Connect Active Directory to Citrix Cloud

Citrix Cloud supports using your on-premises Active Directory (AD) to authenticate workspace subscribers. Also, some workspace authentication methods require a connection between your AD and Citrix Cloud. For more information, see Choose or change authentication methods.

Citrix Cloud also supports using tokens as a second factor of authentication for subscribers signing in to their workspaces through Active Directory. Workspace subscribers can generate tokens using any app that follows the Time-Based One-Time Password standard, such as Citrix SSO.

For more information about authenticating workspace subscribers with Active Directory plus tokens, see Active Directory plus token.

Tip:

Learn more about supported identity providers with the Introduction to Citrix Identity and Authentication education course. The “Planning Citrix Identity and Access Management” module includes short videos that walk you through connecting this identity provider to Citrix Cloud and enabling authentication for Citrix Workspace.

Connecting Active Directory

Connecting your Active Directory to Citrix Cloud involves installing connectors in your domain. You can choose to use either Cloud Connectors or Connector Appliances (preview) as your connectors for Active Directory. To choose which type of connector to use for your environment, see the following articles:

• Deployment scenarios for Cloud Connectors in Active Directory
• Deployment scenarios for Connector Appliances in Active Directory

Connecting Active Directory through Cloud Connectors

At least two Cloud Connectors are required to ensure a highly available connection to Citrix Cloud. For more information, see the following articles:

• Cloud Connector Technical Details: For system requirements and deployment recommendations.
• Cloud Connector Installation: For installation instructions using either the graphical interface or the command line.

Connecting your Active Directory to Citrix Cloud involves the following tasks:

1. Install Cloud Connectors in your domain. Citrix recommends installing two Cloud Connectors for high availability.
2. If applicable, enable tokens for user devices. Subscribers can enroll only one device at a time.

To connect your Active Directory to Citrix Cloud

1. From the Citrix Cloud menu, select Identity and Access Management.
2. From the Authentication tab, in Active Directory, click the ellipsis menu and select Connect.
3. Click Install Connector to download the Cloud Connector software.
4. Launch the Cloud Connector installer and follow the installation wizard.
5. From the Connect to Active Directory page, click Detect. After verification, Citrix Cloud displays a message that your Active Directory is connected.
6. Click Return to Authentication. The Active Directory entry is marked Enabled on the Authentication tab.

Connecting Active Directory through Connector Appliances (preview)

You can use Connector Appliance to connect a resource location to forests which do not contain Citrix Virtual Apps and Desktops resources. For example, in the case of Citrix Secure Private Access customers or Citrix Virtual Apps and Desktops customers with some forests only used for user authentication.

For more information, see Active Directory with Connector Appliance

To enable Active Directory plus token authentication

1. Connect Active Directory to Citrix Cloud by using either Connector Appliances or Cloud Connectors.
2. In the Citrix Cloud Identity and Access Management section, on the Authentication tab, check that the Active Directory entry is marked Enabled.
3. Click Next. The Configure Token page appears and the Single device option is selected by default.
4. Click Save and Finish to complete the configuration. On the Authentication tab, the Active Directory + Token entry is marked as Enabled.
5. Enable token authentication for workspaces:
   1. From the Citrix Cloud menu, select Workspace Configuration.
   2. From the Authentication tab, select Active Directory + Token.

After enabling Active Directory plus token authentication, Workspace subscribers can register their device and use an authenticator app to generate tokens. Subscribers can register only one device at a time. For instructions to register subscribers’ devices, see Two-factor authentication (optional).

For options to re-enroll subscribers’ devices, see Re-enroll a device.

More information

Citrix Tech Zone:

• Tech Insight: Authentication - TOTP
• Tech Insight: Authentication - Push