Configure access to workspaces

Citrix recommends using the latest version of Citrix Workspace app to access workspaces. Citrix Workspace app replaces Citrix Receiver. You can also access workspaces using the latest version of Edge, Chrome, Firefox, or Safari with the Workspace URL.

Important:

Browser support for Internet Explorer ends on March 31, 2022.

Citrix recommends transitioning subscribers to the latest versions of Edge, Chrome, Firefox, or Safari before this date.

This article summarizes the steps involved in configuring and using:

Overview

Subscribers can access Citrix Workspace through a browser with the Workspace URL or through the Citrix Workspace app installed on their devices.

The Workspace URL is customizable and is enabled by default. For instructions on editing the Workspace URL, see Workspace URL in this article.

Citrix Workspace app replaces Citrix Receiver as the natively installed app that provides access to the Workspace user interface (UI). For information about the Citrix Workspace app and transitioning from Citrix Receiver, see Citrix Workspace app (formerly Citrix Receiver) in this article.

Remote subscribers can gain external access to their workspaces if you configure external connectivity with Citrix Gateway or the Citrix Gateway service. For information on enabling remote access to workspaces, see External connectivity in this article.

Alternatively, for internal connectivity only, you can use Citrix Workspace on its own or host StoreFront on-premises. For internal connectivity, the endpoint must connect directly to the IP address of the Virtual Delivery Agent (VDA).

Citrix Workspace supports a growing list of identity providers that you connect to Citrix Cloud and then enable in Workspace Configuration to authenticate subscribers to their workspaces. For information on configuring authentication for Workspace subscribers, see Authentication to workspaces in this article.

Citrix Workspace also supports the following authentication options:

Workspace URL

The Workspace URL is ready to use and can be found in Citrix Cloud > Workspace Configuration > Access, where you can enable, edit, and disable your Workspace URL.

Access console page

Customize the Workspace URL

The first part of the Workspace URL is customizable. For example, you can change the URL from https://example.cloud.com to https://newexample.cloud.com.

You can change the Workspace URL only when it’s enabled. If the URL is disabled, you must re-enable it first.

To enable the Workspace URL, navigate to Workspace Configuration > Access and select the toggle to enable it. Re-enabling the Workspace URL can take up to 10 minutes to take effect.

The first part of the Workspace URL represents the organization using the Citrix Cloud account, and must comply with the Citrix End User Services Agreement. Misuse of third party intellectual property rights, including trademarks, might result in revocation and reassignment of the URL or suspension of the Citrix Cloud account.

To customize your URL, go to Workspace Configuration > Access and select Edit. The customizable part of the URL:

  • Must be between 6 and 63 characters long. If you want to change the customizable part of the URL to fewer than 6 characters, open a ticket in Citrix Cloud.
  • Must consist of only letters and numbers.
  • Can’t include Unicode characters.

When you rename a URL, the old URL is immediately removed and is no longer available.

If you change the Workspace URL, your subscribers can’t access their workspaces until the new URL is active, which takes about 10 minutes. Tell subscribers what the new URL is and manually update all local Citrix Workspace apps to use the new URL.

Disable the Workspace URL

You can disable the Workspace URL to prevent users from authenticating through Citrix Workspace. For example, you might want subscribers to use an on-premises StoreFront URL to access resources, or you might want to prevent access during maintenance.

Workspace URL toggle button

Disabling the Workspace URL can take up to 10 minutes to take effect.

Disabling the workspace URL has the following effects:

  • All service integrations are disabled. Subscribers can’t access data and applications from services in Citrix Workspace.
  • You can’t customize the Workspace URL. You must re-enable the URL before you can change it.
  • Anyone visiting the URL receives a 404 message in their browser.

Citrix Workspace app (formerly Citrix Receiver)

Important:

Citrix Receiver has reached End of Life (EoL) and is no longer supported. If you continue to use Citrix Receiver, technical support is limited to the options described in Lifecycle Milestones and Definitions. For information about EoL milestones for Citrix Receiver by platform, refer to Lifecycle milestones for Citrix Workspace app and Citrix Receiver.

Citrix Workspace app is a natively installed app that replaces Citrix Receiver for accessing workspaces.

Supported authentication methods for Citrix Workspace app

The following table shows the authentication methods supported by Citrix Workspace app. The table includes authentication methods relevant to specific versions of Citrix Receiver, which Citrix Workspace app replaces.

Citrix Workspace app Active Directory Authentication Active Directory plus Token Authentication Azure Active Directory authentication
Citrix Workspace for Windows Yes Yes Yes (Workspace app; Receiver 4.9 LTSR CU2 and later only; Receiver 4.11 CR and later only)
Citrix Workspace for Linux Yes Yes Yes (Workspace app; Receiver 13.8 and later only)
Citrix Workspace for Mac Yes Yes Yes
Citrix Workspace for iOS Yes Yes Yes
Citrix Workspace for Android Yes Yes Yes (Workspace app; Receiver 3.13 and later only)

For more information about supported features in Citrix Workspace app by platform, refer to the Citrix Workspace app feature matrix.

For an overview of TLS and SHA2 support with Citrix Receivers, see the CTX23226 Support article.

Transition from Citrix Receiver to Citrix Workspace app

Citrix Workspace app replaces, and extends the capabilities of, Citrix Receiver.

Citrix Workspace app delivers access for subscribers to SaaS, Web, and virtual apps with a single sign-on (SSO) experience. For information on single sign-on for workspace subscribers, see Enable single sign-on for workspaces with Citrix Federated Authentication Service.

This access control feature isn’t supported in Citrix Receiver. Thus, with the same services and access control enabled, Citrix Receiver users still see the purple UI, but without Web and SaaS apps. Additionally, Files isn’t supported in Citrix Receiver and subscribers can’t access them this way.

Citrix Workspace with Citrix Receiver and access control

Azure Active Directory (AAD) also isn’t compatible with Citrix Receiver. If subscribers attempt to access Workspace with Citrix Receiver when AAD is enabled as the authentication method, they see a message that the device isn’t supported. Once they upgrade to Citrix Workspace app, they can access their workspaces.

Citrix Receiver with AAD

Customers that upgrade to Citrix Workspace app (or use a Web browser) see the new UI. For more information on what the subscriber experience of this UI is, visit Manage your workspace experience.

Aside from a new UI, the Citrix Workspace app allows subscribers to use all the new functionality that you’ve enabled. Subscribers can access Files, see Virtual Apps and Desktops, and access Web and SaaS apps through the Citrix Gateway service.

If you have a StoreFront (on-premises) deployment, upgrading from Citrix Receiver to Citrix Workspace app only changes the icon to open Citrix Workspace app.

Citrix Workspace app with StoreFront on-premises

Note:

Citrix Cloud Government users will continue to see their purple UI when using the Citrix Workspace app or when accessing Workspace from a Web browser.

External connectivity

Provide secure access for remote subscribers by adding Citrix Gateways or the Citrix Gateway service to resource locations.

Citrix supports the following external connectivity options:

  • Citrix hosts Citrix Gateway and Citrix ADC
  • You host Citrix Gateway and Citrix ADC on-premises

You can add Citrix Gateways from Workspace Configuration > Access > External Connectivity or from Citrix Cloud > Resource Locations.

Workspace external access settings

Note:

The External Connectivity part of the Workspace Configuration > Access page isn’t available in Citrix Virtual Apps Essentials. The Citrix Virtual Apps Essentials service uses the Citrix Gateway service, which requires no additional configuration.

Authentication to workspaces

Configuring workspace authentication for subscribers is a two-step process:

  1. Define one or more identity providers for subscribers in Identity and Access Management. For instructions, visit Identity and access management.
  2. Choose the authentication method used by subscribers to sign into their workspaces in Workspace Configuration. For instructions, visit Choose or change authentication methods.

Subscribers can authenticate to their workspaces using one of the following methods:

For more information on supported methods for subscriber authentication to workspaces, visit Secure workspaces.

Active Directory (AD) is the default identity provider used to authenticate subscribers to workspaces. AD requires that you have at least two Citrix Cloud Connectors installed in the on-premises AD domain. For information about Citrix Cloud Connector, visit Citrix Cloud Connector.

You can add a second factor of authentication for subscribers signing in to their workspaces through Active Directory. Workspace subscribers can generate tokens using any app that follows the Time-Based One-Time Password (TOTP) standard, such as Citrix SSO. For information on setting up token-based two-factor authentication, see Two-factor authentication.

You can also use the Citrix Federated Authentication Service to provide single sign-on (SSO) access for workspace subscribers. FAS is typically adopted if you’re using a federated authentication method, such Azure Active Directory. FAS removes the need for additional authentication to Virtual Apps and Desktops after already signing in to Citrix Workspace. For more information about SSO for workspace subscribers, see Enable single sign-on for workspaces with Citrix Federated Authentication Service.

Configure access to workspaces