Deploy from Azure Marketplace

Last published : Oct 22, 2026
Citrix SecurSpaces™ Community Edition is available in Azure Marketplace as a managed application. The deployment creates an Azure Kubernetes Service (AKS) cluster in your own subscription, installs SecurSpaces on it, and serves it over HTTPS on a hostname you choose.
Community Edition is free of license fees and supports up to 20 users and 10 workspaces. Your Azure subscription is billed for the resources the deployment creates. For what the edition includes, see Community Edition.
Related information
Deploy
Prerequisites for Azure MarketplaceObtain a certificateAfter the deploymentCommunity EditionRenew the TLS certificateUninstall

The deployment sequence

  1. Check the prerequisites. One of them, your own TLS certificate, can take a day or two to arrange. See Prerequisites.
  2. Create the managed application in the Azure portal, as described on this page.
  3. Create the DNS records and choose the license. See After the deployment.

Choose how the TLS certificate is provided

The first question in the wizard is your role on the subscription. It decides how SecurSpaces gets its TLS certificate and what you do after the deployment.
Owner Contributor
Certificate Obtained from Let's Encrypt by the deployment, and renewed automatically You obtain it before you deploy, and you renew it
What the deployment adds An Azure DNS zone for your hostname, an identity for the certificate manager, and one role assignment: DNS Zone Contributor on that zone A Kubernetes Secret built from the certificate you paste into the wizard
DNS records you create afterwards One NS record set, delegating the hostname to the new zone Two CNAME records
Before you start A hostname A hostname, and a certificate for two names. See Obtain a certificate
Contributor together with User Access Administrator works in place of Owner. A Contributor who selects the Owner option fails at the role assignment, after the cluster has been created.

Create the managed application

  1. Open Citrix SecurSpaces Community in Azure Marketplace and select Get it now. In the Azure portal, select the Community Edition plan and select Create.
  2. On the Basics tab:
    1. Select the Subscription and a Resource group, or select Create new.
    2. Select the Region.
    3. Under Your role on this subscription, select Owner - obtain the TLS certificate automatically or Contributor - I bring my own TLS certificate.
    4. Select the confirmation check boxes. They confirm that you have the hostname, and on the Contributor path the certificate. They also confirm that the subscription does not enforce policies that block privileged containers or disable AKS local accounts, and that you accept the NetScaler CPX™ license terms presented with the offer.
    5. Enter an Application Name. Keep or change the Managed Resource Group name. The managed resource group holds every resource the application creates.
  3. On the Hostname tab, enter the Platform hostname, for example securspaces.apps.example.com.
    • The hostname must have at least three labels and be a subdomain of a zone you control.
    • On the Owner path, it can be at most 64 characters.
    • On the Contributor path, also paste the full contents of fullchain.pem into TLS certificate (PEM fullchain) and of privkey.pem into TLS private key (PEM).
    Caution:
    The wizard does not mask the private key. It is visible in the box and again on the Review + submit tab. Paste it last, do not share your screen until you have deployed, and clear your clipboard afterwards.
  4. On the Size tab, select the node size. One node is created.
    Use Example size Approximate capacity
    Trying it out 4 vCPU, 16 GiB, for example Standard_D4s_v6 About 3 concurrent workspaces
    Testing (default) 8 vCPU, 32 GiB, for example Standard_D8s_v6 About 11 concurrent workspaces
    Daily use by a small team 16 vCPU, 64 GiB, for example Standard_D16s_v6 About 25 concurrent workspaces
    The capacity figures assume the default workspace size of 500m vCPU, and fall in proportion as the workspace size grows. Community Edition allows 10 workspaces in total, whatever the node size. If your region does not offer the _v6 sizes, select the _v5 or _v4 size with the same vCPU and memory.
    You cannot change the node size after deployment, but you can add nodes with az aks scale. If a workspace does not fit on the node, its pod stays in Pending and the platform does not report why.
  5. On the Administrator tab, enter the Administrator email and a password for the first platform administrator.
  6. On the Review + submit tab, check the settings, read the terms, and select Create.
The deployment takes about five minutes. When it reports success, the platform is running, but it is not yet reachable and not yet licensed. Continue with After the deployment.

Costs

Community Edition has no license fee. Your subscription is billed for:
  • The AKS node and its disk.
  • The load balancer.
  • On the Owner path, the Azure DNS zone, about USD 0.50 a month.
  • A storage account and a container instance used by the deployment script. They are kept for 26 hours after the deployment finishes, so that a failed deployment still has a log to read.
The AKS control plane runs on the Free tier. It is not charged, and it has no uptime SLA.

Updates and support

An installation stays on the version it was deployed with. Updates and security fixes are not applied to it. New versions are announced in the release notes.
Community Edition does not include Citrix Support. For help, use the SecurSpaces community forum.