A small Finding in the Wild from a current Citrix FAS project.
The starting point:
* Hybrid Entra joined VDA
* FAS logon works
* Certificate is issued correctly
* CRL is reachable internally
* But no Primary Refresh Token (PRT)
What was particularly interesting: I had previously implemented comparable configurations in older FAS environments without explicitly enabling Certificate-Based Authentication (CBA) in Entra.
The crucial difference may lie in the PRT acquisition flow being used.
Entra CBA changes certificate validation
If native Microsoft Entra Certificate-Based Authentication is used to issue the PRT, CBA must be enabled under
Entra ID → Authentication methods → Certificate-based authentication
for the relevant users.
Then there is a second important point:
A CRL that is reachable only internally is not sufficient.
If Entra validates the certificate, Microsoft must also be able to access the Certificate Revocation List.
The internal CA does not have to be exposed to the internet. Publishing the signed .crl file through a publicly reachable HTTP endpoint is sufficient.
This turns:
FAS → Windows logon works → no PRT
into an investigation across the entire chain:
FAS → certificate → Entra CBA → CA trust → CRL → PRT
My learning: do not automatically assume that older and newer FAS environments acquire the PRT through the same authentication path.
Sometimes the issue is not with Citrix, but between your own PKI and Microsoft Entra ID.