Citrix SecurAccess™ ZTNA use cases
Citrix Aidrien™ is your intelligent assistant designed to simplify and accelerate policy review, access modeling, and access troubleshooting within your Citrix SecurAccess™ ZTNA™ deployment. Instead of paging through the Citrix SecurAccess™ ZTNA admin console to correlate applications with the access policies that govern them, you can ask Citrix Aidrien in natural language and get an answer grounded in your own configuration.
Citrix Aidrien reads your Citrix SecurAccess™ ZTNA configuration. It does not create, modify, delete, reorder, enable, or disable any application or access policy. Every change it recommends is one you apply yourself in the Citrix SecurAccess™ ZTNA admin console.
Note:
-
Citrix SecurAccess™ ZTNA environment context requires a Citrix SecurAccess™ ZTNA entitlement in Citrix Cloud, and the Citrix SecurAccess™ ZTNA service must be available to your administrator account. If the Citrix SecurAccess™ ZTNA tile is grayed out for you in the Citrix Cloud console, Citrix SecurAccess™ ZTNA prompts are not offered and Citrix SecurAccess™ ZTNA questions are answered from published documentation only.
-
Citrix Aidrien honors your administrator permissions. It surfaces only the applications and access policies that your own administrator account is allowed to read.
Citrix SecurAccess™ ZTNA environment data
Citrix Aidrien supports three categories of Citrix SecurAccess™ ZTNA environment data.
Applications
Citrix Aidrien lists and searches the applications configured in Citrix SecurAccess™ ZTNA, so you can audit your application inventory without exporting it. For each application it can report the name, description, type (
web, saas, ztna for TCP/UDP applications, and sic), URL and related URLs, destinations, category and keywords, single sign-on method (none, basic, saml, kerberos, form, nosso), whether agentless access is enabled, whether the application is restricted to a secure browser launch, whether enhanced security is enforced on mobile devices, whether the application is hidden, the number of access policies that reference it, the state, and when it was created.
Results can be paginated, sorted by type, name, URL, or state, searched by a substring of the name, and filtered by type or by whether agentless access is enabled.
Access policies and access rules
Citrix Aidrien lists and searches your access policies in the order in which they are evaluated, and expands each policy into its access rules. For each access policy it can report the name, description, whether it is enabled, the applications it targets, and its priority. For each access rule it can report the name, description, whether it is enabled, its position within the policy, whether it allows or denies, the conditions it matches on, and the restrictions it applies when it matches.
Conditions include users and groups, device platform (PC, mobile, or any), and contextual tags from Network Location Service, Citrix Analytics Service risk scoring, Endpoint Analysis device posture, geographic location, third-party device posture providers, and contextual sources. Restrictions include redirecting the launch to a secure browser and the enhanced security settings applied to the session.
User and group conditions are expressed as claims — values carrying an
OID:, SID:, EMAIL:, or UPN: prefix. This is the same form that access evaluation takes as input, so a claim you read out of an access policy can be fed straight back into the modeling described in the next section.
Results can be paginated, sorted by priority, name, description, or enabled state, searched by a substring of the name, restricted to a chosen set of fields, and filtered to the access policies that target a specific application.
Note:
Citrix Aidrien reports access policy and access rule priority using the same consecutive numbers you see in the Priority column of the Citrix SecurAccess™ ZTNA admin console, so the order it describes matches the order you see on screen. Disabled access policies occupy a position in that order just as they do in the console.
Access evaluation (policy modeling)
Citrix Aidrien evaluates what a given user or group would actually be able to reach, by running your current access policies against a target you describe. You provide the target yourself: its claims and identity provider details, the device platform, and any conditions you want to model — geographic location, network location, device posture, risk score, workspace URL, and scheduled-time session conditions.
Citrix Aidrien can evaluate three ways:
| Mode | What you ask about | What you provide |
|---|---|---|
| All applications | Every application configured for your organization | Target and conditions only |
| Single web or SaaS application | One application identified by its FQDN URL | The application URL, for example https://app.example.com |
| Single TCP/UDP (ZTNA) application | One application identified by destination | destination:port and the protocol, TCP, or UDP |
For each application in scope the result reports the outcome — allowed, denied, allowed with restrictions, no policy found, or no policy matched — together with the access policy and access rule that produced it, the priority at which that policy was evaluated, the routing information for the application, and whether the target is blocked outright. That is the answer to "why", not just "whether".
Note:
-
You supply the target's claims and identity provider details. Citrix Aidrien evaluates your access policies against what you give it; it does not look the identity up for you.
-
Access evaluation is a point-in-time model of your current configuration against the conditions you describe. It is not a record of a real user session, and it does not read live session, connection, or usage telemetry.
Use cases
Citrix Aidrien offers Citrix SecurAccess™ ZTNA starter prompts in the Try a prompt prompt library of the chat interface, grouped under three headings. Select Citrix SecurAccess™ ZTNA from the product list to see them. You can use a starter prompt as it stands, or edit it to match your environment — replace the quoted placeholders such as
"group name" and "application name" with your own values.
Applications & policies
Review what is configured in your deployment: the applications you have published, the access policies that govern them, and how the two fit together.
Starter prompts:
-
List applications — "Can you list my Citrix SecurAccess™ ZTNA applications?"
-
List access policies — "Can you list my Citrix SecurAccess™ ZTNA policies?"
-
Configuration summary — "Can you give me a summary of my configured Citrix SecurAccess™ ZTNA applications and policies?"
Policy review
Examine your access policies for the problems that are hard to spot by the eye: policies that overlap and resolve in an order you did not intend, policies that grant access with no location condition attached, a policy that already covers a group you were about to write a new one for, and the policy responsible for denying access to an application.
Starter prompts:
-
Conflicting policies — "Are there any Citrix SecurAccess™ ZTNA policies colliding with one another that should be prioritized correctly?"
-
Missing location rules — "Are there any Citrix SecurAccess™ ZTNA policies without location restrictions?"
-
Reusable group policy — "Is there any existing Citrix SecurAccess™ ZTNA policy for the group "group name" that I can reuse, or should I create a new one?"
-
Policies blocking an app — "Are there any Citrix SecurAccess™ ZTNA policies blocking application "application name"?"
Note:
Citrix Aidrien reports what your configuration does and highlights where it may not match your intent. It never changes a priority, a policy, or a rule. Apply any change yourself in the Citrix SecurAccess™ ZTNA admin console.
Access troubleshooting
Find out what a group or user can actually reach under your current access policies, and why one user is denied an application that another user can open.
Starter prompts:
-
Group application access — "Which Citrix SecurAccess™ ZTNA applications does the group "group name" have access to based on the configured access policies?"
-
User access simulation — "Give me the Citrix SecurAccess™ ZTNA applications available or denied to "user name". This user is under IDP "IDP name", in domain and forest "ad domain", and has claims "claims"."
-
User blocked from an app — "A Citrix SecurAccess™ ZTNA user who belongs to "group name" is blocked from accessing application "application name", while another user, "user name", is able to access it. What is going wrong? Any suggestions to fix this?"
Access Citrix SecurAccess™ ZTNA data in Aidrien
| Data type | Description | Example query |
|---|---|---|
| Applications | Search and view configured applications, their type, URL, single sign-on method, and access settings | "Can you list my Citrix SecurAccess™ ZTNA applications?" |
| Access policies | Search and view access policies in evaluation order, with their rules, conditions, and restrictions | "Can you list my Citrix SecurAccess™ ZTNA policies?" |
| Access evaluation | Model which applications a target is allowed or denied, and which access policy and rule decided it | "What Citrix SecurAccess™ ZTNA applications does the group "group name" have access to based on the configured access policies?" |
Prerequisites
Before you can use the Citrix SecurAccess™ ZTNA use cases in Citrix Aidrien, make sure the following requirements are met.
-
Citrix Aidrien is enabled for your organization in Citrix Cloud, and your administrator account has access to it. See Citrix Aidrien overview.
-
Your organization has a Citrix SecurAccess™ ZTNA entitlement, and the Citrix SecurAccess™ ZTNA service is available to your administrator account in Citrix Cloud.
-
Your administrator account has permission to read Citrix SecurAccess™ ZTNA applications and access policies.
No setup is required in the Citrix SecurAccess™ ZTNA admin console itself.
Limitations
-
Read-only. Citrix Aidrien does not modify your Citrix SecurAccess™ ZTNA configuration. It cannot create, update, delete, reorder, enable, or disable an application or an access policy.
-
Configuration, not telemetry. Citrix SecurAccess™ ZTNA environment context covers your configuration and the access outcomes modeled from it. Live session, connection, and usage data is not available to Citrix Aidrien.
-
Access evaluation is a model. Results reflect your current configuration evaluated against the conditions you describe, not a replay of an actual access attempt.
-
You supply the target details. Access evaluation needs the target's claims and identity provider details. Citrix Aidrien does not resolve a user or group by name on your behalf — take the claims from the access policies that already reference that user or group, or from your identity provider.
-
Your permissions apply. Citrix Aidrien only returns the applications and access policies your own administrator account can read. Two administrators with different scopes can receive different answers to the same question.
-
Phased availability. Citrix SecurAccess™ ZTNA capabilities are enabled progressively. If a capability is not yet enabled for your organization, Citrix Aidrien reports that the requested capability is not enabled rather than returning a partial answer.
Share your feedback
Use the Thumbs Up/Down icons at the end of each response within the Citrix Aidrien chat interface, or email the Citrix Aidrien team at citrix.copilot@cloud.com for questions, suggestions, feature requests, or to report issues.