Scenario 3
This scenario covers how to enable App Protection based on Device Posture results.
-
Configure Device Posture service:
-
Sign in to Citrix Cloud.
-
Navigate to Identity and Access Management > Device Posture and click Manage.
-
Click Create device policy.
Create devicy policy page appears.
-
Under Policy rules, click the Select Rule drop-down menu and select Citrix Workspace app Version.
-
Click the Select a rule drop-down menu and select Greater or equal to >=.
-
Enter the Citrix Workspace app version that you want to set as the condition. In this example, it is 23.7.0.19.
-
Under Policy result, select Compliant.
-
In the Name field, enter a name for the policy.
-
In the Priority field, enter the priority of the policy.
-
Select the Enable when created checkbox to enable the policy since you created it.
-
Click Create.
-
-
Configure the Broker Access policy rules:
-
Install the Citrix PowerShell SDK and connect to the cloud API as explained in the Citrix blog Getting started with PowerShell automation for Citrix Cloud.
-
Run the command
Get-BrokerAccessPolicyRule.A list of all the broker access policies for all the delivery groups which are present is displayed.
-
Find the DesktopGroupUid for the delivery group that you want to change.
-
Get the policies that are applied only to a particular delivery group using the command:
Get-BrokerAccessPolicyRule -DesktopGroupUid 7 -
To apply App Protection to the compliant devices, run the following command:
Set-BrokerAccessPolicyRule "Contextual App Protection Delivery Group_AG" -IncludedSmartAccessFilterEnabled $true -IncludedSmartAccessFilterEnabled Workspace:COMPLIANT -
To apply App Protection to the non-compliant devices, run the following command:
New-BrokerAccessPolicyRule "Contextual App Protection Delivery Group_AG_NonCompliant"-DesktopGroupUid 7 -AllowedConnections ViaAG -AllowedProtocols HDX, RDP -Enabled $true -AllowRestart $true -ExcludedSmartAccessFilterEnabled $true -ExcludedSmartAccessTags Workspace:COMPLIANT-IncludedSmartAccessFilterEnabled $true
-
-
Verification:
Sign out of Citrix Workspace app. Sign in from a Citrix Workspace app version that is compliant with the device policy. You see that the App Protection policies are not applied. Again, sign out from the Citrix Workspace app and sign in from a Citrix Workspace app version that is not complaint with the device policy. You see that the App Protection policies are applied.