Citrix Virtual Apps and Desktops Service Integration with Microsoft Azure key terms

Azure's deployment and management control plane. Every resource lives in a resource group and is created, tagged, and deleted through ARM templates or APIs, which Citrix uses when it provisions catalog machines and supporting infrastructure.

A logical container that groups Azure resources sharing a lifecycle and permissions. Citrix deployments typically place machine catalogs, NICs, disks, and images in dedicated resource groups so they can be tagged, quota-tracked, and deleted together.

A region is a geographic datacenter cluster; zones are physically separate datacenter groups within a region. Placing Citrix VDAs and Azure Files or gateway services across zones improves resilience against a single datacenter failure.

A logical grouping that spreads virtual machines across fault domains and update domains inside one datacenter. It protects Citrix VDA uptime during host maintenance but offers weaker protection than availability zones.

Azure block storage whose lifecycle Azure manages, with tiers such as Standard HDD, Standard SSD, Premium SSD, and Ultra Disk. Citrix catalog machine identity disks and MCS write-back caches are provisioned as managed disks.

An Azure OS disk stored on local host storage rather than in a storage account. It gives faster boot and lower cost for stateless Citrix workers, but data is lost on deallocation and the image must fit the host cache.

The isolated private network boundary in Azure and its address ranges. Citrix VDAs, Cloud Connectors, and Azure Files endpoints each need subnets sized for growth, with routing and security rules planned before deployment.

A stateful set of allow and deny rules applied to subnets or NICs. It controls which ports reach Citrix VDAs, Cloud Connectors, and the Azure load balancer health probe, and is a frequent cause of registration failures.

A Layer 4 load balancer that distributes TCP and UDP traffic and probes backend health. It fronts RDP or ICA traffic to Citrix VDAs in Azure and can publish the Gateway or StoreFront tier when paired with health probes.

A private IP address inside a VNet that connects to an Azure PaaS service over the Microsoft backbone. It lets Citrix Cloud Connectors and VDAs reach Azure Files or storage without exposing traffic to the public internet.

SMB file shares hosted in Azure storage, often used for FSLogix profile and Office containers. Access requires line-of-sight to the share, correct NTFS permissions, and either private endpoints or firewall-approved routes.

A private, dedicated circuit connecting on-premises networks to Azure, bypassing the public internet. It is chosen when Citrix users or domain controllers need predictable latency and bandwidth to VDAs hosted in Azure.

An Azure compute construct that manages a group of identical VMs with autoscale rules. Citrix autoscale can grow or shrink a scale set backing a machine catalog, though power-managed catalogs are the more common pattern.

A discounted Azure VM that can be evicted when capacity is reclaimed. It suits interruptible, non-persistent Citrix workloads only, and eviction handling must be planned so users are not abruptly disconnected.

A licensing program that applies existing Windows Server or SQL Server licenses with Software Assurance to Azure VMs. It lowers the compute cost of Citrix VDA hosts running Windows client or server operating systems.

A one- or three-year prepaid commitment that discounts steady-state VM compute. Citrix environments with predictable always-on infrastructure, such as Cloud Connectors and persistent VDAs, benefit most from reservations.

The Citrix configuration object that stores the Azure subscription, service principal credentials, and region used to create and manage machines. It is created once per subscription and region and referenced by machine catalogs.

An Azure Active Directory application identity with a secret or certificate, granted a role at subscription or resource group scope. Citrix uses it to authenticate to Azure on behalf of the administrator when provisioning and power-managing machines.

Azure's authorization model that assigns built-in or custom roles at management group, subscription, resource group, or resource scope. The service principal needs sufficient rights to create NICs, disks, and VMs but should follow least privilege.

An Azure-assigned identity that lets a resource authenticate to other Azure services without stored secrets. It can replace service principal secrets for Citrix integrations and reduces credential rotation risk in automation.

A service for storing and auditing secrets, certificates, and keys. Citrix administrators use it to hold service principal secrets and TLS certificates rather than embedding them in scripts or catalog properties.

A Citrix provisioning method that clones a master image into catalog machines using the hypervisor's snapshot and copy APIs. On Azure it creates managed disks or ephemeral disks per VM and tracks them through the host connection.

The prepared virtual machine snapshot or Azure image from which Citrix MCS creates catalog machines. It must contain the VDA, the correct hypervisor drivers, and be generalized or sealed according to the chosen preparation method.

A service for storing, versioning, and replicating VM images across regions. Citrix MCS can use a gallery image version as the master image, enabling faster catalog builds and regional image distribution.

A Citrix feature that buffers writes to a temporary cache disk on non-persistent Azure VDAs, reducing read and write load on the master image disk. Cache size and disk type affect performance and cost.

A Citrix collection of physical or virtual machines with a shared image and provisioning method, assigned to users through delivery groups. On Azure, catalog properties include the host connection, resource group, and disk settings.

A Citrix object that maps machines from one or more catalogs to users and applications, and holds power-management and session policies. It is where Azure-hosted desktops and published apps become accessible.

A Citrix component, deployed as an Azure VM or on-premises server, that maintains an outbound connection to Citrix Cloud and brokers communication with the resource location. It needs domain join, certificates, and outbound 443 access.

A Citrix Cloud service that provides user authentication and HDX session proxy into customer environments without a customer-managed gateway appliance. It requires Cloud Connectors and published Gateway Service URLs.

A Citrix Cloud feature that powers machines on and off or scales a VM scale set based on schedule and load. On Azure it reduces compute cost for non-persistent catalogs while respecting buffer and drain settings.

A profile virtualization technology that stores the user profile in a VHD or VHDX file, typically on an SMB share. On Azure it is commonly hosted on Azure Files or Azure NetApp Files for multi-session desktops.

Citrix Monitor records session, logon, and machine metrics; Azure Monitor collects platform metrics, logs, and alerts. Correlating both is essential when diagnosing VDA registration or performance problems on Azure.

A repository for log and metric data queried with KQL. Azure activity logs, boot diagnostics, and guest OS performance counters feed it, giving Citrix administrators evidence for troubleshooting and capacity reporting.

The process by which a Virtual Delivery Agent establishes and maintains a connection to a Citrix Cloud Connector or Delivery Controller. Failure on Azure usually traces to NSG rules, DNS, time sync, or an expired machine identity.

A VM setting that captures serial console output and screenshots during boot. It helps determine whether an unregistered Citrix VDA failed at the OS layer before the VDA service ever started.

Citrix's application delivery controller, available as an Azure marketplace appliance or as VPX. It provides load balancing, SSL offload, and Gateway or StoreFront publishing for Citrix workloads hosted in Azure.

A pattern in which two Citrix ADC VPX appliances share a floating IP through an Azure internal load balancer, giving active-passive failover without unsupported layer 2 clustering across subnets.