Microsoft Entra single sign-on Azure configuration
In order to leverage Microsoft Entra single sign-on, you must first allow Microsoft Entra authentication for Windows in your Microsoft Entra ID tenant, which enables issuing the required authentication tokens that allow users to sign in to the Microsoft Entra joined and Microsoft Entra hybrid joined session hosts. To achieve this, you must do the following:
-
Register the Citrix applications (Resource app and Client app) in your Microsoft Entra ID tenant.
-
Enable the Remote Desktop Security Configuration for the Citrix resource application.
-
Add the Citrix client application as an approved client for the Citrix resource application.
-
\[Optional\] Hide the user consent prompt dialog.
-
Create a Kerberos server object.
-
Review Microsoft Entra Conditional Access policies.
The person making the Azure configuration must be assigned one of the following Microsoft Entra built-in roles or equivalent at a minimum:
If you wish to complete the Azure configuration via PowerShell, you will need to use the Microsoft Graph PowerShell SDK. You can also leverage Microsoft Graph API with a tool like Graph Explorer.
Instructions are provided for how to complete the configuration with both PowerShell and Graph Explorer.
PowerShell configuration
If you choose to use the Microsoft Graph PowerShell SDK, please note:
-
You will need to use the Azure Cloud Shell with the PowerShell terminal type, or run PowerShell 7.x on your local system, and ensure your Azure context is set to the subscription that you want to use.
-
You will need to install the Microsoft Graph PowerShell SDK v1.0 module (Microsoft.Graph) and the beta application module (Microsoft.Graph.Beta.Applications).
Enable Remote Desktop Security Configuration
After you register the Citrix applications, you must enable the Remote Desktop Security Configuration in the Citrix Resource application.
-
Import the Authentication and Application Microsoft Graph modules and connect to Microsoft Graph with the
Application.Read.AllandApplication-RemoteDesktopConfig.ReadWrite.Allscopes:Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Applications
Import-Module Microsoft.Graph.Beta.Applications
Connect-MgGraph -Scopes "Application.Read.All","Application-RemoteDesktopConfig.ReadWrite.All" -
Get the object ID for the service principals associated with the app registrations:Citrix Cloud US, EU, APS
$CtxResourceSpId = (Get-MgServicePrincipal -Filter "AppId eq '3a510bb1-e334-4298-831e-3eac97f8b26c'").Id
$CtxClientSpId = (Get-MgServicePrincipal -Filter "AppId eq '85651ebe-9a8e-49e4-aaf2-9274d9b6499f'").IdCitrix Cloud Japan$CtxResourceSpId = (Get-MgServicePrincipal -Filter "AppId eq '0027603f-364b-40f2-98be-8ca4bb79bf8b'").Id
$CtxClientSpId = (Get-MgServicePrincipal -Filter "AppId eq '0fa97bc0-059c-4c10-8c54-845a1fd5a916'").Id -
Set the property
isRemoteDesktopProtocolEnabledtotrue:If ((Get-MgServicePrincipalRemoteDesktopSecurityConfiguration -ServicePrincipalId $CtxResourceSpId) -ne $true) {
Update-MgServicePrincipalRemoteDesktopSecurityConfiguration -ServicePrincipalId $CtxResourceSpId -IsRemoteDesktopProtocolEnabled
} -
Confirm the property
isRemoteDesktopProtocolEnabledis set totrue:Get-MgServicePrincipalRemoteDesktopSecurityConfiguration -ServicePrincipalId $CtxResourceSpId
Approve the client application
You must explicitly add the Citrix Client application as an approved client in the Citrix Resource application.
-
Create an
approvedClientAppobject:$acp = New-Object -TypeName Microsoft.Graph.Beta.PowerShell.Models.MicrosoftGraphApprovedClientApp
$acp.Id = $CtxClientSpId -
Add the client app to the
approvedClientAppobject:New-MgBetaServicePrincipalRemoteDesktopSecurityConfigurationApprovedClientApp -ServicePrincipalId $CtxResourceSpId -BodyParameter $acpThe output should be similar to this:Id DisplayName
-- -----------
87654321-wxyz-1a2b-3c4d-1029384756af Citrix-Workspace
Hide the user consent prompt dialog
By default, users are prompted to allow the Remote Desktop connection when connecting to a Microsoft Entra joined or Microsoft Entra hybrid joined session host with Microsoft Entra single sign-on enabled, in which they must select Yes to allow single sign-on. Microsoft Entra will remember up to 15 unique session hosts for 30 days before prompting again.
You can hide this dialog by configuring a list of target devices. To configure the list of devices, you must create one or more groups in Microsoft Entra ID that contain the Microsoft Entra joined and/or Microsoft Entra hybrid joined session hosts and then authorize the groups in the resource application, up to a maximum of 10 groups.
NOTE
It is highly recommended to create a dynamic group to simplify the membership management for the group. While dynamic groups normally update within 5-10 minutes, large tenants can take up to 24 hours.
Dynamic groups requires the Microsoft Entra ID P1 license or Intune for Education license. For more information, see Dynamic membership rules for groups.
Once the groups have been created, follow these steps:
-
Get the object ID (OID) of the group that contains the session hosts for which you want to hide the Remote Desktop connection prompt.
-
Create a
targetDeviceGroupobject:$tdg = New-Object -TypeName Microsoft.Graph.PowerShell.Models.MicrosoftGraphTargetDeviceGroup
$tdg.Id = "<groupOID>" -
Add the client app to the
approvedClientAppobject:New-MgServicePrincipalRemoteDesktopSecurityConfigurationTargetDeviceGroup -ServicePrincipalId $CtxResourceSpId -BodyParameter $tdgThe output should be similar to this:Id DisplayName
-- -----------
87654321-wxyz-1a2b-3c4d-1029384756af Entra-SSO-Desktops -
If you later need to remove a device group from the targetDeviceGroup object, run the following command:
Remove-MgServicePrincipalRemoteDesktopSecurityConfigurationTargetDeviceGroup -ServicePrincipalId $CtxResourceSpId -TargetDeviceGroupId "<groupOID>"
NOTE
You can repeat these steps to add more groups if needed, up to a maximum of 10 groups.
Microsoft Graph API configuration
Enable Remote Desktop Security Configuration
After you register the Citrix applications, you must enable the Remote Desktop Security Configuration in the Citrix Resource application.
-
Get the object ID (OID) for the service principals associated with the app registrations from the Azure portal:
-
Navigate to Microsoft Entra ID > Enterprise Applications.
-
Remove the
Application typefilter if set so all applications are listed. -
Search for
Citrix-Workspace-Resource/Citrix-Workspace-Resource-JPand note the associated object ID for the Resource application. -
Search for
Citrix-Workspace/Citrix-Workspace-JPand note the associated object ID for the client application.
-
-
In Graph Explorer, sign in with an account from the target Azure tenant that has the required permissions.
-
Set the following query:
-
HTTP request method: PATCH
-
Microsoft Graph API Version: v1.0
-
Query:
https://graph.microsoft.com/v1.0/servicePrincipals/<resourceAppOID>/remoteDesktopSecurityConfiguration -
Request body:
{
"@odata.type": "#microsoft.graph.remoteDesktopSecurityConfiguration",
"isRemoteDesktopProtocolEnabled": true
}
-
-
Select the Modify Permissions tab and ensure that you have consented to the
Application.ReadWrite.Allpermission. -
Run the query.
See remoteDesktopSecurityConfiguration resource type for reference.
Approve the client application
You must explicitly add the Citrix Client application as an approved client in the Citrix Resource application.
Set the following query and run it:
-
HTTP request method: POST
-
Microsoft Graph API Version: v1.0
-
Query:
https://graph.microsoft.com/v1.0/servicePrincipals/<resourceAppOID>/remoteDesktopSecurityConfiguration/approvedClientApps -
Request body:
{
"@odata.type": "#microsoft.graph.approvedClientApp",
"id": "<clientAppOID>"
}
Hide the user consent prompt dialog
By default, users are prompted to allow the Remote Desktop connection when connecting to a Microsoft Entra joined or Microsoft Entra hybrid joined session host with Microsoft Entra single sign-on enabled, in which they must select Yes to allow single sign-on. Microsoft Entra will remember up to 15 unique session hosts for 30 days before prompting again.
You can hide this dialog by configuring a list of target devices. To configure the list of devices, you must create one or more groups in Microsoft Entra ID that contain the Microsoft Entra joined and/or Microsoft Entra hybrid joined session hosts and then authorize the groups in the resource application, up to a maximum of 10 groups.
NOTE
It is highly recommended to create a dynamic group to simplify the membership management for the group. While dynamic groups normally update within 5-10 minutes, large tenants can take up to 24 hours.
Dynamic groups requires the Microsoft Entra ID P1 license or Intune for Education license. For more information, see Dynamic membership rules for groups.
Once the groups have been created, follow these steps:
-
Get the object ID (OID) of the group that contains the session hosts for which you want to hide the Remote Desktop connection prompt.
-
Set the following query and run it:
-
HTTP request method: POST
-
Microsoft Graph API Version: v1.0
-
Query:
https://graph.microsoft.com/v1.0/servicePrincipals/<resourceAppOID>/remoteDesktopSecurityConfiguration/targetDeviceGroups -
Request body:
{
"@odata.type": "#microsoft.graph.targetDeviceGroup",
"id": "<groupOID>"
}
-
NOTE
You can repeat these steps to add more groups if needed, up to a maximum of 10 groups.
If you later need to remove a device group from the targetDeviceGroup object, set the following and run the query:
-
HTTP request method: DELETE
-
Microsoft Graph API Version: v1.0
-
Query:
https://graph.microsoft.com/beta/servicePrincipals/<resourceAppOID>/remoteDesktopSecurityConfiguration/targetDeviceGroups
See targetDeviceGroup resource type for reference.
Create a Kerberos server object
If your session hosts are Microsoft Entra hybrid joined, you must configure a Kerberos server object in the Active Directory domain where the user and computer accounts reside. See Create a Kerberos Server object for details.
Review Microsoft Entra Conditional Access policies
If you use or plan to use Microsoft Entra Conditional Access policies, review the configuration applied to the Citrix Resource application and the Citrix Client application to ensure users have the intended sign‑in experience.
For detailed guidance on configuring Conditional Access when using Microsoft Entra single sign‑on for DaaS, refer to the Microsoft documentation. Remember that the required Conditional Access settings must be applied to the Citrix Resource application or Citrix Client application, not the Microsoft applications.