Configure workspaces

This article describes how to configure workspaces for subscribers, who might be using one or more services available from Citrix Cloud.


Looking for workspace authentication articles?

Secure workspaces is the new home for information about supported methods for subscriber authentication to workspaces. See the following sections:

For information about single sign-on for workspace subscribers, see Enable single sign-on for workspaces with Citrix Federated Authentication Service.

Administrator access to Workspace Configuration

When you add administrators to your Citrix Cloud account, you define the administrator permissions that are appropriate for their role in your organization. Administrators with Full Access have access to Workspace Configuration by default. Administrators with Custom Access have access only to the functions and services you select.

To enable access to Workspace Configuration:

  1. From the Citrix Cloud menu, select Identity and Access Management and then select Administrators.
  2. Locate the administrator you want to manage, click the ellipsis button, and then select Edit Access. Administrator account with Edit Access menu highlighted
  3. Verify that Custom Access is enabled.
  4. To enable only Workspace Configuration access, under General Management, select Workspace Configuration. Selecting General Management enables all permissions in the group. Custom Access role with Workspace Configuration enabled

After enabling access, administrators sign in to Citrix Cloud and select Workspace Configuration from the Citrix Cloud menu.

Workspace Configuration menu option

Connectivity requirements

The following addresses must be contactable to operate and consume Citrix Workspace:

  • https://*
  • https://*

For a complete list of required contactable addresses for Citrix Cloud services, see Service connectivity requirements.

Workspace URL

In Citrix Cloud > Workspace Configuration > Access, the Workspace URL is ready to use.

Access console page


  • In Citrix Virtual Apps Essentials, Workspace Configuration is available from the Citrix Cloud menu after you create the first catalog.
  • Workspace does not support connections from legacy clients that use a PNAgent URL to connect to resources. If your environment includes these legacy clients, you must instead deploy StoreFront on-premises and enable legacy support. To secure these client connections, use Citrix Gateway on-premises instead of the Citrix Gateway service.

Customize the workspace URL

The first part of the workspace URL is customizable. You can change the URL from, for example,, to


The first part of the workspace URL represents the company or organization using the Citrix Cloud account, and must comply with the Citrix End User Services Agreement. Any misuse of a third party’s intellectual property rights including trademarks may result in the revocation and reassignment of the workspace URL and/or the suspension of the Citrix Cloud account.

From the Citrix Cloud menu, go to Workspace Configuration > Access, and select the Edit link next to the workspace URL.

Guidance for new URLs:

  • The customizable part of the URL (“newexample”) must be between 6 and 63 characters long. If you want to change the customizable part of the URL to fewer than 6 characters, please open a ticket in Citrix Cloud.
  • Must consist of only letters and numbers.
  • Cannot include Unicode characters.
  • When you rename a URL, the old URL is immediately removed and no longer available.
  • If you change the workspace URL, your subscribers cannot access their workspaces until the new URL is active (takes about 10 minutes). You’ll also need to tell them what the new URL is and manually update all local Citrix Receiver apps to use the new URL.
  • You can change the workspace URL only when it is enabled. If the URL is disabled, you must re-enable it first. Re-enabling the workspace URL can take up to 10 minutes to take effect.

Disable the workspace URL

You can disable the workspace URL to prevent users from authenticating through Workspace. For example, you might prefer subscribers use an on-premises StoreFront URL to access resources or you want to prevent workspace access during maintenance periods.

Workspace URL toggle button

Disabling or re-enabling the workspace URL can take up to 10 minutes to take effect. After the workspace URL is disabled, Citrix Cloud parks the domain so it can’t be accessed. Anyone visiting the URL receives a 404 message in their browser.

Disabling the workspace URL has the following effects:

  • All service integrations are disabled. Subscribers will no longer have access to data and applications from all services in Citrix Workspace.
  • You cannot customize the workspace URL. You must re-enable the URL before you can change it.

External connectivity

Provide secure access for your remote subscribers by adding Citrix Gateways or the Citrix Gateway service to the resource locations.

Citrix supports these connectivity options:

  • Citrix hosts Citrix Gateway and Citrix ADC
  • You host Citrix Gateway and Citrix ADC on-premises
  • For internal connectivity only, you host StoreFront on-premises

    For internal connectivity, the endpoint must connect directly to the IP address of the Virtual Delivery Agent (VDA).

You can add Citrix Gateways from Workspace Configuration > Access > External Connectivity or from Citrix Cloud > Resource Locations.

Workspace external access settings


The External Connectivity part of the Workspace Configuration > Access page is not available in Citrix Virtual Apps Essentials. The Citrix Virtual Apps Essentials service uses the Citrix Gateway service, which requires no additional configuration.

Enable and disable services

You can enable or disable the availability of individual service resources from the Service Integrations tab. By default, the Virtual Apps and Desktops service and the Secure Browser service are enabled after you subscribe to them. All other new services that your organization subscribes to are disabled by default.


The Citrix App Essentials service, Citrix Desktop Essentials service, and Citrix Virtual Apps and Desktops service display as “Citrix Virtual Apps and Desktops service” in the Service Integrations tab.

To enable workspace integration for a service

  1. Go to Workspace Configuration > Service Integrations.
  2. Select the ellipsis button next to the service and then select Enable.
  3. To disable integration, select the ellipsis button next to the service and then select Disable.

Service Integrations console page

To disable workspace integration for a service


Disabling workspace integration blocks subscriber access for that service. This does not disable the workspace URL, but subscribers will no longer have access to data and applications from that service in Citrix Workspace.

  1. Go to Workspace Configuration > Service Integrations.
  2. Select the ellipsis button next to the service and then select Disable.
  3. When prompted, click Confirm to acknowledge that subscribers will no longer have access to data or application from the service.

Disable Workspace Access Warning message

Customize the appearance of workspaces

To customize how subscribers see their workspace, change the settings in Workspace Configuration > Customize > Appearance and Save.

Customize console page

Changes to the workspace appearance take effect right away. Local Citrix Receiver apps may take around five minutes for the updated user interface to display.


The Workspace Preview does not show a preview if you are currently working with the older “purple” user interface.

Logo Required Dimensions Max. size Supported formats
Sign-in logo 350 x 120 pixels 2 MB JPEG, JPG, or PNG
After sign-in logo 340 x 80 pixels 2MB JPEG, JPG, or PNG

Logos that do not match the required dimensions may appear distorted.

The Sign-in logo appears on the workspace sign-in form. You can replace the Workspace logo with your own. The colors and branding of the rest of the sign-in page are not affected.

Sign in logo page

Changes to the sign-in logo do not impact users who authenticate to their workspace using Azure Active Directory. For more information on how to add company branding to your sign-in page in Azure AD, see the Microsoft documentation.

The After Sign-in logo appears at the top left of the workspace.

The Content Branding colors change the header background, text and icon color, and the accent color in the workspace.

Customize rollout of new features

In Workspace Configuration > Customize > Features, you can roll out the newest Workspace features gradually so you can ensure the best workspace experience for your subscribers. You can control this rollout by selecting the users and groups who will use the feature. When you’re ready for all subscribers to use the feature, you can enable it easily for everyone.

Actions, Virtual Assistance, and Activity Feed

Enable features that help subscribers save time and accomplish work tasks more effectively, without leaving their workspace in Workspace Configuration > Customize > Features.

Activity feed enabled for all subscribers


Citrix Assistant is currently in internal technical preview and temporarily unavailable to customers. For more information, see support article CTX282428.

Using microapps, you can build integrations from your organization’s application data sources to pull actions from those applications into your subscribers’ workspace. Using microapps, subscribers can take action on work items inside their workspace. For more information, see Getting Started in the Microapps documentation.

Requirements for configuration

Using the Actions, Virtual Assistance, and Activity Feed setting requires the following items:

  • The Microapps service is enabled in Workspace Configuration > Service Integrations.
  • You have subscribed the appropriate users and groups to the microapps that will generate actions in the activity feed. For instructions, see Managing subscribers.
  • To enable the feature for specific users and groups, you must use one of the following authentication methods:
    • Active Directory
    • Active Directory + Token
    • Azure Active Directory
    • Okta

    You can only enable or disable this feature for all microapps subscribers if:

    • You are using Citrix Gateway as an identity provider
    • You are using the Citrix Federated Authentication Service with Citrix Cloud.

Configure the setting

After enabling the setting, choose whether to enable actions, virtual assistance, and activity feeds for all workspace subscribers in your organization with a microapps subscription or only for specific users and groups.

Activity feed enabled for all subscribers

If you select Enable for selected users and groups, select the domain and search for the users and groups who will see the activity feed in their workspace. When you’re finished adding users and groups, click Save.

User and group selection for activity feed

To remove users or groups, under Assign Users and Groups, click the trash can icon for the user or group and then select Remove.

Remove users or groups from activity feed

Preview the workspace

To see what your subscribers’ workspace looks like with and without the activity feed, select Workspace Configuration > Customize > Features > Preview.

Subscriber experience with Actions, Virtual Assistance, and Activity Feed

When enabled, subscribers see personalized alerts and notifications in their Activity feed, in the center of their workspace.

Preview of subscriber workspace

If the subscriber needs to take action on an item, such as approving a request, they can take that action directly in the activity feed. They don’t have to switch to another application to complete actions.

Recommended Actions on the right side of the workspace provide quick access to common actions like submitting expenses or creating a calendar event. These actions are then processed by your organizational systems through the integrations you’ve created in the Microapps service.

The Actions tab on the left side of the workspace displays all the actions available to subscribers with access to microapps. For example, these actions might include links to other organizational systems or intranet sites.

Customize workspace preferences

Customize how subscribers interact with their workspace in Workspace Configuration > Customize > Preferences.

Allow Favorites

Allow Favorites is available to customers who have access to Workspace Configuration and the new workspace experience.

Enabled (default). Workspace subscribers can add favorite apps (up to a maximum of 250) by selecting the star icon.

Workspace Home

Disabled. The Workspace home page is removed and subscribers can’t select apps as favorites. Favorites are not deleted and can be recovered if you re-enable Favorites.


For some existing customers (new to workspace between December 2017 and April 2018), Allow Favorites defaults to Disabled. The administrator can decide when to enable this feature for their subscribers.

Subscribers can add up to a maximum of 250 favorite apps. If a subscriber adds more than 250, the “oldest favorite” app will be removed (or as close as possible to preserve the most recent favorites).

Administrators can automatically add favorite apps for subscribers by using KEYWORDS: Auto and KEYWORDS: Mandatory settings in the Virtual Apps and Desktops service (Manage > Full Configuration > Applications).

  • KEYWORDS: Auto. The application is added as a favorite and subscribers can remove the favorite.
  • KEYWORDS: Mandatory. The application is added as a favorite, but subscribers cannot remove the favorite. Mandatory apps do not display a star icon.

Application Settings Identification

If you use both Mandatory and Auto keywords for an app, the Mandatory keyword overrides the Auto keyword.

For a subscriber with access only to apps that have the Mandatory keyword:

  • The subscriber sees only the Apps page in the left navigation pane in Workspace. The Favorites page doesn’t appear in the left pane because there’s no difference in the apps that appear on the Apps page relative to the Favorites page.
  • The subscriber doesn’t see the Favorites tab on the home page. Only the Recents tab is shown.

    Workspace home page with no Favorites navigation shown

Automatically Launch Desktop

Automatically Launch Desktop is available to customers who have access to Workspace Configuration and the new workspace experience. This preference only applies to workspace access from a browser.

Preferences tab

When disabled (default), the setting prevents Citrix Workspace from automatically starting a desktop when a subscriber signs in. Subscribers must manually launch their desktop after signing in.

When enabled, if a subscriber has only one available desktop, the desktop automatically launches when the subscriber signs in to the workspace. The subscriber’s applications aren’t reconnected, regardless of the workspace control configuration.


To enable Citrix Workspace to launch desktops automatically, subscribers accessing the site through Internet Explorer must add the workspace URL to the Local intranet or Trusted sites zones.

Workspace Sessions

Use the Workspace Sessions preference to specify the amount of idle time allowed (up to a maximum of 8 hours) before subscribers are automatically signed out of Citrix Workspace. This preference applies to browser access only, and does not apply to access from a local Citrix Workspace app.

Workspace session timeout settings

Opening Apps and Desktops

The Opening Apps and Desktops setting is available to customers who have access to Workspace Configuration and the new workspace experience. This preference applies to the way users open apps and desktops delivered by Citrix Virtual Apps and Desktops only (service, or on-premises from the Site aggregation feature). It does not apply to, for example, SaaS apps delivered by the Citrix Gateway service. This preference is available to new and existing customers, however the introduction of this feature will not change any settings for existing customers.

Workspace Preferences settings

Choose one of the following settings:

  • In a native app (default). Uses a locally installed version of Citrix Workspace – gives the best experience for the platform the subscriber is on.
  • In a browser. Uses Citrix Workspace for HTML5 – no client software is required.
  • Let users choose. Prompts subscribers to detect a locally installed version of Citrix Workspace, or to use Citrix Workspace for HTML5 in their browser where possible.

For the In a native app and Let users choose options, there is an additional check box option to guide users to install the latest version of Citrix Workspace if a local app can’t be detected automatically. Removing this selection makes sense if your users don’t have rights to install software.

Configure workspaces