Last updated:
A Citrix environment with Microsoft Entra ID, correctly configured SSO and registered VDAs.
Users authenticate successfully to Citrix Workspace. However, launching the desktop prompts for Windows credentials again, or SSO fails.
The symptoms:
✅ Entra ID authentication succeeds
✅ The VDA is registered and reachable
✅ Citrix resources are displayed
❌ Single sign-on within the session does not work
The initial suspects are Entra ID, Conditional Access, Kerberos or the Citrix configuration.
But the actual cause may lie in a Microsoft Security Baseline.
🔍 Root cause
Citrix Entra SSO requires the following Windows security setting:
Allow Custom SSPs and APs to be loaded into LSASS
The Microsoft Intune Security Baseline for Windows sets this setting to Disabled by default.
This prevents Windows from loading additional Security Support Providers and Authentication Packages into LSASS.
As a result, the authentication integration required for Citrix SSO can be blocked.
🛠️ My troubleshooting approach
First, I check the effective policy on the affected VDA:
Computer Configuration → System → Local Security Authority
The critical setting is:
Allow Custom SSPs and APs to be loaded into LSASS
Next, I check whether Intune, a Security Baseline or a conventional GPO controls this setting.
The solution:
Specifically set the setting to Enabled on the affected Citrix session hosts.
Important: do not disable the entire Security Baseline!
I would use a dedicated policy or an agreed exception for the Citrix VDAs.
Then verify policy application, restart the VDA and retest SSO.
⚠️ Security note
This change permits additional SSP/AP components to load into LSASS, deliberately expanding the allowed authentication integration.
The exception therefore belongs only on systems that actually require this functionality.
💡 My takeaway
Not every Citrix SSO issue is a Citrix problem.
Sometimes a correctly deployed Security Baseline prevents exactly the functionality required by the intended authentication architecture.
Security hardening and functionality must be considered together, especially with Citrix, Entra ID and Windows.
