Product Documentation

Create Delivery Groups

Jan 04, 2016

A Delivery Group is a collection of machines selected from one or more Machine Catalogs. The Delivery Group specifies which users can use those machines, plus the applications and/or desktops available to those users.

Creating a Delivery Group is the next step in configuring your deployment after creating a Site and creating a Machine Catalog. Later, you can change the initial settings in the first Delivery Group and create other Delivery Groups. There are also features and settings you can configure only when editing a Delivery Group, not when creating it.

From Studio: 

  • If you have created a Site and a Machine Catalog, but haven't yet created a Delivery Group, Studio will guide you to the correct starting place to create a Delivery Group.
  • If you have already created a Delivery Group and want to create another, select Delivery Groups in the Studio navigation pane, and then select Create Delivery Group in the Actions pane.

The wizard walks you through the items described below.


Select a Machine Catalog and select the number of machines you want to use from that catalog.

Good to know:

  • At least one machine must remain unused in a selected Machine Catalog.
  • A Machine Catalog can be specified in more than one Delivery Group; however, a machine can be used in only one Delivery Group.
  • A Delivery Group can use machines from more than one catalog; however, those catalogs must contain the same machine types (Server OS, Desktop OS, or Remote PC Access). In other words, you cannot mix machine types in a Delivery Group. Similarly, if your deployment has catalogs of Windows machines and catalogs of Linux machines, a Delivery Group can contain machines from either OS type, but not both.
  • Citrix recommends that you install or upgrade all machines with the most recent VDA version, and then upgrade Machine Catalogs and Delivery Groups as needed. When creating a Delivery Group, if you select machines that have different VDA versions installed, the Delivery Group will be compatible with the earliest VDA version. (This is called the group’s functional level.) This means that some features that require later VDA versions might not be available in that Delivery Group. For example, if one of the machines you select has VDA version 7.1 installed and other machines have the current version, all machines in the group can use only those features that were supported in VDA 7.1.
  • Each machine in a Remote PC Access Machine Catalog is automatically associated with a Delivery Group; when you create a Remote PC Access Site, a catalog named “Remote PC Access Machines” and a Delivery Group named “Remote PC Access Desktops” are created automatically.  

Delivery type

Specify what the Delivery Group will offer: only desktops, only applications, or both desktops and applications. Delivery Groups containing static Desktop OS machines cannot offer both desktops and applications. 


Specify the users and user groups who can use the applications and desktops in the Delivery Group.

Where user lists are specified

Active Directory user lists are specified when you create or edit the following:

  • A Site’s user access list, which is not configured through Studio. By default, the application entitlement policy rule includes everyone; see the PowerShell SDK BrokerAppEntitlementPolicyRule cmdlets for details.
  • Delivery Groups.
  • Applications.

The list of users who can access an application through StoreFront is formed by the intersection of the above user lists. For example, to restrict the ability to launch “Application A” to users in the Finance Department, you could:

  • Use the default application entitlement policy rule that includes everyone.
  • Configure the Delivery Group user list to allow all users to use any of the applications specified in the Delivery Group.
  • Configure Application A’s properties to restrict its visibility to only Finance Department users. 

Authenticated and unauthenticated users

There are two types of users: authenticated and unauthenticated (unauthenticated is also called anonymous). You can configure one or both types in a Delivery Group.

  • Authenticated: To access applications and desktops, the users and group members you specify by name must present credentials such as smart card or user name and password to StoreFront or Citrix Receiver. (For Delivery Groups containing Desktop OS machines, you can import user data (a list of users) later by editing the Delivery Group.)
  • Unauthenticated (anonymous): For Delivery Groups containing Server OS machines, you can allow users to access applications and desktops without presenting credentials to StoreFront or Citrix Receiver. For example, at kiosks, the application might require credentials, but the Citrix access portal and tools do not. An Anonymous Users Group is created when you install the first Delivery Controller.

To grant access to unauthenticated users, each machine in the Delivery Group must have a VDA for Windows Server OS (minimum version 7.6) installed. When unauthenticated users are enabled, you must have an unauthenticated StoreFront store.

Unauthenticated user accounts are created on demand when a session is launched, and named AnonXYZ, in which XYZ is a unique three-digit value.

Unauthenticated user sessions have a default idle timeout of 10 minutes, and are logged off automatically when the client disconnects. Reconnection, roaming between clients, and Workspace Control are not supported.

The following table describes your choices on the Users page:

Enable access for

Add/assign users and user groups?

Enable the "Give access to unauthenticated users" check box?

Only authenticated users



Only unauthenticated users



Both authenticated and unauthenticated users




A list of applications appears. Choose one or more applications.

  • If the selected Machine Catalog was created using a master image containing applications, a list of applications discovered on a machine created from that image will appear.
  • If you configured App-V server information and the App-V server has sequenced packages available, a list of those applications will appear.
  • You can also add applications manually. Provide the path to the executable, working directory, optional command line arguments, and display names for administrators and users.

Good to know:

  • You cannot create applications for Remote PC Access Delivery Groups.
  • By default, new applications you add are placed in a folder named Applications. You can specify a different folder. See the Manage applications article for details.
  • You can change an application's properties in the Create Delivery Group wizard or later; see the Manage applications article for details.
  • If you try to add an application, and an application with the same name already exists in the same folder, you are prompted to rename the application you’re adding. If you decline, the application is added with a suffix that makes it unique within that application folder.
  • If you add two applications with the same name to the same users, change the Application name (for user) property; otherwise, users will see duplicate names in Receiver.


Select or add StoreFront URLs that will be used by the Citrix Receiver that is installed on each machine in the Delivery Group. You can also specify the StoreFront server address later by selecting Configuration > StoreFront in the Studio navigation pane.