Citrix SecurSpaces™

Workspace lifecycle and idle detection

September 18, 2026

Contributed by:

Citrix SecurSpaces™ 2026.4 introduces a hybrid idle detection engine that uses multiple signals to determine whether a workspace is truly idle before pausing it. This replaces the previous approach, in which an open SSH connection alone was sufficient to keep a workspace running indefinitely.

How it works

The idle detection engine uses a priority-based approach with three layers:

IDE activity signals (primary)

When the SecurSpaces IDE extension is active in the developer’s IDE, the system uses granular input signals such as keyboard and mouse activity to determine whether a user is present. An open but unused SSH connection alone no longer prevents a workspace from pausing.

This applies to IDEs that support the SecurSpaces extension, including VS Code Desktop, Cursor, Windsurf, and Kiro.

SSH fallback (secondary)

For developers using IDEs that do not support the SecurSpaces extension, the system falls back to the previous SSH-based logic. An active SSH connection continues to signal that the workspace is in use, so active work is not interrupted.

Note

Starting a workspace is not an activity signal. A workspace that is started and then left alone is paused normally once the idle timeout is reached. Starting a workspace does, however, count as use for the Inactive Workspace condition that automatically deletes unused workspaces. See Custom Actions.

Bypass Schedule (manual override)

Security officers and platform administrators can deactivate idle detection for individual workspaces. When Bypass Schedule is enabled for a workspace, the scheduler is bypassed, and the workspace keeps running regardless of detected user activity.

This is intended for long-running services such as shared development tooling or infrastructure components that must remain available continuously.

Bypass Schedule in the Workspace Update Center

The Bypass Schedule column is visible in the platform-level Workspace Update Center (Platform > Workspaces > Workspace Update Center). Each workspace row displays one of two states:

Disabled (default) — The workspace follows the normal idle detection schedule. The workspace pauses automatically after the configured timeout if no activity is detected.
Enabled — The workspace bypasses the schedule and keeps running. A red Disable button appears, allowing administrators to revert.

To enable Bypass Schedule for a workspace, select Enable in the Bypass Schedule column for that workspace.

Workspace Update Center showing the Bypass Schedule column with all workspaces set to Disabled

Workspace Update Center showing one workspace with Bypass Schedule set to Enabled

Permissions

Only security officers and platform administrators can turn Bypass Schedule on or off. This restriction exists because bypassing the schedule directly impacts infrastructure costs.

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

Workspace lifecycle and idle detection

September 18, 2026

Contributed by:

September 18, 2026

Contributed by:

Workspace lifecycle and idle detection

How it works

IDE activity signals (primary)

SSH fallback (secondary)

Bypass Schedule (manual override)

Bypass Schedule in the Workspace Update Center

Permissions

In this article