOS devices: Citrix Endpoint Management now supports eSIM and dual SIM capabilities on iOS devices. eSIM support allows you to retrieve information such as phone number, IMEI, ICCID from the iOS device and displays on the Citrix Endpoint Management UI. For more information about the device properties, see Device property names and values.
Current known issues
Intermittently, selecting all three log types (Debug, Admin Audit, User Audit) to download under Troubleshooting and Support > Logs isn’t working. Only Debug logs are being downloaded. As a workaround, you can download each log separately, or open your browser in incognito mode to download all logs by marking all three check boxes. [CXM-105334]
When creating a web link in Android Enterprise, an error occurs when trying to save the app with an icon. This is a Google services issue. As a workaround, save the app without uploading an icon. [CXM-105395]
Samsung Knox/SAFE policies are still active on enrolled devices even after deprecation, and cannot be disabled or configured. As a workaround, unenroll and reenroll the device. [CXM-104303]
When searching for an enrolled active directory user on the Monitor tab, no enrolled devices are shown for the user. You can still see policies and apps assigned to the user, and use all security actions, from Manage > Devices. Both iOS and Android enrolled devices are affected. [CXM-104283]
Private apps fail to publish using Android Enterprise because of an issue in Google services. We will update our documentation when the issue is resolved. [CXM-103690]
After migrating to Citrix Cloud based RBAC, admin users with full access permission in Citrix Cloud also obtain full access permission in CEM, even if they had custom permission before the migration. As a workaround, you can update admin permissions on the Citrix Cloud Identity and Access Management page with the desired access. [CXM-102765]
Customers who onboarded before 2018 have local admin access to the console. CEM admin users with permissions to add or edit local users also can add or edit local users in Citrix Cloud. This includes changing local users’ passwords. To remediate this issue, you can call Support to have direct local admin access to the console blocked, allowing only Citrix Cloud admin access. [CXM-102780]
On iOS devices enrolled only in MAM, enterprise apps fail to install. [CXM-101852]
Using the Automatically Update Managed Apps policy for Android Enterprise fails to apply on devices when the CEM server is upgraded to 21.11.0. The policy failure impacts app updates on the device. As a workaround, an administrator can edit and save the policy to refresh the default values. [CXM-102446]
The VPN device policy does not work properly on managed Windows 11 devices. We reported this issue to Microsoft and are working with them to resolve it. We’ll provide updates on any progress.
On Android devices enrolled in work profile on corporate-owned devices mode: Users might see errors saying they can’t install or search apps on their personal profile. If they see those errors, update the Google Play Store app and try again. [CXM-100678]
Users can’t authenticate to Azure Active Directory (AAD) if they:
- Enroll their device in Citrix Endpoint Management using AAD credentials.
- Launch an Office 365 app and complete the AAD registration.
- Remove their account from the Microsoft Authenticator app.
- Launch an Office 365 app and sign out.
As a workaround, unenroll the device from Citrix Endpoint Management and re-enroll. [CXM-90235]
Re-enrollment fails on iOS devices if the user trying to re-enroll is a different Azure Active Directory user than the user originally enrolled on the device. As a workaround, unregister the original user from the Microsoft Authenticator app on the device before re-enrolling. [CXM-90218]
When adding Citrix Secure Web as an MDX app for Android Enterprise, Managed Google Play can’t find the app using the app identifier. If you search for “Citrix Secure Web” instead of the app identifier, Managed Google Play can find the app. This issue is a Google bug. [CXM-91991]
Importing the SSL Listener certificate might fail. Repackage the certificate keystore by following the steps in CTX-297153. [XMHELP-3346]
If you upgrade on-premises Citrix ADC to 13.0-64.35 or later, and Citrix Endpoint Management isn’t Workspace-enabled: Single sign-on to Citrix Files or the ShareFile domain URL results in an error. The user is unable to sign in. This error only occurs in a browser with the Company Employee Sign in option.
To work around this issue: If you haven’t already run the following commands from the ADC CLI on Citrix Gateway, run them to enable global SSO:
set vpn parameter SSO ON
bind vpn vs <vsName> -portalTheme X1
For more information, see:
After you complete the workaround, users can authenticate to Citrix Files or the ShareFile domain URL using SSO in a browser with the Company Employee Sign in option. [CXM-88400]
After configuring ShareFile with a ShareFile URL in the Citrix Endpoint Management console, clicking the Test Connection button results in an error. To resolve this issue, disable multifactor authentication for ShareFile. Learn more about this issue and the workaround on this support page. [CXM-79240]
When adding users to a library in Citrix Cloud, Citrix Endpoint Management reports success, but the users aren’t added. [CXM-73726]
MDX and Public apps can’t be deleted from the console. As a workaround, select the app you want to delete and then click Edit. Deselect Android Enterprise and select any other platforms from the platform list. Save the app. You can then delete the app. [CXM-74468]
When enrolling a Citrix Ready workspace hub device, define the Ethernet (eth0) MAC address in the allow list to avoid failed enrollment. [CXM-43141]
When tabbing through options in the Windows GPO device policy, radio buttons and check boxes get skipped. [CXM-58277]
If you unenroll an Android Enterprise enterprise by deleting it through the Google admin console: Trying to re-enroll the enterprise might fail. Always use the Citrix Endpoint Management console to unenroll an Android Enterprise enterprise, as described in Unenroll an Android Enterprise enterprise. Google Workspace customers, follow the instructions in Unenrolling an Android Enterprise enterprise. [CXM-62709] [CXM-62950]
When creating a public store app in Citrix Endpoint Management 10.18.3: On the iPad App Settings page, if you click Back without searching for apps, and then you click Next, the following issue occurs. The navigation buttons appear unresponsive and don’t allow you to search for apps. The issue occurs when creating public store apps for both iOS or Android. [CXM-46820]
After you complete the registration process on the Settings > Android Enterprise page, the following error message appears: “A configuration error occurred. Please try again”. When you close the error message, your Android Enterprise configuration is saved, however Enable Android Enterprise is Off. To work around this issue, reduce the number of app categories to 30 or fewer. [CXM-60899]
When a Chrome app is configured as a required app for Chrome OS devices: Users might need to log off and log back on to install the app. This third-party issue is Google bug ID #76022819. [CXM-48060]
After you delete a Citrix Cloud administrator who has a device enrolled: Citrix Endpoint Management doesn’t update the User Role in the Citrix Endpoint Management console until after the administrator logs in again from the Citrix Secure Hub app or the Self-Help Portal. [CXM-45730]
If you configure Citrix Endpoint Management for single sign-on (SSO) using the Citrix identity provider with Azure Active Directory: When an Citrix Endpoint Management administrator or user gets redirected to the Azure Active Directory sign-in screen, the screen includes the message “Sign-in page for Citrix Secure Hub.” The correct message is “Sign-in page for Citrix Endpoint Management console.” [CXM-42309]