Support for Software as a Service apps

Software as a Service (SaaS) is a software distribution model to deliver software remotely as a web-based service. Commonly used SaaS apps include Salesforce, Workday, Concur, GoToMeeting, and so forth.

SaaS apps can be accessed using Citrix Workspace using the Secure Workspace Access service. The Secure Workspace Access service coupled with Citrix Workspace provides a unified user experience for the configured SaaS apps, configured virtual apps, or any other workspace resources.

SaaS apps delivery using the Secure Workspace Access service provides you an easy, secure, robust, and scalable solution to manage the apps. SaaS apps delivered on the cloud have the following benefits:

  • Simple configuration – Easy to operate, update, and consume.
  • Single sign-on – Hassle free logon with Single sign-on.
  • Standard template for different apps – Template based configuration of popular apps.  

How SaaS apps are supported with the Secure Workspace Access service

  1. Customer admin configures SaaS apps using Secure Workspace Access service UI ( The admin then adds subscribers (users) for the apps.
  2. Admin provides the service URL to the users to access Citrix Workspace.
  3. Users subscribed for an app can see the app upon logon to Citrix Workspace.
  4. To launch the app, a user clicks the enumerated SaaS app icon.
  5. SaaS app trusts the SAML assertion provided by the Secure Workspace Access service and the app is launched.


Configured SaaS apps are aggregated along with virtual apps and other resources in Citrix Workspace for a unified user experience.

How it works

Ways to configure the SaaS apps

SaaS apps can be configured and published in the following two ways:

Configure and publish apps manually

The following configuration takes the Aha app as an example to configure and publish an app manually:

  1. On the Secure Workspace Access tile, click Manage.

  2. Click Add an app.

  3. Click Skip to configure the Aha app manually.

    skip selecting template

  4. Select Outside my corporate network.

  5. Enter the following details in the App Details section and click Save.

    Name – Name of the application.

    URL – URL with your customer ID. If SSO fails or when the Don’t use SSO option is selected, the user is redirected to this URL.

    Customer domain name and Customer domain ID - Customer domain name and ID are used to create an app URL and other subsequent URLs in the SAML SSO page.

    For example, if you are adding a Salesforce app, your domain name is salesforceformyorg and ID is 123754, then the app URL is Customer domain name and Customer ID fields are specific to certain apps.


    Unqualified domains are not supported.

    Related Domains – The related domain is auto-populated based on the URL that you have provided. Related domain helps the service to identify the URL as part of the app and route traffic accordingly. You can add more than one related domain.

    Icon – Click Change to change the app icon. The icon file size must be 128x128 pixels. If you do not change the icon, the default icon is displayed.

    To change the icon

  6. In the Enhanced Security section, select Enable enhanced security to choose the security options you would like to apply to the application.


    The Enhanced Security section is available only if you are entitled to Secure Workspace Access service. For details, see

    • The following enhanced security options can be enabled for the application.

      • Restrict clipboard access: Disables cut/copy/paste operations between the app and system clipboard
      • Restrict printing: Disables ability to print from within the Citrix Workspace app browser
      • Restrict navigation: Disables the next/back app browser buttons
      • Restrict downloads: Disables the user’s ability to download from within the app
      • Display watermark: Displays a watermark on the user’s screen displaying the user name and IP address of the user’s machine


      Restrict Navigation is not supported with the Citrix Workspace Browser. For details, see Citrix Workspace Browser.

      Enhanced security options

    • Select Launch application always in Citrix Secure Browser service to always launch an application in Secure Browser service regardless of other enhanced security settings.


      • The other enhanced security options are still enforced once the app is launched inside the Secure Browser.

      • If you are accessing the app from the Citrix Workspace app or from the Citrix Workspace for web, then the app is launched in the embedded browser or the native browser respectively until the policy is enforced on mobile devices.

    • Select Enforce policy on mobile device to enable the previously mentioned enhanced security options on your mobile device.


      When Enforce Policy on Mobile Device is selected along with Enable enhanced security, the user experience for the application access is negatively impacted for the desktop users and the mobile users.

  7. Select your preferred single sign-on type to be used for your application and click Save. SAML and Don’t use SSO single sign-on types are available.

    Save the configuration

    SAML: Enter the following details for the SAML single sign-on section and click Save.

    • Sign Assertion - Signing assertion or response ensures message integrity when the response or assertion is delivered to the relying party(SP). You can select Assertion, Response, Both, or None.

    • Assertion URL – Assertion URL is provided by the application vendor. The SAML assertion is sent to this URL.

    • Relay State – The Relay State parameter is used to identify the specific resource the users access after they are signed in and directed to the relying party’s federation server. Relay State generates a single URL for the users. Users can click this URL to log on to the target application.

    • Audience – Audience is provided by the application vendor. This value confirms the SAML assertion is generated for the correct application.

    • Name ID Format – Select the supported name identifier format.

    • Name ID – Select the supported name ID.

    Don’t use SSO – Use the Don’t use SSO option when you do not need to authenticate a user on the back-end server. When you select Don’t use SSO option the user is redirected to the URL configured under the App details section.

  8. Download the metadata file by clicking the link under SAML Metadata. Use the downloaded metadata file to configure SSO on the SaaS apps server.


    • You can copy the SSO login URL under Login URL and use this URL when configuring SSO on the SaaS apps server.
    • You can also download the certificate from the Certificate list and use the certificate when configuring SSO on the SaaS apps server.
  9. Click Finish.

After you click Finish, the app is added to the library and you are presented with the following three options.

  • Add Another App
  • Edit App
  • Go to the Library

Assign users or user groups for the published apps

After an app is published, you can assign users or groups to the app.

  1. On the Citrix Cloud screen, click Go to the Library. Alternatively, you can also click Library in the upper left menu.

    Go to library

    Notice that the newly added app features in your library.

    Apps added to library

  2. To assign users for the app, hover your pointer over the ellipses on the right, and click Manage Subscribers.

    Manage subscribers

  3. Click Choose a domain list and select a domain. Click Choose a group or user and assign users.

    Assign users or groups


    A subscribed user can be unsubscribed by selecting the user and clicking the delete icon next to Status.

  4. To obtain the Workspace URL to be shared with app users, on Citrix Cloud, click the menu icon and navigate to Workspace Configuration.

    Obtain workspace url

Manage published apps

You can edit or delete a published app, and add more subscribers to the published app.

Edit a published app

To edit a published app, perform the following steps:

  1. Go to Library and identify the app to be edited.

  2. Hover your pointer over the ellipses on the right and click Edit.

    Edit a published app

  3. Edit the entries under the App Details section and click Save.

    Save the edits

  4. Edit the entries under the Single Sign On section, click Save, and click Finish.

  5. The following screen appears indicating that the app has been modified.

    Confirmation on modified app

Delete a published app

To delete a published app, perform the following steps:

  1. Go to Library and identify the app to be deleted.
  2. Click the dot icon on the right and click Delete.

Manage subscribers for published app

To add more subscribers, perform the following steps:

  1. Go to Library and identify the app to be modified.
  2. Hover your pointer over the ellipses on the right, and click Manage Subscribers.

Launch a configured app - end-user flow

To launch a configured app, perform the following steps:

  1. Log on to Citrix Workspace with AD user credentials. The admin configured apps are displayed.
  2. Click the app to launch the app. The app is launched and the user is signed-in to the app.
Support for Software as a Service apps