Machine identities
Each machine must have a unique machine identity, also known as computer account. Machine identities can be created and managed in the machines locally or in a directory, such as on-premises Active Directory (AD) or Microsoft Entra ID. Citrix supports hosting virtual applications and desktops on machines that are Active Directory joined, Microsoft Entra joined, Microsoft Entra hybrid joined, or non-domain joined.
Machine identity types
The following machine identity types are supported.
| Machine identity type | Description |
|---|---|
| AD joined | Identities are created and managed in on-premises Active Directory. Provisioned machines are joined to on-premises Active Directory using the assigned machine identities. |
| Microsoft Entra joined | Identities are created and managed in Entra ID. Provisioned machines are joined to Entra ID using the assigned machine identities. Importing VMs to Citrix DaaS is not supported. |
| Microsoft Entra hybrid joined | Identities are created in on-premises Active Directory and are synced with Entra ID through Microsoft Entra Connect. Provisioned machines are joined to on-premises Active Directory and Entra ID. The machines are then Entra hybrid joined. For importing an Entra hybrid joined VM, the VM is treated as an Active Directory joined VM by Citrix DaaS. |
| Non-domain-joined | Identities are created and managed in the machines locally. Importing VMs to Citrix DaaS is not supported. |
Supported Configurations
The following are details of the supported configurations for each scenario.
Supported infrastructure
| Machine identity | Citrix DaaS™ | Citrix® StoreFront Cloud | Citrix StoreFront | Citrix Gateway Service | Citrix Gateway |
|---|---|---|---|---|---|
| AD joined | Yes | Yes | Yes | Yes | Yes |
| Microsoft Entra joined | Yes | Yes | Preview | Yes | No |
| Microsoft Entra hybrid joined | Yes | Yes | Yes | Yes | Yes |
| Non-domain-joined | Yes | Yes | Yes | Yes | Yes |
NOTE
Neither Local Host Cache nor Service Continuity are available for Non-domain joined session hosts when using Storefront.
Supported Citrix® StoreFront Cloud authentication identity providers
| Machine identity | Microsoft Entra ID | Active Directory | Active Directory and Token | Okta | SAML | Citrix Gateway | Adaptive Authentication |
|---|---|---|---|---|---|---|---|
| AD joined | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Microsoft Entra joined | Yes | No | No | No | Yes | No | No |
| Microsoft Entra hybrid joined | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Non-domain-joined | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
NOTE
-
If using an identity provider other than Active Directory or Active Directory + Token with AD joined or Entra hybrid joined deployments, you need Citrix Federated Authentication Service (FAS) to achieve single sign-on (SSO) to the virtual app or desktop session. Refer to the FAS documentation for details.
If you plan to use SAML as your identity provider and require access to Microsoft Entra joined session hosts, see the Citrix Cloud documentation for information on configuring SAML with Entra ID identities.