Citrix Virtual Apps and Desktops

Hybrid Azure Active Directory joined

December 20, 2024

Contributed by:

C C

Note:

Since July 2023, Microsoft has renamed Azure Active Directory (Azure AD) to Microsoft Entra ID. In this document, any reference to Azure Active Directory, Azure AD, or AAD now refers to Microsoft Entra ID.

This article describes the requirements to create Hybrid Azure Active Directory (HAAD) joined catalogs using Citrix DaaS in addition to the requirements outlined in the Citrix DaaS system requirements section.

Hybrid Azure AD joined machines use on-premises AD as the authentication provider. You can assign them to domain users or groups in on-premises AD. To enable Azure AD seamless SSO experience, you need to have the domain users synced to Azure AD.

Note:

Hybrid Azure AD joined VMs are supported in both federated and managed identity infrastructures.

Requirements

VDA type: Single-session (desktops only) or multi-session (apps and desktops)
VDA version: 2212 or later
Provisioning type: Machine Creation Services (MCS), Persistent and Non-persistent
Assignment type: Dedicated and pooled
Hosting platform: Any hypervisor or cloud service

Limitations

If Citrix Federated Authentication Service (FAS) is used, single sign-on is directed to on-premises AD rather than Azure AD. In this case, it is recommended to configure Azure AD certificate-based authentication so that the primary refresh token (PRT) is generated upon user logon, which facilitates single sign-on to Azure AD resources within the session. Otherwise, the PRT will not be present and SSO to Azure AD resources will not work. For information on achieving Azure AD single sign-on (SSO) to hybrid joined VDAs using Citrix Federated Authentication Service (FAS), see Hybrid-joined VDAs.
Do not skip image preparation while creating or updating machine catalogs. If you want to skip image preparation, make sure the master VMs are not Azure AD or Hybrid Azure AD joined.

Considerations

Creating hybrid Azure Active Directory joined machines requires the Write userCertificate permission in the target domain. Make sure that you enter credentials of an administrator with that permission during catalog creation.
The hybrid Azure AD joining process is managed by Citrix. You need to disable autoWorkplaceJoin controlled by Windows in the master VMs as follows. The task of manually disabling autoWorkplaceJoin is only required for VDA version 2212 or earlier.
1. Run gpedit.msc.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Device Registration.
3. Set Register domain joined computers as devices to Disabled.
Select the Organizational Unit (OU) that is configured to be synced with Azure AD when you create the machine identities.

For Windows 11 22H2 based master VM, create a scheduled task in the master VM that executes the following commands at system startup using SYSTEM account. This task of scheduling a task in the master VM is only required for VDA version 2212 or earlier.

 $VirtualDesktopKeyPath = 'HKLM:\Software\AzureAD\VirtualDesktop'
 $WorkplaceJoinKeyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin'
 $MaxCount = 60

 for ($count = 1; $count -le $MaxCount; $count++)
 {
   if ((Test-Path -Path $VirtualDesktopKeyPath) -eq $true)
   {
     $provider = (Get-Item -Path $VirtualDesktopKeyPath).GetValue("Provider", $null)
     if ($provider -eq 'Citrix')
     {
         break;
     }

     if ($provider -eq 1)
     {
         Set-ItemProperty -Path $VirtualDesktopKeyPath -Name "Provider" -Value "Citrix" -Force
         Set-ItemProperty -Path $WorkplaceJoinKeyPath -Name "autoWorkplaceJoin" -Value 1 -Force
         Start-Sleep 5
         dsregcmd /join
         break
     }
   }

   Start-Sleep 1
 }
 <!--NeedCopy-->

By default, Azure AD Connect synchronizes every 30 minutes. The provisioned machines can take up to 30 minutes to be hybrid Azure AD joined during the first boot.

Where to go next

For more information on creating Hybrid Azure Active Directory joined catalogs, see Create Hybrid Azure Active Directory joined catalogs.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Hybrid Azure Active Directory joined

December 20, 2024

Contributed by:

C C

December 20, 2024

Contributed by:

C C

Hybrid Azure Active Directory joined

Requirements

Limitations

Considerations

Where to go next

In this article