Configure identity, access, and security in Azure
Identity layers
This domain tests the separation between user authentication, machine identity, and administrative authorization. Entra ID authenticates users and controls Azure RBAC. AD DS provides domain identity for Cloud Connectors and domain-joined VDAs. Citrix Cloud administrative roles control who can manage catalogs, delivery groups, and hosting connections. Security also covers service principals, secrets, disk encryption, and network exposure.
Core rules and concepts
- Cloud Connectors must be domain joined in standard deployments. Entra ID does not replace AD DS for that machine identity requirement.
- Entra ID Conditional Access and MFA can protect Citrix Workspace access. Citrix Gateway can also integrate SAML or MFA at the edge.
- Citrix Federated Authentication Service issues short-lived certificates to VDAs so users authenticated by a federated identity provider can log on to AD-joined machines. FAS requires an AD CA and is not a substitute for AD DS.
- Azure RBAC and Citrix Cloud roles are separate. A Citrix administrator does not automatically have Azure rights, and an Azure Contributor cannot manage Citrix delivery groups.
- Store service principal secrets in Key Vault where possible, restrict access, and rotate them. Apply Azure Disk Encryption or encryption at host according to policy.
- Use just-in-time access and least privilege for management jump hosts; do not expose RDP or WinRM to the internet.
Worked example
Users authenticate to Workspace with Entra ID and MFA. VDAs are domain joined, so the user needs an AD identity at the VDA logon stage. The company deploys FAS with an enterprise CA, configures the VDA to use FAS, and issues short-lived logon certificates. Conditional Access requires compliant devices for external access. The Azure service principal used by the host connection has Contributor only on the workload resource group. The reasoning is that Entra ID handles the front-door authentication, FAS bridges to AD logon, and RBAC limits blast radius.
Traps that cost marks
Assuming Entra ID can domain join Cloud Connectors loses marks. Deploying FAS without a properly configured CA and certificate templates fails. Giving the host connection service principal Owner rights is excessive. Forgetting that Citrix Cloud roles and Azure RBAC are independent causes authorization confusion. Leaving management ports open to the internet is a security failure.
Key points
- Entra ID handles user authentication; AD DS remains required for domain-joined Cloud Connectors and VDAs.
- FAS issues short-lived certificates for AD logon after federated authentication.
- Azure RBAC and Citrix Cloud administrator roles are separate control planes.
- Store and rotate service principal secrets securely, preferably in Key Vault.
- Use MFA, Conditional Access, and JIT access; never expose RDP publicly.