Citrix DaaS

Azure AD service accounts

An Azure AD service account is a container to store application ID and secret of an Azure AD service principal which has sufficient permissions to manage Azure AD joined or Microsoft Intune enrolled devices. MCS can use this service account to automatically clean any stale Azure AD or Microsoft Intune devices generated during the lifecycle of the provisioned machines.

Permissions required for an Azure AD service principal

The permissions required for an Azure AD service principal used by a service account depend on the capabilities enabled for the service account.

  • For the service account with Azure AD joined devices management capability, the Azure AD service principal must have Device.ReadWrite.All permission in your Azure AD tenant.
  • For the service account with Microsoft Intune enrolled devices management capability, the Azure AD service principal must have DeviceManagementManagedDevices.ReadWrite.All permission in your Azure AD tenant.

Limitation

Azure AD role-based access control is currently not supported. Therefore, assign the Azure AD permissions directly to the service principal.

Create an Azure AD service account

Use Studio or PowerShell to create an Azure AD service account.

Prerequisite

To create an Azure AD service account, make sure to complete the following task:

  • Create an Azure AD principal in your Azure AD tenant with sufficient permissions based on the capabilities that you want to enable the service account with.

Use Studio

  1. In the DaaS tile, click Manage.
  2. In the left pane, select Administrators.
  3. In the Service Accounts tab, click Create Service Account.
  4. On the Identity Type page, select Azure Active Directory. Click Next.
  5. On the Credentials page, enter the Azure AD tenant ID, Application ID and Client secret and set the credential expiration date.
  6. Choose the capabilities for the service account.
  7. Select one or more scopes for the service account.
  8. Enter a friendly name and a description (optional) for the service account.
  9. Click Finish to complete the creation.

Note:

  • The capability of Azure AD joined devices management is selected by default and you cannot deselect it.
  • To use a multitenant Azure AD application which is invited to your tenant, the Azure AD tenant ID you entered must be your own tenant ID rather than the home tenant ID of the application.

Use PowerShell

Alternatively, you can use PowerShell commands to create an Azure AD service account. For example:

$tenantId = xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
$applicationId = xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
$applicationSecret = xxxxxxxxxxxxxxx
$credential = ConvertTo-SecureString -String $applicationSecret -AsPlainText -Force

New-AcctServiceAccount -IdentityProviderType AzureAD -IdentityProviderIdentifier $tenantId -AccountId $applicationId -AccountSecret $credential -SecretExpiryTime 2030/08/15 -Capabilities @("AzureADDeviceManagement","IntuneDeviceManagement") -DisplayName 'MyApplication' -Description 'Service account for Azure AD tenant'
<!--NeedCopy-->

Migrate Azure AD joined device management to service account

Previously, Citrix provided an option to enable Azure AD joined device management when creating or editing a hosting connection to Microsoft Azure Resource Manager. MCS used the permissions of the Azure AD service principal (provisioning SPN) stored along with the hosting connection to manage the stale Azure AD joined device. With service accounts, you can use a dedicated Azure AD service principal (identity management SPN) stored along with a service account to manage Azure AD joined or Microsoft Intune enrolled devices.

Citrix recommends migrating from hosting connection powered device management to service account powered device management to separate the responsibility of provisioning SPN and identity management SPN.

For any existing hosting connections that are already enabled with Azure AD joined device management, you can disable it as follows:

  1. From Studio, select Hosting in the left pane.
  2. Select the connection and then select Edit Connection in the action bar.
  3. On the Connection Properties page, clear the Enable Azure AD joined device management checkbox.
  4. Click Save to apply the changes.

Note:

Currently, you cannot enable Azure AD joined device management when creating a new hosting connection.

Where to go next

Azure AD service accounts