Citrix Virtual Apps and Desktops Service Integration with Microsoft Azure cheat sheet

Azure region pairs are at least 300 miles apart within the same geography; Citrix catalog hosting connections should reference the region pair for VDA redundancy.

Availability Sets cap at 99.95% SLA and require fault domains (default 2, max 3) plus update domains (max 20); Availability Zones give 99.99% and require zone-redundant SKUs.

Azure VM sizes with a suffix 's' (e.g., D4s_v5) support Premium SSD; sizes without 's' on older families may not, which affects MCS cache disk choice.

Temp disk on Azure VMs is ephemeral and lost on deallocation; Citrix MCS write-back cache placed there is discarded on stop/deallocate.

Azure subscription limits: default 10,000 cores per region per subscription for most families, 800 storage accounts per region, 100 NSGs per subscription per region.

Managed disks: Standard HDD, Standard SSD, Premium SSD, Premium SSD v2, Ultra Disk; MCS catalog templates typically use Standard SSD for cost or Premium SSD for performance.

Azure Resource Manager resource locks (CanNotDelete, ReadOnly) apply to the resource group and block Citrix catalog update/delete operations until removed.

Azure Hybrid Benefit and reserved instances (1 or 3 year) reduce compute cost; Citrix PVS/MCS provisioning scripts must not depend on pay-as-you-go licensing metadata.

Azure Compute Gallery (formerly Shared Image Gallery) stores MCS master images with versioning; Citrix requires the image definition to be in the same region as the catalog's hosting connection.

Machine Catalog identity options: Active Directory domain join, Azure Active Directory Domain Services join, or non-domain-joined (Azure AD only, requires Citrix Workspace with Azure AD auth).

MCS provisioning types: full clone (dedicated, persistent) vs. linked clone (shared base disk, non-persistent); Azure MCS uses full clones by default with optional write-back cache.

Write-back cache options in MCS: cache in memory (RAM, lost on reboot), cache on disk (temp disk or Premium disk), or cache in appliance (Citrix Provisioning).

Hosting connection requires an Azure service principal with Contributor at subscription scope or a custom role including Microsoft.Compute/, Microsoft.Network/, Microsoft.Resources/subscriptions/resourceGroups/*.

Design sizing: each VDA needs a unique IP in the VNet subnet; Azure allows /16 to /29 subnets (min 4 usable addresses); plan /24 per 250 VDAs.

Azure Files with SMB for user profiles requires either Azure AD DS, on-prem AD DS with Azure Files AD auth, or kerberos; Citrix Profile Management supports Azure Files as a profile store.

Azure NetApp Files is the supported option for Citrix Provisioning (PVS) store and for high-IOPS profile containers; standard Azure Files is not supported for PVS vDisk store.

Citrix Gateway Service (Citrix-managed) vs. Citrix Gateway on Azure VM: the service removes the need for public IP and TLS termination in the VNet.

Design for Azure SQL for Citrix databases: the Citrix site database must be on a supported SQL edition; Azure SQL Managed Instance is supported, Azure SQL Database single database is not for on-prem CVAD.

MCS catalog creation requires: hosting connection, master image (snapshot or Azure Compute Gallery version), machine profile (optional, for NIC/disk/tags), and identity pool.

Machine profile captures VM size, network interfaces, tags, and diagnostics settings; changes to the profile require catalog update.

MCS power management uses Azure ARM API start/deallocate; 'deallocate' releases compute billing but keeps disks; 'stop' (without deallocate) keeps billing.

Citrix Cloud Connector: deploy at least two per resource location, in the same VNet as the VDAs, outbound TCP 443 to Citrix Cloud and to the on-prem AD.

Master image must have the VDA installed, be sysprepped (or use Citrix image prep), and have the Azure VM agent installed for MCS to work.

Azure MCS supports ephemeral OS disks for non-persistent catalogs; the OS disk is recreated on each provisioning cycle.

Catalog update (image update) uses a rolling schedule; max concurrent operations default 20, configurable per catalog.

Azure AD DS-joined catalogs require the VNet DNS to point to the Azure AD DS domain controllers; MCS provisioning fails if DNS is misconfigured.

Citrix Provisioning on Azure requires a PVS server VM in the same VNet or peered VNet with low latency (<5 ms) to the target devices.

VNet peering is non-transitive; hub-and-spoke requires either Azure Firewall/route server or user-defined routes (UDRs) to reach spokes.

Azure VPN Gateway: Basic SKU max 100 Mbps and no VNet peering support; use VpnGw1+ for production Citrix hybrid connectivity.

ExpressRoute provides private connectivity; Citrix Gateway/StoreFront on-prem can reach Azure VDAs over ExpressRoute with private peering.

Azure Load Balancer (Standard) is required for HA StoreFront/Gateway on Azure; Basic LB is being retired and does not support HA ports or zone redundancy.

Citrix ADC HA in Azure requires an Azure internal load balancer for the floating IP; two NICs (management + data) is the standard design.

NSG rules must allow: 80/443 to Citrix Gateway, 1494/2598 (ICA) to VDAs, 443 to Cloud Connector, 3389 for admin, and 53 to DNS.

Azure Private Endpoint for Azure Files/Key Vault keeps traffic off the public internet; Citrix Cloud Connector still needs outbound 443 to Citrix Cloud endpoints.

Accelerated networking (SR-IOV) reduces latency and CPU; supported on most D/E/F series; required for high-throughput Citrix ADC deployments.

Azure DNS private zones resolve internal names; VNets must be linked to the private zone for Cloud Connector and VDA name resolution.

Citrix Cloud authentication options: Citrix identity provider, Azure AD (SAML/OIDC), AD FS, or third-party IdP; Azure AD is configured under Identity and Access Management.

Azure AD Conditional Access policies apply to Citrix Workspace when Azure AD is the IdP; MFA is enforced before the Citrix session token is issued.

Service principal for Citrix hosting connection: client secret expiry must be monitored; expired secret breaks catalog provisioning and power management.

Azure RBAC: 'Citrix Cloud' app requires Contributor on subscription or a custom role; least privilege uses a custom role scoped to the resource group.

Azure Disk Encryption (ADE) and Encryption at Host are supported for VDA OS disks; MCS catalogs can inherit encryption from the master image.

Azure Key Vault stores Citrix ADC certificates and service principal secrets; managed identity avoids storing credentials in scripts.

Azure AD DS is required for domain-joined MCS catalogs without on-prem AD; it supports Kerberos and LDAP but not full AD schema extensions.

NSG flow logs and Azure Defender for Cloud provide audit of Citrix VNet traffic; Defender for Servers covers VDA threat detection.

Just-in-time VM access in Defender for Cloud can open RDP to VDA admin VMs on demand, reducing exposed management ports.

Azure Monitor metrics for VDA VMs: CPU percentage, Available Memory Bytes, Disk IOPS, Network In/Out; alert thresholds should be set per catalog.

Citrix Autoscale in Citrix Cloud: schedule-based and load-based; load-based uses a peak and off-peak buffer with a minimum number of machines.

Azure VMSS is not used by MCS; MCS manages its own power state via ARM, so scaling is driven by Citrix Autoscale, not VMSS rules.

Azure Monitor autoscale rules apply to VMSS and App Service, not to MCS-managed VMs; do not confuse the two scaling mechanisms.

Citrix Director (on-prem) or Monitor (Citrix Cloud) provides session latency and logon duration; correlate with Azure VM metrics for root cause.

Azure Advisor provides cost and performance recommendations; idle VDA VMs with no sessions should be deallocated to stop compute billing.

Azure Log Analytics with the Azure Monitor Agent collects Windows event logs and perf counters from VDAs; Citrix Cloud Connector logs can be forwarded too.

Reserved instances and savings plans apply to VDA compute; MCS catalogs with Autoscale should use pay-as-you-go for off-peak deallocated machines.

Azure Network Watcher connection troubleshoot and NSG diagnostics verify ICA traffic reachability between Gateway and VDA.

Catalog provisioning failure 'service principal' error: verify client secret expiry, Contributor role assignment, and that the subscription is registered for Microsoft.Compute and Microsoft.Network providers.

VDA registration failure: check Cloud Connector outbound 443 to Citrix Cloud, VDA to Cloud Connector 443/80, and that the VDA is in the same resource location as the connector.

MCS image update failure: master image must be sysprepped, Azure VM agent running, and the image version must be in the same region as the hosting connection.

ICA session fails but VDA registered: check NSG for 1494/2598, Azure Load Balancer health probe, and Citrix Gateway STA configuration.

Slow logon on Azure VDAs: check Azure DNS resolution latency, profile store (Azure Files) latency, and whether the VDA is using a public DNS.

Azure VM deallocated unexpectedly: check Azure Advisor, subscription spending limit, and whether Autoscale or a scheduled task deallocated it.

Hosting connection error 'insufficient permissions': the service principal needs Microsoft.Compute/virtualMachines/* and Microsoft.Network/networkInterfaces/* at the resource group scope.

Azure AD DS join failure: verify VNet DNS points to AD DS DCs, the VDA is in the same or peered VNet, and the AD DS admin credentials are correct.

Citrix ADC HA failover failure in Azure: the Azure internal load balancer probe must match the ADC's health check; floating IP requires the LB to allow floating IP.

Citrix ADC VPX is available in Azure Marketplace; supported sizes range from 200 Mbps to 100 Gbps; throughput is licensed, not VM-size limited.

Citrix ADC HA in Azure uses two VPX instances in an availability set or availability zones, with an Azure internal load balancer providing the floating IP.

Azure LB for ADC HA must be Standard SKU with a health probe on port 9000 (or the configured HA monitor) and floating IP enabled on the backend pool.

Citrix ADC can use Azure AD as a SAML IdP for Gateway authentication; configure the SAML action with the Azure AD enterprise app.

Citrix ADC with Azure Autoscale (via Citrix ADM) can scale VPX instances based on metrics; ADM uses Azure service principal to provision.

Azure Application Gateway can front Citrix StoreFront for HTTP(S) load balancing, but ICA traffic must bypass it (Layer 4 only).

Citrix ADC VPX requires at least two NICs in Azure (management and data); a third NIC is optional for client-side traffic separation.

Azure Accelerated Networking is supported on ADC VPX and recommended for high throughput; verify the VM size supports SR-IOV.

Citrix ADM agent in Azure connects to Citrix ADM service; it requires outbound 443 to Citrix ADM endpoints and Azure service principal for autoscale.