Citrix Virtual Apps and Desktops

Manage policy assignment exceptions

May 27, 2026

Contributed by:

Note:

Starting with version 2511, Citrix Web Studio™ (web-based) is the only management console for Citrix Virtual Apps and Desktops™. Citrix Studio (MMC-based) has been removed from the installer. This article applies only to Web Studio. For information about Citrix Studio, see the equivalent article in Citrix Virtual Apps and Desktops 7 2212 or earlier.

When you assign policies to groups of users, user devices, or machines using filters, some members of the group might need different settings. You can handle these cases without creating entirely separate policies for each individual.

You can make exceptions for certain users or machines within a group by:

Creating a separate policy only for those group members and giving it higher priority
Using the Deny mode for an assignment added to the policy

Use Deny mode for exceptions

An assignment with the mode set to Deny means that the policy applies to connections that don’t match the assignment criteria. For example, a policy includes the following assignments:

Assignment A: Client IP address assignment range 208.77.88.*, mode = Allow.
Assignment B: Specific user account, mode = Deny.

This policy applies to users connecting from the specified IP range, except the user defined in Assignment B.

Note:

In the Assign Policy step, if you clear the Enable checkbox, the assignment is disabled. If a policy has no enabled assignments, it applies to all objects in the site.

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

Manage policy assignment exceptions

May 27, 2026

Contributed by:

May 27, 2026

Contributed by:

Manage policy assignment exceptions

Use Deny mode for exceptions

Related content

In this article