Create application groups
Introduction
Application groups let you manage collections of applications. You can create application groups for applications shared across different delivery groups or used by a subset of users within delivery groups. Application groups are optional. They offer an alternative to adding the same applications to multiple delivery groups. Delivery groups can be associated with more than one application group, and an application group can be associated with more than one delivery group.
Using application groups can provide application management and resource control advantages over using more delivery groups:
- The logical grouping of applications and their settings lets you manage those applications as a single unit. For example, you don’t have to add (publish) the same application to individual delivery groups one at a time.
- Session sharing between application groups can conserve resource consumption. In other cases, disabling session sharing between application groups may be beneficial.
- You can use the tag restriction feature to publish applications from an application group, considering only a subset of the machines in selected delivery groups. With tag restrictions, you can use your existing machines for more than one publishing task, saving the costs associated with deploying and managing additional machines. A tag restriction can be thought of as subdividing (or partitioning) the machines in a delivery group. Using an application group or desktops with a tag restriction can be helpful when isolating and troubleshooting a subset of machines in a delivery group.
Example configurations
Example 1
The following graphic shows a deployment that includes application groups:
In this configuration, applications are added to the application groups, not the delivery groups. The delivery groups specify which machines will be used. (Although not shown, the machines are in machine catalogs.)
Application group 1 is associated with delivery group 1. The applications in application group 1 can be accessed by the users specified in application group 1, as long as they are also in the user list for delivery group 1. This follows the guidance that the user list for an application group should be a subset (a restriction) of the user lists for the associated delivery groups. The settings in application group 1 (such as application session sharing between application groups, associated delivery groups) apply to applications and users in that group. The settings in delivery group 1 (such as anonymous user support) apply to users in application groups 1 and 2, because those application groups have been associated with that delivery group.
Application group 2 is associated with two delivery groups: 1 and 2. Each of those delivery groups can be assigned a priority in application group 2, which indicates the order in which the delivery groups will be checked when an application is launched. delivery groups with equal priority are load balanced. The applications in application group 2 can be accessed by the users specified in application group 2, as long as they are also in the user lists for delivery group 1 and delivery group 2.
Example 2
This simple layout uses tag restrictions to limit which machines will be considered for certain desktop and application launches. The site has one shared delivery group, one published desktop, and one application group configured with two applications.
Tags have been added to each of the three machines (VDA 101-103).
The application group was created with the “Orange” tag restriction, so each of its applications (Calculator and Notepad) can be launched only on machines in that delivery group that have the tag “Orange”: VDA 102 and 103.
For more comprehensive examples and guidance for using tag restrictions in application groups (and for desktops), see Tags.
Guidance and considerations
Citrix recommends adding applications to either application groups or delivery groups, but not both. Otherwise, the additional complexity of having applications in two group types can make it more difficult to manage.
By default, an application group is enabled. After you create an application group, you can edit the group to change this setting. See Manage application groups.
By default, application session sharing between application groups is enabled. See Session sharing between application groups.
Citrix recommends upgrading your delivery groups to the current version. This requires:
- Upgrading VDAs on the machines used in the delivery group.
- Changing to a higher function level for the machine catalogs containing those machines
- Changing to a higher function level for the delivery group.
For details, see Manage delivery groups.
To use application groups, your core components must be minimum version 7.9.
Creating application groups requires the delegated administration permission of the Delivery Group Administrator built-in role. See Delegated administration for details.
This article refers to “associating” an application with more than one application group to differentiate that action from adding a new instance of that application from an available source. Similarly, delivery groups are associated with application groups (and vice versa), rather than being additions or components of one another.
Session sharing with application groups
When application session sharing is enabled, all applications launch in the same application session. This saves the costs associated with launching additional application sessions, and allows the use of application features that involve the clipboard, such as copy-paste operations. However, in some situations you may wish to turn off session sharing.
When you use application groups you can configure application session sharing in the following three ways which extend the standard session sharing behavior available when you are using only delivery groups:
- Session sharing enabled between application groups.
- Session sharing enabled only between applications in the same application group.
- Session sharing disabled.
Session sharing between application groups
You can enable application session sharing between application groups, or you can disable it to limit application session sharing only to applications in the same application group.
-
An example when enabling session sharing between application groups is helpful:
Application group 1 contains Microsoft Office applications such as Word and Excel. Application group 2 contains other applications such as Notepad and Calculator, and both application groups are attached to the same delivery group. A user who has access to both application groups starts an application session by launching Word, and then launches Notepad. If the user’s existing session running Word is suitable for running Notepad then Notepad is started within the existing session. If Notepad cannot be run from the existing session—for example if the tag restriction excludes the machine that the session is running on—then a new session on a suitable machine is created rather than using session sharing.
-
An example when disabling session sharing between application groups is helpful:
You have a set of applications that do not interoperate well with other applications that are installed on the same machines, such as two different versions of the same software suite or two different versions of the same web browser. You prefer not to allow a user to launch both versions in the same session.
You create an application group for each version of the software suite, and add the applications for each version of the software suite to the corresponding application group. If session sharing between groups is disabled for each of those application groups, a user specified in those groups can run applications of the same version in the same session, and can still run other applications at the same time, but not in the same session. If the user launches one of the different-versioned applications (that are in a different application group), or launches any application that is not contained in an application group, then that application is launched in a new session.
This session sharing between application groups feature is not a security sandboxing feature. It is not foolproof, and it cannot prevent users from launching applications into their sessions through other means (for example, through Windows Explorer).
If a machine is at capacity, new sessions are not started on it. New applications are started in existing sessions on the machine as needed using session sharing (providing that this complies with the session sharing restrictions described here).
You can only make prelaunched sessions available to application groups which have application session sharing allowed. (Sessions which use the session linger feature are available to all application groups.) These features must be enabled and configured in each of the delivery groups associated with the application group. You cannot configure them in the application groups.
By default, application session sharing between application groups is enabled when you create an application group. You cannot change this when you create the group. After you create an application group, you can edit the group to change this setting. See Manage application groups.
Disable session sharing within an application group
You can prevent application session sharing between applications which are in the same application group.
-
An example when disabling session sharing within application groups is helpful:
You want your users to access multiple simultaneous full screen sessions of an application on separate monitors.
You create an application group and add the applications to it. If session sharing is prohibited between applications in that application group, when a user specified in it starts one application after another they launch in separate sessions, and the user can move each to a separate monitor.
By default, application session sharing is enabled when you create an application group. You cannot change this when you create the group. After you create an application group, you can edit the group to change this setting. See Manage application groups.
Create an application group
Use the process of creating an Application Group to create Application Categories in the Citrix Workspace app. Application Categories allow to manage collections of applications in Citrix Workspace.
To create an application group:
- From Studio, select Applications in the left pane, and then select the Application Groups tab.
- To organize application groups using folders, create folders under the Application Groups root folder.
- Select the folder where you want to create the group, and then click Create Application Group. The group creation wizard launches with an Introduction page. You can remove the page from future launches of this wizard.
- Follow the wizard to configure settings on the pages described below. When you are done with each page, select Next until you reach the Summary page.
Step 1. Delivery groups
The Delivery Groups page lists all delivery groups, with the number of machines each group contains.
- The Compatible Delivery Groups list contains delivery groups you can select. Compatible delivery groups contain random (not permanently or statically assigned) server or desktop OS machines.
- The Incompatible Delivery Groups list contains delivery groups you cannot select. Each entry explains why it is not compatible, such as containing static assigned machines.
An application group can be associated with delivery groups containing shared (not private) machines that can deliver applications.
You can also select delivery groups containing shared machines that deliver only desktops, if both of the following conditions are met:
- The delivery group contains shared machines and was created with a XenDesktop version earlier than 7.9.
- You have Edit Delivery Group permission.
The delivery group type is automatically converted to “desktops and applications” when the group creation wizard is committed.
Although you can create an application group that has no associated delivery groups (perhaps to organize applications or to serve as storage for applications not currently used) the application group cannot be used to deliver applications until it specifies at least one delivery group. Additionally, you cannot add applications to the application group from the From Start menu source if there are no delivery groups specified.
The delivery groups you select specify the machines that will be used to deliver applications. Select the check boxes next to the delivery groups you want to associate with the application group.
To add a tag restriction, select Restrict launches to machines with the tag and then select the tag from the dropdown.
Step 2. Users
Specify who can use the applications in the application group. You can either allow all users and user groups in the delivery groups you selected on the previous page, or select specific users and user groups from those delivery groups. If you restrict use to users you specify, then only the users specified in the delivery group and the application group can access the applications in this application group. Essentially, the user list in the application group provides a filter on the user lists in the delivery groups.
Enabling or disabling application use by unauthenticated users is available only in delivery groups, not in application groups.
For information about where user lists are specified in a deployment, see Where user lists are specified.
Step 3. Applications
Good to know:
- By default, new applications you add are placed in a folder named Applications. You can specify a different folder. If you try to add an application and one with the same name already exists in that folder, you are prompted to rename the application you are adding. If you agree with the suggested unique name, the application is added with that new name. Otherwise, you must rename it yourself before it can be added. For details, see Manage application folders.
- You can change an application’s properties (settings) when you add it, or later. See Change application properties. If you publish two applications with the same name to the same users, change the Application name (for user) property in Studio. Otherwise, users will see duplicate names in the Citrix Workspace app.
- When you add an application to more than one application group, a visibility issue can occur if you do not have sufficient permission to view the application in all of those groups. In such cases, either consult an administrator with greater permissions or have your scope extended to include all the groups to which the application was added.
Select the Add dropdown to display the application sources.
-
From Start menu: Applications that are discovered on a machine in the selected delivery groups. When you select this source, a new page launches with a list of discovered applications. Select the check boxes of applications to add, and then select OK.
This source cannot be selected if you selected any of the following:
- Application groups that have no associated delivery groups.
- Application groups with associated delivery groups that contain no machines.
- A delivery group containing no machines.
- Manually: Applications located in the site or elsewhere in your network. When you select this source, a new page launches where you type the path to the executable, working directory, optional command line arguments, and display names for administrators and users. After entering this information, select OK.
- Existing: Applications previously added to the site. When you select this source, a new page launches with a list of discovered applications. Select the check boxes of applications to add and then select OK. This source cannot be selected If the site has no applications.
-
Application packages: Applications in App-V, MSIX, MSIX app attach, or FlexApp application packages. When you select this source, the Add Applications from Packages page launches. Select an application package source, select the applications you want to add from the resulting display, and then select OK
Note:
To publish MSIX or MSIX app attach apps, the delivery group’s functional level must be 2106 or later. For FlexApp apps, the functional level must be 2206 or later. When a functional level requirement isn’t met, the corresponding options in the Application package source dropdown list are dimmed. Note:
On VDA version 2003 and later, publishing App-V packages from HTTP URLs is not supported. You cannot select those applications from the list.
As noted, certain entries in the Add dropdown will not be selectable if there is no valid source of that type. Sources that are incompatible are not listed at all (for example, you cannot add application groups to application groups, so that source is not listed when you create an application group).
Step 4. Scopes
This page appears only if you have previously created a custom scope. By default, the All scope is selected. For more information, see Delegated administration.
Step 5. Summary
Enter a name for the application group. You can also (optionally) enter a description.
Review the summary information and then select Finish.