Citrix Workspace app

Scenario 1

February 28, 2024

Contributed by:

This scenario covers how to disable App Protection for certain device types.

The following are the steps to disable App Protection for iPhone users on a delivery group called Win10Desktop:

Create a Smart Access policy:
1. Sign in to the Citrix ADC Administration UI.
2. On the left navigation menu, go to Citrix Gateway > Virtual Servers.
  
  Note the VPN Virtual Server name, which is needed to configure the Broker Access Policy later on.
3. Click VPN Virtual Server. Scroll to the bottom of the page and click Session policies. A list of session policies appears.
4. Click Add Binding.
5. Click Add to create a session policy.
6. Enter a name for the session policy. In this scenario, it is temp.
7. Click Add next to Profile to specify a Profile name. Click Create.
8. Click Expression Editor from the Session policy window.
9. Create the following expression to check for iPhone in the User Agent string:
```
HTTP.REQ.HEADER("User-Agent").CONTAINS("iPhone")

```
10. Click Bind to create the session policy.
Create Broker access policy rules:

To apply the policy for iPhone users accessing Win10Desktop through the access gateway, do the following steps:
1. Run the following command in the Delivery controller (DDC):
```
Get-BrokerAccessPolicyRule

```
  which lists all the Broker Access policies defined in the DDC. In this scenario, the Broker Access policies for the delivery group Win10Desktop are Win10Desktop_AG and Win10Desktop_Direct. Note the desktop group UID of the delivery group for the next step.
2. Create a broker access policy rule for Win10Desktop to filter iPhone users coming through the access gateway using the following command:
```
New-BrokerAccessPolicyRule -Name Win10Desktop_AG_iPhone -DesktopGroupUid <Uid_of_desktopGroup> -AllowedConnections ViaAG -AllowedProtocols HDX, RDP -AllowedUsers AnyAuthenticated -AllowRestart $true -AppProtectionKeyLoggingRequired $false -AppProtectionScreenCaptureRequired $false -Enabled $true -IncludedSmartAccessFilterEnabled $true

```
  Uid_of_desktopGroup is the DesktopGroupUID of the delivery group got by running the GetBrokerAccessPolicy Rule in step 1.
3. To disable App Protection for Win10Desktop iPhone users coming through the access gateway, reference the Smart Access tag temp created in Step 1. Create Smart Access policy using the following command:
```
Set-BrokerAccessPolicyRule Win10Desktop_AG_iPhone -IncludedSmartAccessTags Primary_HDX_Proxy:temp -AppProtectionScreenCaptureRequired $false -AppProtectionKeyLoggingRequired $false

```
  Primary_HDX_Proxy is the VPN virtual server name from earlier in Step 1, Create Smart Access Policy.
4. To enable App Protection policies for the rest of the Win10desktop users, use the following command:
```
Set-BrokerAccessPolicyRule Win10Desktop_AG -AppProtectionScreenCaptureRequired $true -AppProtectionKeyLoggingRequired $true

```
Verification

For iPhone: Sign out of the Citrix Workspace app, if already open on the iPhone. Sign in to Citrix Workspace app externally through the access gateway connection. You can see the required resources in StoreFront and App Protection has to be disabled.

For devices other than the iPhone: Sign out of the Citrix Workspace app, if already open on the device. Sign in to Citrix Workspace app externally through an access gateway connection. You can see the required resources in the StoreFront and App Protection has to be disabled.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Scenario 1

February 28, 2024

Contributed by:

February 28, 2024

Contributed by:

Scenario 1

In this article