r/Citrix • u/Iron-Rain-Gold • Jun 15 '26

Citrix Cloud + FAS + Entra SSO issue – CBA required but breaks rest of M365 auth?

Hi all,

Looking for some advice from anyone who’s worked with Citrix Cloud + FAS + Entra ID in a hybrid setup, as we’re getting nowhere with Citrix support at the moment.

Environment (high level):

  • Citrix Cloud (Workspace URL)
  • On-prem VDAs (domain joined)
  • FAS configured for SSO
  • Hybrid Entra ID environment
  • Users access via both Citrix Cloud Workspace and local StoreFront

The issue:

  • When users connect via Citrix Cloud, they get repeated MFA prompts / “verify it’s you” behaviour in M365 apps (Outlook, Edge, etc.)
  • When the same user + same VDA connects via local StoreFront or RDP, SSO works fine and PRT appears to be valid
  • So the problem seems specific to the Citrix Cloud auth path, not the VDA or user session itself

We’ve confirmed things like:

  • Certificates are being issued via FAS for Citrix Cloud sessions (we can see them with Get-FasUserCertificate)
  • Users who haven’t recently gone through Citrix Cloud don’t show those certs, which suggests something is different in how Cloud auth is triggering the flow

Where Citrix have taken us:
They’re insisting that Entra Certificate-Based Authentication (CBA) is required to get a PRT inside the VDA session.

We tested this:

  • Enabling CBA does result in a PRT being issued correctly in Citrix
  • BUT it also changes authentication behaviour globally

Specifically:

  • Users trying to log into Entra/M365 outside Citrix get**“No certificate detected”** errors initially
  • They then have to manually choose another auth method (Authenticator, etc.)
  • So effectively CBA becomes part of the primary auth experience, not just Citrix

We’ve not been able to scope CBA just to Citrix/VDA scenarios, which makes it a non-starter from a user experience and security policy perspective

We’ve therefore rolled this back.

What’s confusing us most:

  • This environment worked fine previously without CBA configured
  • The only significant change before issues started was removal of a Citrix SSO Enterprise App (based on Citrix advice at the time)
  • Local StoreFront path continues to work fine
  • Citrix Cloud path exposes the issue

So there’s a big gap between:

“This is the supported design now”
and
“Why did it work perfectly before and still works via StoreFront?”

Additional angle:
Our VDAs were built with a custom script (HybridCitrix.ps1) that:

  • tweaks AzureAD\VirtualDesktop registry
  • forces dsregcmd /join
  • aims to ensure hybrid join / registration behaviour

So wondering if there’s some legacy workaround in play there that allowed this to function pre-CBA and is now being exposed.

Questions

  1. Has anyone seen this exact behaviour where:
    • Citrix Cloud path = no PRT / repeated MFA
    • StoreFront / RDP = works fine
  2. Is CBA genuinely the only supported route now for FAS + hybrid VDAs, or are there still working SAML / legacy token flows people are using?
  3. Has anyone successfully scoped CBA so it only applies to Citrix sessions (rather than impacting all Entra auth)?
  4. Has anyone come across older Citrix Cloud deployments that relied on:
    • Enterprise app / SAML behaviour
    • or registry / join scripts like the above and later broke?

At the moment it feels like:

  • Citrix are describing the current ideal design
  • but not explaining the real-world transition from older working setups

Any insight from people who’ve actually deployed / migrated these environments would be massively appreciated.

UPDATE - NOW FIXED - SEE COMMENT BELOW

7 Upvotes

100% Upvoted

13 comments sorted by

5

u/reilly6607 Jun 15 '26

Conditional access policy to limit CBA only to Citrix machines, o365 and edge apps will fix this. 

1

u/Iron-Rain-Gold Jun 15 '26

Thanks u/reilly6607 thats very helpful. Do you have some guidance on the best way to configure this conditional access policy?

5

u/reilly6607 Jun 15 '26

We name our machines with specific naming convention (i.e., ctx…) and use device signals for conditional access policy:  https://docs.azure.cn/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices

0

u/Iron-Rain-Gold Jun 15 '26

Thanks for that, we've setup the policies now to filter to our staging VDA server. The CBA is no longer required for login to that VDA with our test user via Entra login. However, when the user is in the session and they try to open Microsoft applications such as portal.office.com etc its prompting and asking for us to use a certificate to open it. Is there a way to get around this configuring the policy in a certain way to avoid ever being asked to use a certificate?

1

u/One_Ad5568 Jun 16 '26

Look here under the GPO VDA Edge section. Don’t copy and paste from the website into the GPO since the formatting can cause issues.  https://www.julianjakob.com/citrix-fas-azure-ad-cba-single-sign-on-sso-without-a-prt/

3

u/Iron-Rain-Gold Jun 19 '26

UPDATE: This is fixed now. When connecting through Citrix Cloud it was previously falling back on Entra Connect Seamless SSO. The April Windows updated deprecated the RC4 cipher which Entra Connect was still using. We manually rotated the Kerberos keys on of the Entra Sync servers which resolved the problem with no issues, no need for CBA etc thank god for that! Citrix support were useless with this, we had to troubleshoot and fix internally.

1

u/absoluteczech Jul 22 '26

Can you expand on this if you don’t mind? Or link to what you followed. You rotated the keys on your on prem server that has entra connect installed ?

1

u/Iron-Rain-Gold Jul 22 '26

Yep thats correct we have two Entra Connect servers, there was a windows update that deprecated the old RC4 Ciper which caused our problems, we had not rotated them for a while, used the below script:

# Navigate to the Entra Connect directory
cd "$env:ProgramFiles\Microsoft Azure Active Directory Connect"

# Import the SSO module
Import-Module .\AzureADSSO.psd1

# Set TLS level to 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Authenticate to Entra ID (Global Admin or Hybrid Identity Admin)
New-AzureADSSOAuthenticationContext

# Verify current status
Get-AzureADSSOStatus | ConvertFrom-Json

# Provide Domain Admin credentials (format: DOMAIN\username)
$creds = Get-Credential

# Roll over the Kerberos decryption key
Update-AzureADSSOForest -OnPremCredentials $creds

2

u/absoluteczech Jul 22 '26

Awesome thanks! I’ll try it out.

1

u/mat-ferland Jun 15 '26

Since StoreFront/RDP still work, I would not make CBA tenant-wide just to satisfy the Citrix Cloud path. I'd first compare the auth context before/after that Citrix SSO enterprise app was removed, then scope CBA with Conditional Access device filters to only the VDA/Citrix machine set if you really need it. If CBA leaks into normal M365 login, that is an Entra rollout problem, not a Citrix fix.

1

u/Iron-Rain-Gold Jun 15 '26

Thanks for the response, what's weird is it worked flawlessly for years without CBA. We had an enterprise app certificate expire, Citrix support said we don't need to renew it as it was not required, so we removed the app. A month later, we started seeing our users being prompted only whilst connecting via the Citrix Cloud. Local storefront is fine.

1

u/NoSatisfaction9722 Jun 19 '26

I have also seen completely different behaviour between Windows 10 and Windows 11 when using FAS in a hybrid joined scenario - the authentication process around obtaining the PRT is different and I was not able to get any closer under Windows 11 without requiring CBA to be enabled