Product documentation
Citrix Virtual Apps and Desktops
Current Release Service 2507 LTSR 2503 2411 2407 2402 LTSR 2311 2203 LTSR
View PDF

Microsoft Entra hybrid joined

October 13, 2025
Contributed by: 
C

This article describes the requirements to create identity pool of Microsoft Entra hybrid joined catalogs and Microsoft Entra hybrid joined catalogs enrolled in Microsoft Intune in addition to the requirements outlined in the system requirements section.

Microsoft Entra hybrid joined machines use on-premises AD as the authentication provider. You can assign them to domain users or groups in on-premises AD. To enable Microsoft Entra ID seamless SSO experience, you need to have the domain users synced to Microsoft Entra ID.

Note:

Microsoft Entra hybrid joined VMs are supported in both federated and managed identity infrastructures.

Requirements for Microsoft Entra hybrid joined

  • VDA type: Single-session (desktops only) or multi-session (apps and desktops)
  • VDA version: 2212 or later
  • Provisioning type: Machine Creation Services™ (MCS), Persistent and Non-persistent
  • Assignment type: Dedicated and pooled
  • Hosting platform: Any hypervisor or cloud service

Limitations for Microsoft Entra hybrid joined

  • If Citrix Federated Authentication Service (FAS) is used, single sign-on is directed to on-premises AD rather than Microsoft Entra ID. In this case, it is recommended to configure Microsoft Entra certificate-based authentication so that the primary refresh token (PRT) is generated upon user logon, which facilitates single sign-on to Microsoft Entra resources within the session. Otherwise, the PRT will not be present and SSO to Microsoft Entra resources will not work. For information on achieving Microsoft Entra single sign-on (SSO) to hybrid joined VDAs using Citrix Federated Authentication Service (FAS), see Hybrid-joined VDAs.
  • Do not skip image preparation while creating or updating machine catalogs. If you want to skip image preparation, make sure the master VMs are not Microsoft Entra or Microsoft Entra hybrid joined.

Considerations for Microsoft Entra hybrid joined

  • Creating Microsoft Entra hybrid joined machines requires the Write userCertificate permission in the target domain. Make sure that you enter credentials of an administrator with that permission during catalog creation.

  • The Microsoft Entra hybrid joining process is managed by Citrix. You need to disable autoWorkplaceJoin controlled by Windows in the master VMs as follows. The task of manually disabling autoWorkplaceJoin is only required for VDA version 2212 or earlier.

    1. Run gpedit.msc.
    2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Device Registration.
    3. Set Register domain joined computers as devices to Disabled.

  • Select the Organizational Unit (OU) that is configured to be synced with Microsoft Entra ID when you create the machine identities.

  • For Windows 11 22H2 based master VM, create a scheduled task in the master VM that executes the following commands at system startup using SYSTEM account. This task of scheduling a task in the master VM is only required for VDA version 2212 or earlier.

     $VirtualDesktopKeyPath = 'HKLM:\Software\AzureAD\VirtualDesktop'
 $WorkplaceJoinKeyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin'
 $MaxCount = 60

 for ($count = 1; $count -le $MaxCount; $count++)
 {
   if ((Test-Path -Path $VirtualDesktopKeyPath) -eq $true)
   {
     $provider = (Get-Item -Path $VirtualDesktopKeyPath).GetValue("Provider", $null)
     if ($provider -eq 'Citrix')
     {
         break;
     }

     if ($provider -eq 1)
     {
         Set-ItemProperty -Path $VirtualDesktopKeyPath -Name "Provider" -Value "Citrix" -Force
         Set-ItemProperty -Path $WorkplaceJoinKeyPath -Name "autoWorkplaceJoin" -Value 1 -Force
         Start-Sleep 5
         dsregcmd /join
         break
     }
   }

   Start-Sleep 1
 }
 <!--NeedCopy-->
  • By default, Microsoft Entra Connect synchronizes every 30 minutes. The provisioned machines can take up to 30 minutes to be Microsoft Entra hybrid joined during the first boot.

Microsoft Entra hybrid joined catalogs enrolled in Microsoft Intune

Microsoft Entra hybrid joined catalogs, persistent single and multi-session VMs, enrolled in Microsoft Intune use the device credentials with co-management capability.

Co-management enables you to concurrently manage Windows 10 or later devices by using both Configuration Manager and Microsoft Intune. For more information, see Co-management.

Prerequisites for Microsoft Entra hybrid joined catalogs enrolled in Microsoft Intune

Before enabling this feature, verify that:

  • Your Azure environment meets the licensing requirements to use Microsoft Intune. For more information, see the Microsoft documentation.
  • You have a valid Configuration Manager deployment with co-management enabled. For more information, see the Microsoft documentation.

Requirements for Microsoft Entra hybrid joined catalogs enrolled in Microsoft Intune

  • Control plane: Citrix DaaS™
  • VDA type: Single-session or multi-session
  • VDA version: 2407 or later
  • Provisioning type: Machine Creation Service (MCS), Persistent. Microsoft Entra hybrid joined catalogs enrolled in Microsoft Intune for non-persistent single and multi-session VMs is currently under Preview. See Enrollment of Hybrid Entra ID joined non-persistent VMs into Microsoft Intune.
  • Assignment type: Dedicated and pooled
  • Hosting platform: Any hypervisor or cloud service

Limitations for Microsoft Entra hybrid joined catalogs enrolled in Microsoft Intune

  • Do not skip image preparation while creating or updating machine catalogs.
  • Internet-based client management (IBCM) of Configuration Manager is not supported.

Considerations for Microsoft Entra hybrid joined catalogs enrolled in Microsoft Intune

  • Intune enrollment might be delayed if too many machines in the catalog are powered on simultaneously.

    Microsoft imposes a per-tenant Intune enrollment restriction that limits the number of devices that can be enrolled within a specific time frame. The allowable number of devices varies depending on the number of Microsoft Intune licenses associated with the tenant. Consult your Microsoft account team to find out the allowable limit for your tenant. This approach helps Microsoft Intune enrollment scale better for large environments.

    For persistent machines, there might be an initial wait time required for all devices to complete Intune enrollment.

    For non-persistent machines, consider limiting the concurrent power actions in either Autoscale™ or manual power actions.

  • Configure Cloud Attach of Configuration Manager. For more information, see the Microsoft documentation.
  • Manually install Configuration Manager client on the master VM without assigning the site code with .\CCMSetup.exe /mp:SCCMServer /logon FSP=SCCMServer. The SCCMServer is the SCCM server name in your environment. For more information, see the Microsoft documentation.

  • MCS created machines use the automatic site assignment mechanism to find site boundary groups that are published to Active Directory Domain Services. Ensure that the boundaries and boundary groups of Configuration Manager are configured in your environment. If automatic site assignment is not available, a static Configuration Manager site code can be configured in the master VM through the following registry setting:

    Key:

     HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\MachineIdentityServiceAgent\DeviceManagement
 <!--NeedCopy-->

    Value name: MdmSccmSiteCode

    Value type: String

    Value data: the site code to be assigned

Where to go next

For more information on creating identity pool of Microsoft Entra hybrid joined catalogs, see Identity pool of Microsoft Entra hybrid joined machine identity.

Microsoft Entra hybrid joined
October 13, 2025
Contributed by: 
C
October 13, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.