This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Hybrid Azure Active Directory joined
Note:
Since July 2023, Microsoft has renamed Azure Active Directory (Azure AD) to Microsoft Entra ID. In this document, any reference to Azure Active Directory, Azure AD, or AAD now refers to Microsoft Entra ID.
This article describes the requirements to create Hybrid Azure Active Directory (HAAD) joined catalogs using Citrix DaaS in addition to the requirements outlined in the Citrix DaaS system requirements section.
Hybrid Azure AD joined machines use on-premises AD as the authentication provider. You can assign them to domain users or groups in on-premises AD. To enable Azure AD seamless SSO experience, you need to have the domain users synced to Azure AD.
Note:
Hybrid Azure AD joined VMs are supported in both federated and managed identity infrastructures.
Requirements
- VDA type: Single-session (desktops only) or multi-session (apps and desktops)
- VDA version: 2212 or later
- Provisioning type: Machine Creation Services (MCS), Persistent and Non-persistent
- Assignment type: Dedicated and pooled
- Hosting platform: Any hypervisor or cloud service
Limitations
- If Citrix Federated Authentication Service (FAS) is used, single sign-on is directed to on-premises AD rather than Azure AD. In this case, it is recommended to configure Azure AD certificate-based authentication so that the primary refresh token (PRT) is generated upon user logon, which facilitates single sign-on to Azure AD resources within the session. Otherwise, the PRT will not be present and SSO to Azure AD resources will not work. For information on achieving Azure AD single sign-on (SSO) to hybrid joined VDAs using Citrix Federated Authentication Service (FAS), see Hybrid-joined VDAs.
- Do not skip image preparation while creating or updating machine catalogs. If you want to skip image preparation, make sure the master VMs are not Azure AD or Hybrid Azure AD joined.
Considerations
- Creating hybrid Azure Active Directory joined machines requires the
Write userCertificate
permission in the target domain. Make sure that you enter credentials of an administrator with that permission during catalog creation. -
The hybrid Azure AD joining process is managed by Citrix. You need to disable
autoWorkplaceJoin
controlled by Windows in the master VMs as follows. The task of manually disablingautoWorkplaceJoin
is only required for VDA version 2212 or earlier.- Run
gpedit.msc
. - Navigate to Computer Configuration > Administrative Templates > Windows Components > Device Registration.
- Set Register domain joined computers as devices to Disabled.
- Run
-
Select the Organizational Unit (OU) that is configured to be synced with Azure AD when you create the machine identities.
-
For Windows 11 22H2 based master VM, create a scheduled task in the master VM that executes the following commands at system startup using SYSTEM account. This task of scheduling a task in the master VM is only required for VDA version 2212 or earlier.
$VirtualDesktopKeyPath = 'HKLM:\Software\AzureAD\VirtualDesktop' $WorkplaceJoinKeyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin' $MaxCount = 60 for ($count = 1; $count -le $MaxCount; $count++) { if ((Test-Path -Path $VirtualDesktopKeyPath) -eq $true) { $provider = (Get-Item -Path $VirtualDesktopKeyPath).GetValue("Provider", $null) if ($provider -eq 'Citrix') { break; } if ($provider -eq 1) { Set-ItemProperty -Path $VirtualDesktopKeyPath -Name "Provider" -Value "Citrix" -Force Set-ItemProperty -Path $WorkplaceJoinKeyPath -Name "autoWorkplaceJoin" -Value 1 -Force Start-Sleep 5 dsregcmd /join break } } Start-Sleep 1 } <!--NeedCopy-->
Where to go next
For more information on creating Hybrid Azure Active Directory joined catalogs, see Create Hybrid Azure Active Directory joined catalogs.
Share
Share
In this article
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.