Last updated:
During a current Citrix project, I came across a development that will be particularly interesting for future StoreFront architectures.
StoreFront can now configure Microsoft Entra ID directly through the management console.
This becomes especially interesting in hybrid environments:
→ Hybrid users can receive resources from Citrix DaaS and on-premises CVAD through StoreFront.
→ From CVAD 2603, StoreFront supports Entra ID SSO to published resources, provided the VDAs are appropriately hybrid Entra ID joined.
→ Even more interesting: Entra SSO and FAS can be used in parallel within the same store.
StoreFront uses each delivery group’s logon type to decide which authentication method to use for resource launch.
For example, this enables gradual modernization of an environment without immediately removing FAS from the design.
What I take from this for new designs
In future, I would create an authentication matrix during the design phase:
Delivery group → VDA join state → authentication method → SSO method
For example:
• Conventional AD VDAs → FAS
• Hybrid Entra ID joined VDAs → Entra SSO
• DaaS workloads → according to the identity design
In larger hybrid environments in particular, this prevents considerable confusion later.
For me, this is another step towards making StoreFront more interesting in modern Entra ID/DaaS architectures, rather than viewing it solely as a component of conventional on-premises CVAD environments.
