Citrix DaaS

Service accounts for machine identity management

October 10, 2024

Contributed by:

A service account is a container for stored credentials, which is configured and used to perform machine identity related operations without user interaction. Create the service account before the operations that require permissions for machine identity management.

You can configure an MCS machine catalog to use a service account to:

create or delete computer accounts in Active Directory without entering the domain credentials every time.
manage stale Azure AD joined or Microsoft Intune enrolled devices without manually deleting them through the Azure AD or Intune portal.

Supported service account types

Citrix allows the creation of two types of service accounts based on the type of identity provider.

Identity provider type	Description	Credentials
On-premises Active Directory service account	Manages machine catalogs and computer accounts without entering domain credentials every time.	User name and password of an on-premises Active Directory user accounts.
Azure AD service account	Combines a service principal with device management capability to grant permissions for device management.	Application ID and secret of an Azure AD service principal.

Credential protection

Citrix stores the credentials of service accounts in the customer’s site database. In DaaS, the site database is a per tenant (customer) database, which is accessible only by the services running for the customer.

The following actions are also enforced to protect the stored credentials:

The credentials are encrypted using AES 256 encryption before storing into the database.
The encryption key is generated per site and stored in the Delivery Controller locally, which can only be accessed by the services dedicated to the customer.
The connection to the database is encrypted using the TLS 1.2 protocol.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Service accounts for machine identity management

October 10, 2024

Contributed by:

October 10, 2024

Contributed by:

Service accounts for machine identity management

Supported service account types

Credential protection

In this article