Prerequisites and Configuration

Last published : Oct 15, 2026
Related information
FIDO2 and WebAuthn authentication

Supportability matrix

Session host operating system Web application authentication UWP application authentication
Windows Server 2016 Supported via USB redirection Not supported
Windows Server 2019 Supported Not supported
Windows Server 2022 Supported Supported
Windows Server 2025 Supported Supported
Windows 10 Supported Supported
Windows 11 Supported Supported
Note:
Support for the authentication methods listed above depends on the capabilities of the underlying operating system. For example, UWP applications are not supported on Windows Server 2019 due to an OS limitation.
For additional information, please review the requirements below.

Web application authentication

Requirements

The following are the requirements for using FIDO2 and WebAuthn authentication with web applications:

Citrix® control plane

  • Citrix Virtual Apps and Desktops™ 2203 or later

Session host

  • Operating system
    • Windows 10 22H2 or later
    • Windows 11
    • Windows Server 2019 or later
  • VDA
    • Windows: version 2203 or later

Client device

  • Operating system
  • Workspace app
    • Windows: version 2402 or later
    • Linux: 2303 or later
    • Mac: 2307 or later

Web browser requirements

  • 32-bit and 64-bit browsers

Authentication methods supported

  • FIDO2 Security Key
  • Windows Hello
    • TPM 2.0
    • Integrated biometrics
      • Facial recognition
      • Fingerprint scanner
    • WebAuthn
  • Passkeys
Note:
  • Support for the authentication methods listed above depends on the capabilities of the underlying client operating system.
  • Passkeys are not supported on Windows 10 client devices and/or session hosts.

UWP application authentication

With the release of Citrix Virtual Apps and Desktops™ 2112, Citrix supports WebAuthn and FIDO2 authentication in UWP applications.
Applications such as Microsoft Teams, Microsoft Outlook for Office 365 and OneDrive use a UWP application for authentication as a link to Microsoft Entra ID. Citrix now supports using FIDO2 to authenticate those applications.

Requirements

The following are the requirements for using FIDO2 and WebAuthn authentication with UWP applications:

Citrix control plane

  • Citrix Virtual Apps and Desktops 2112 or later

Session host

  • Operating system
    • Windows 10 22H2 or later
    • Windows 11
    • Windows Server 2022 or later
  • VDA
    • Windows: version 2203 or later

Client device

  • Operating system
  • Workspace app
    • Windows: version 2402 or later
    • Linux: 2303 or later
    • Mac: 2307 or later
UWP application requirements
  • 32-bit and 64-bit applications

Authentication methods supported

  • FIDO2 Security Key
  • Windows Hello
    • TPM 2.0
    • Integrated biometrics
      • Facial recognition
      • Fingerprint scanner
    • WebAuthn
    • Passkeys
Note:
Support for the authentication methods listed above depends on the capabilities of the underlying operating system.
In scenarios where FIDO2 redirection is not available because the feature is not supported by the client or VDA or the operating system, USB based FIDO2 keys can be redirected using USB redirection. It is also possible to use USB redirection to redirect USB based FIDO2 keys in scenarios where FIDO2 redirection is available. In this case, you must disable FIDO2 redirection and configure the appropriate USB redirection rules. Please refer to the USB redirection device rules documentation for details on how to configure FIDO2 keys using USB redirection rules.

Configuration

FIDO2 redirection is enabled by default. No additional configuration is required to authenticate to applications running in Chrome, Edge, Brave and Firefox browsers. For information about relevant policy settings, see FIDO2 redirection settings.
For enterprises using any other applications that require FIDO2 authentication, additional configuration in the registry is needed. For more information, see Advanced configuration.
Note:
FIDO2 redirection is supported in double-hop scenarios as long as the Citrix Workspace App for Windows installed on the intermediate hop VDA is version 2503 or later. Additionally, this is only supported when the 2nd hop connection is over ICA.