Citrix Secure Access Endpoint Analysis (EPA) client distribution and upgrade

This topic describes the supported ways to distribute and upgrade the Citrix Secure Access Endpoint Analysis client. The information captured here applies to both managed and unmanaged Windows devices, and to both cloud (Device Posture service) and on-premises (NetScaler® Gateway) deployments.

Note:

In this topic, EPA refers to the Citrix Secure Access Endpoint Analysis (EPA) client. The two terms are used interchangeably.

Citrix Secure Access Endpoint Analysis (EPA) client distribution and upgrade methods

Detailed configuration steps

Bundled with the Citrix Workspace app release

The Citrix Secure Access Endpoint Analysis client is bundled with Citrix Workspace app. Therefore, installing or upgrading Citrix Workspace app automatically installs or upgrades the EPA client.

1. Track the availability of Citrix Workspace app in the Citrix Workspace app release notes.

2. Distribute Citrix Workspace app through your usual channel: Citrix Workspace app auto-update, manual download, or a mobile device management (MDM) tool.

   During installation, the bundled Citrix Secure Access Endpoint Analysis client is installed or upgraded. No separate action is required.

Applicability: Cloud and on-premises. Managed and unmanaged devices, where end users install or update Citrix Workspace app themselves.

Citrix Workspace app auto-update (Client App Management)

The Citrix Workspace app auto-update service upgrades the Citrix Secure Access Endpoint Analysis client when the Citrix Endpoint Analysis plug-in is enabled in Client App Management. The Client App Management control is named Citrix Endpoint Analysis plug-in, and the client that it upgrades appears in the Windows control panel as Citrix Secure Access Endpoint Analysis.

1. Open the Client App Management console. For cloud, see Configure the Global App Configuration service (cloud). For on-premises, see Configure the Global App Configuration service (StoreFront).
2. Enable the Citrix Endpoint Analysis plug-in for auto-update.

3. Ensure that the configured version targets the required Citrix Secure Access Endpoint Analysis version.

   The Citrix Workspace app auto-update service automatically upgrades the EPA client on eligible endpoints through the Citrix Workspace app updater service.

   The configured versions are shown in the download option in the portal, and the end users download and install or upgrade the client themselves.

Applicability: Cloud and on-premises. Managed and unmanaged devices.

Push the installer using SCCM, Intune, Jamf, or another endpoint management tool

For managed endpoints, administrators can distribute the Citrix Secure Access Endpoint Analysis installer by using SCCM, Intune, Jamf, or another endpoint management tool.

1. Download the Citrix Secure Access Endpoint Analysis installer from Citrix Downloads.
2. Package the installer in your endpoint management platform.
3. Deploy the package to the required managed Windows devices by using your standard software distribution process.
4. Validate the installed version from the Windows Control Panel or from your management inventory.

Applicability: Cloud and on-premises. Managed devices only.

Set a minimum EPA client version in the Device Posture service console

In the Device Posture service console, you can set a minimum EPA client version. Clients running a lower version see a download option in the portal, allowing end users to install or upgrade the client.

1. In the Device Posture service console, set the Endpoint Analysis (EPA) client minimum version to your target version (for example, 26.5.1.7). For details, see EPA client version management through Device Posture service.

   At the next posture evaluation, clients running a lower version see a download option in the portal.

2. The end users download and install or upgrade the client.

   Note:

   Install with administrator privileges. Otherwise the install runs in user mode and some features might not be available.

Note:

This method prompts the end user to update the client. It does not enforce a silent or automatic upgrade.

Applicability: Cloud only. Managed and unmanaged devices, where the end user is typically the administrator.

Upload the plug-in to the NetScaler Gateway portal

You can upload the Citrix Secure Access Endpoint Analysis plug-in to the NetScaler Gateway portal. At logon, the gateway prompts users to download or upgrade the client.

For the configuration steps, see How users connect with the NetScaler Gateway plug-in.

Note:

This method only detects and prompts. End users can decline the action, and it does not enforce a silent self-install.

Install with administrator privileges. Otherwise, the client installs in user mode, and some features might not be available.

Applicability: On-premises. Managed and unmanaged devices, with the same detect-and-prompt behavior.

Considerations when the EPA client is used with NetScaler and Device Posture service

When an EPA client is used together with the Device Posture service and NetScaler, there might be scenarios where the end device is running the latest EPA client version whereas NetScaler is on a different version of the EPA client. This mismatch might cause NetScaler to prompt the end user to install the EPA client version that is present on NetScaler. To avoid this conflict, we recommend the following configuration changes:

• If you have configured EPA with adaptive authentication, on-premises authentication, or a gateway virtual server, we recommend that you disable version control of the EPA client on NetScaler. This ensures that the Client App Management (GACS) or Device Posture service does not push the latest version of the EPA client to the end devices.

• You can set the EPA version control to Never by using the CLI or the GUI. These configuration changes are supported on NetScaler 13.x and later versions.

  • CLI: Use the CLI commands for the adaptive authentication and on-premises authentication virtual servers.
  • GUI: Use the GUI for the on-premises gateway virtual server. For details, see Control upgrade of Citrix Secure Access clients.

Sample CLI commands:

add rewrite action <rewrite_action_name> insert_http_header Plugin-Upgrade "\"epa_win:Never;epa_mac:Always;epa_linux:Always;vpn_win:Never;vpn_mac:Always;vpn_linux:Always;\""

add rewrite policy <rewrite_action_policy> "HTTP.REQ.URL.CONTAINS(\"pluginlist.xml\")" <rewrite_action_name>

bind authentication vserver <Authentication_Vserver_Name> -policy <rewrite_action_policy> -priority 10 -type RESPONSE
<!--NeedCopy-->