Deploy from Azure Marketplace

Last published : Nov 10, 2026
Citrix SecurSpaces™ Community Edition is available in Azure Marketplace as a managed application. The deployment creates an Azure Kubernetes Service (AKS) cluster in your own subscription, installs SecurSpaces on it, and serves it over HTTPS on a hostname you choose.
Community Edition is free of license fees and supports up to 20 users and 10 workspaces. Your Azure subscription is billed for the resources the deployment creates. For what the edition includes, see Community Edition.
Related information
Deploy
Prerequisites for Azure MarketplaceObtain a certificateAfter the deploymentCommunity EditionRenew the TLS certificateUninstall

The deployment sequence

  1. Check the prerequisites. On the Contributor path, arranging your own TLS certificate can take a day or two. The Owner path obtains its certificate automatically after DNS delegation. See Prerequisites.
  2. Create the managed application in the Azure portal, as described on this page.
  3. Create the DNS records and choose the license. See After the deployment.

Choose how the TLS certificate is provided

The first question in the wizard is your role on the subscription. It decides how SecurSpaces gets its TLS certificate and what you do after the deployment.
Owner Contributor
Certificate Obtained from Let's Encrypt by the deployment, and renewed automatically You obtain it before you deploy, and you renew it
What the deployment adds An Azure DNS zone for your hostname, an identity for the certificate manager, and one role assignment: DNS Zone Contributor on that zone A Kubernetes Secret built from the certificate you paste into the wizard
DNS records you create afterwards One NS record set, delegating the hostname to the new zone Two CNAME records
Before you start A hostname A hostname, and a certificate for two names. See Obtain a certificate
Contributor together with User Access Administrator works in place of Owner. A Contributor who selects the Owner option fails at the role assignment, after the cluster has been created.
The Marketplace package pins its platform version independently. Redeploying the managed application doesn't upgrade an existing SecurSpaces installation. Check the deployed version before following instructions for features that need SecurSpaces 2026.9.5 or later, such as in-product TLS certificate replacement.

Create the managed application

  1. Open Citrix SecurSpaces Community in Azure Marketplace and select Get it now. In the Azure portal, select the Community Edition plan and select Create.
  2. On the Basics tab:
    1. Select the Subscription and a Resource group, or select Create new.
    2. Select the Region.
    3. Under Your role on this subscription, select Owner - obtain the TLS certificate automatically or Contributor - I bring my own TLS certificate.
    4. Select the confirmation check boxes. They confirm that you have the hostname, and on the Contributor path the certificate. They also confirm that the subscription doesn't enforce policies that block privileged containers or disable AKS local accounts. There isn't a separate NetScaler CPX™ license confirmation.
    5. Enter an Application Name. Keep or change the Managed Resource Group name. The managed resource group holds every resource the application creates.
  3. On the Hostname tab, enter the Platform hostname, for example securspaces.apps.example.com.
    • The hostname must have at least three labels and be a subdomain of a zone you control.
    • On the Owner path, it can be at most 64 characters.
    • On the Contributor path, also paste the full contents of fullchain.pem into TLS certificate (PEM fullchain) and of privkey.pem into TLS private key (PEM).
    Caution:
    The wizard does not mask the private key. It is visible in the box and again on the Review + submit tab. Paste it last, do not share your screen until you have deployed, and clear your clipboard afterwards.
  4. On the Size tab, select an x86-64 (AMD64) Node size. One node is created. Arm64 sizes, such as Standard_D8ps_v6, aren't supported.
    Use Example size Approximate capacity
    Evaluation (default) 8 vCPU, 32 GiB About 2 Small workspaces; Large workspaces don't fit
    Small team 16 vCPU, 64 GiB About 3 Medium workspaces
    Daily team use 32 vCPU, 128 GiB About 7 Medium workspaces
    Each running workspace reserves its full size: Small uses 2 vCPU and 4 GiB, Medium uses 4 vCPU and 8 GiB, and Large uses 6 vCPU and 12 GiB. The platform itself uses about 2.5 vCPU. Community Edition allows 10 workspaces in total, whatever the node size. If your region doesn't offer the _v6 sizes, select an x86-64 _v5 or _v4 size with the same vCPU and memory.
    You can't change the node size after deployment, but you can add nodes with az aks scale. For daily team use, start with at least 16 vCPU. A workspace must fit on an individual node to run.
  5. On the Administrator tab, enter the Administrator email and a password for the first platform administrator.
  6. On the Review + submit tab, check the settings, read the terms, and select Create.
The deployment takes about five minutes. When it reports success, the platform is running, but it is not yet reachable and not yet licensed. Continue with After the deployment.
Note:
If you deploy the package through ARM rather than the wizard, remove acceptIngressLicenseTerms from your parameter file. The template no longer accepts this parameter.

Costs

Community Edition has no license fee. Your subscription is billed for:
  • The AKS node and its disk.
  • The load balancer.
  • On the Owner path, the Azure DNS zone, about USD 0.50 a month.
  • A storage account and a container instance used by the deployment script. They are kept for 26 hours after the deployment finishes, so that a failed deployment still has a log to read.
The AKS control plane runs on the Free tier. It is not charged, and it has no uptime SLA.

Updates and support

An installation stays on the version it was deployed with. Updates and security fixes are not applied to it. New versions are announced in the release notes.
Community Edition does not include Citrix Support. For help, use the SecurSpaces community forum.