Configuring a Citrix Gateway application on the Azure portal

October 9, 2024

Contributed by:

C C

The following section lists steps to configure a Citrix Gateway application on the Azure portal.

Prerequisites

Azure global admin credentials
Intune licensing is enabled
For Intune Integration you must create a Citrix Gateway application on the Azure portal.
Once the Citrix Gateway application is created, configure the OAuth policy on Citrix Gateway using the following application specific information:
- Client ID / Application ID
- Client Secret / Application Key
- Microsoft Entra Tenant ID
Citrix Gateway uses the app client id and client secret to communicate with Azure and check for NAC compliance.

To create a Citrix Gateway app on Azure

Log in to portal.azure.com
Click Microsoft Entra ID.
Click App registrations and click New registration.
On the Register an application page, enter an app name and click Register.
Navigate to Authentication, click Add URI, enter FDQN for Citrix Gateway, and click Save.
Navigate to the Overview page to get Client ID, Tenant ID, and Object ID.
Navigate to API permissions and click Add a permission.
Note:

All Microsoft Entra ID applications that call the https://login.microsoftonline.com, https://graph.microsoft.com, or https://graph.windows.net service endpoints require the API permission to be assigned for the gateway to be able to call the NAC API. The available API Permissions are:
- Application.Read.All
- Application.ReadWrite.All
- Application.OwnedBy
- Directory.Read.All
The preferred permission is Application.Read.All.

For more details, see https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-intune-service-discovery-api-endpoint-will-require/ba-p/2428040
Click the Microsoft Graph tile to configure API permissions for Microsoft Graph.
Click the Delegated permissions tile.
Select the following permissions and click Add permissions.
- Email
- openid
- Profile
- Directory.AccessAsUser.All
- User.Read
- User.Read.All
- User.ReadBasic.All
Permissions for Intune NAC check:

All Microsoft Entra ID applications that call the https://login.microsoftonline.com, https://graph.microsoft.com, or https://graph.windows.net service endpoints require the API permission to be assigned for the gateway to be able to call the NAC API. The available API Permissions are:
- Application.Read.All
- Application.ReadWrite.All
- Application.OwnedBy
- Directory.Read.All
The preferred permission is Application.Read.All.

For more details, see https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-intune-service-discovery-api-endpoint-will-require/ba-p/2428040

Note:

If a customer is only using the Intune Action for NAC check, then the only permission required is Application.Read.All in Microsoft Graph.
Click the Intune tile to configure API permissions for Intune.
Click the Application permissions tile and the Delegated permissions tile to add permissions for Get_device_compliance and Get_data_warehouse respectively.
Select the following permissions, and click Add permissions.
- Get_device_compliance - Application permissions
- Get_data_warehouse - Delegated permissions
Note:

For the Intune NAC check, the only permission required is Get_device_compliance.
The following page lists the configured API permissions.
Navigate to Certificates & secrets and click New client secret.
Under the Add a client secret page, enter a description, select expiry, and click Add.
The following screen shows the configured client secret.

Note

The client secret is displayed only once when it is generated. Copy the displayed client secret locally. Use the same client secret along with the client ID associated with the newly registered app while configuring the OAuth action on the Citrix Gateway appliance for Intune.

The application configuration on the Azure portal is now complete.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring a Citrix Gateway application on the Azure portal

October 9, 2024

Contributed by:

C C

October 9, 2024

Contributed by:

C C

Configuring a Citrix Gateway application on the Azure portal

Prerequisites

To create a Citrix Gateway app on Azure

In this article