Product documentation
Citrix Endpoint Management
View PDF

Authentication with Azure Active Directory through Citrix Cloud

February 26, 2024
Contributed by: 
K C

Citrix Endpoint Management supports authentication with Azure Active Directory (Azure AD) credentials through Citrix Cloud. This authentication method is available only to users enrolling in MDM through Citrix Secure Hub.

To use Citrix Secure Hub with MDM+MAM, configure Citrix Endpoint Management to use NetScaler Gateway for MAM enrollment. For more information, see NetScaler Gateway and Citrix Endpoint Management.

Citrix Endpoint Management uses the Citrix Cloud service, Citrix identity, to federate with Azure Active Directory. Citrix recommends that you use the Citrix identity provider instead of a direct connection to Azure Active Directory.

Citrix Endpoint Management supports authentication with Azure AD for the following platforms:

  • iOS and macOS devices not enrolled in the Apple Business Manager or Apple School Manager
  • iOS and macOS devices enrolled in the Apple Business Manager
  • Android Enterprise devices (preview), for BYOD and fully managed modes

Authentication with Azure AD through Citrix Cloud has these limitations:

  • Isn’t available for Citrix Endpoint Management local accounts.
  • Doesn’t support authentication through Azure AD for enrollment invitations. If you send users an enrollment invitation that has an enrollment URL, users authenticate through LDAP instead of Azure AD.

Prerequisites

  • Azure Active Directory user credentials
  • User groups in Active Directory must match the user groups in Azure Active Directory.
  • User names and email addresses in Active Directory must match the user names and email addresses in the Azure Active Directory.
  • Citrix Cloud account, with Citrix Cloud Connector installed for directory service synchronization.
  • NetScaler Gateway. Citrix recommends that you either enable certificate-based authentication or Azure AD for a full single sign-on experience. If you use LDAP authentication on the NetScaler Gateway for MAM registration, end users experience a dual authentication prompt during enrollment. For more information, see Client certificate or certificate plus domain authentication.
  • In the enrollment profile for Android Enterprise, set Allow users to decline device management to Off. If users decline device management, they can’t enroll using an identity provider to authenticate. For more information, see Enrollment security.

Configure Citrix Cloud to use Azure Active Directory as your identity provider

To set up this service for use with the Citrix Secure Hub, configure Azure Active Directory in Citrix Cloud.

  1. Go to https://citrix.cloud.com and sign in to your Citrix Cloud account.

  2. From the Citrix Cloud menu, go to the Identity and Access Management page and connect to Azure Active Directory.

  3. Type your administrator sign-in URL and then click Connect.

    Citrix Cloud screen

  4. After you sign in, your Azure Active Directory account connects to Citrix Cloud. The Identity and Access Management > Authentication page shows which accounts to use to sign in to your Citrix Cloud and Azure AD accounts.

  5. To enable authentication with Azure AD for users enrolling through the Citrix Secure Hub, under Workspace Configuration > Authentication, select Azure Active Directory. After you complete the configuration, you can enroll user devices through the Citrix Secure Hub.

Configure Citrix identity as the IdP type for Citrix Endpoint Management

This configuration applies only to users enrolling through Citrix Secure Hub. After you configure Azure Active Directory in Citrix Cloud, configure Citrix Endpoint Management as follows.

  1. In the Citrix Endpoint Management console, go to Settings > Identity Provider (IDP) and then click Add.

  2. On the Identity Provider (IDP) page, configure the following:

    • IDP Name: Type a unique name to identify the IdP connection that you’re creating.
    • IDP Type: Choose Citrix Identity Platform.
    • Authentication Domain: Choose Azure Active Directory. This domain corresponds to the Identity provider domain on the Citrix Cloud Workspace Configuration > Authentication page.

  3. Click Next. On the IDP Claims Usage page, configure the following:

    • User Identifier type: By default, this field is set to userPrincipalName. Make sure that you configure all users with the same identifier in both your on-premises Active Directory and in Azure Active Directory. Citrix Endpoint Management uses this identifier to map users on the identity provider with on-premises Active Directory users.
    • User Identifier string: This field is automatically filled.

  4. Click Next, review the Summary page, and then click Save.

    Citrix Secure Hub users, Citrix Endpoint Management console, and Self-Help Portal users can now sign in with their Azure Active Directory credentials. Citrix Secure Hub users who are domain-joined can use Citrix Secure Hub to sign in with their Azure AD credentials. Citrix Secure Hub uses client certificate authentication for MAM devices.

Citrix Secure Hub authentication flow

Citrix Endpoint Management uses the following flow to authenticate users with Azure AD as an IdP on devices enrolled through Citrix Secure Hub:

  1. A user starts Citrix Secure Hub.
  2. Citrix Secure Hub passes the authentication request to Citrix identity, which passes the request to Azure Active Directory.
  3. The user types their Azure Active Directory user name and password.
  4. Azure Active Directory validates the user and sends a code to Citrix identity.
  5. Citrix identity sends the code to Citrix Secure Hub, which sends the code to the Citrix Endpoint Management server.
  6. Citrix Endpoint Management gets an ID token by using the code and secret and then validates the user information that’s in the ID token. Citrix Endpoint Management returns a session ID.
Authentication with Azure Active Directory through Citrix Cloud
February 26, 2024
Contributed by: 
K C
February 26, 2024
Contributed by: 
K C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.