Set up NetScaler Gateway for using micro VPN with Microsoft Endpoint Manager

Citrix micro VPN integration with Microsoft Endpoint Management enables your apps to access on-premises resources. For details see, Citrix micro VPN integration with Microsoft Endpoint Manager.

System requirements

  • NetScaler Gateway versions
    • 13.1
    • 13.0
    • 12.1.50.x or later
    • 12.0.59.x or later

    You can download the latest version of NetScaler Gateway from the NetScaler Gateway download page.

  • A Windows desktop running Windows 7 or later (for Android app wrapping only)

  • Microsoft
    • Azure AD access (with Tenant Admin privileges)
    • Intune-enabled tenant
  • Firewall rules
    • Enable a firewall rule to SSL traffic from a NetScaler Gateway subnet IP to *,, and (port 443)
    • NetScaler Gateway must be able to externally resolve the preceding URLs.


  • Intune environment: If you don’t have an Intune environment, set up one. For instructions see the Microsoft documentation.

  • Edge Browser App: The Micro VPN SDK is integrated within the Microsoft Edge app and Intune Managed Browser app for iOS and Android. For more information about the Managed Browser, see the Microsoft Managed Browser page.

  • Citrix Endpoint Management entitlement: Ensure to have an active Citrix Endpoint Management entitlement for continued support to the micro VPN SDK on a Microsoft Edge mobile browser (iOS and Android). For more information, contact your Sales, Account, or Partner representative.

Grant Azure Active Directory (AAD) application permissions

  1. Consent to Citrix multitenant AAD application to allow NetScaler Gateway to authenticate with the AAD domain. The Azure Global Administrator must visit the following URL and consent:

  2. Consent to Citrix multitenant AAD application to allow mobile applications to authenticate with the NetScaler Gateway micro VPN. This link is only required if the Azure Global Admin has changed the default value for Users can register applications from Yes to No. This setting can be found in the Azure portal under Azure Active Directory > Users > User Settings. The Azure global administrator must visit the following URL and consent (add your Tenant ID)[tenant_id]/adminconsent?client_id=9215b80e-186b-43a1-8aed-9902264a5af7.

Configure NetScaler Gateway for micro VPN

To use micro VPN with Intune, you must configure NetScaler Gateway to authenticate to Azure AD. An existing NetScaler Gateway virtual server does not work for this use case. First, configure Azure AD to sync with the on-premises Active Directory. This step is necessary to ensure that authentication between Intune and NetScaler Gateway occurs properly.

Download script: The .zip file includes a readme with instructions for implementing the script. You need to manually enter the information the scripts require and run the script on the NetScaler Gateway to configure the service. You can download the script file from the NetScaler downloads page.

Important: After you have completed the NetScaler Gateway configuration, and if you see the OAuth Status other than COMPLETE, see the Troubleshooting section.

Configuring Microsoft Edge Browser

  1. Sign in to and then navigate to Intune > Mobile apps.
  2. Publish the Edge App as you normally do and then add an app configuration policy.
  3. Under Manage, click App configuration policies.
  4. Click Add and then enter a name for the policy you want to create. In Device enrollment type, select Managed apps.
  5. Click Associated App.
  6. Select the apps to which you want to apply the policy (Microsoft Edge or Intune managed browser) and then click OK.
  7. Click Configuration Settings.
  8. In the Name field, enter the name of one of the policies listed in the following table.
  9. In the Value field, enter the value you want to apply for that policy. Click off the field to add the policy to the list. You can add multiple policies.
  10. Click OK and then click Add.

The policy is added to your list of policies.

Name (iOS/Android) Value Description
MvpnGatewayAddress External URL of your NetScaler Gateway
MvpnNetworkAccess MvpnNetworkAccessTunneledWebSSOor Unrestricted MvpnNetworkAccessTunneledWebSSO is the default for tunneling
MvpnExcludeDomains Comma-separated list of domain name to be excluded Optional. Default=blank
TunnelExcludeDomains Use this client property to override the default list of domains excluded.,,,,,,,,,,,,,,,,  

Note: Web SSO is the name for Secure Browse in the settings. The behavior is the same.

  • MvpnNetworkAccess - MvpnNetworkAccessTunneledWebSSO enables HTTP/HTTPS redirection through the NetScaler Gateway, also known as Tunneled-Web SSO. The gateway responds to HTTP authentication challenges inline, providing a single-sign-on (SSO) experience. To use Web SSO, set this policy to MvpnNetworkAccessTunneledWebSSO. Full tunnel redirection is currently not supported. Use Unrestricted to leave micro VPN tunneling off.

  • MvpnExcludeDomains - Comma-separated list of host or domain names to be excluded from being routed through the NetScaler Gateway reverse web proxy. The host or domain names are excluded even though the NetScaler Gateway configured split DNS settings might otherwise select the domain or host.


    • This policy is only enforced for MvpnNetworkAccessTunneledWebSSO connections. If MvpnNetworkAccess is Unrestricted, this policy is ignored.

    • This policy applies only to the Tunneled-Web SSO mode with NetScaler Gateway configured for reverse split tunneling.

  • TunnelExcludeDomains - By default, MDX excludes some service endpoints from micro VPN tunneling. The mobile app SDKs and the apps use these service endpoints for various features. For example, the service endpoints include services that do not require routing through enterprise networks, such as Google Analytics, Citrix Cloud services, and Active Directory services. Use this client property to override the default list of excluded domains.

    To configure this global client policy, on the Microsoft Endpoint Management console, navigate to Settings > Client Properties, add the custom key TUNNEL_EXCLUDE_DOMAINS, and set the value.

    Value: To replace the default list with the domains that you want to exclude from tunneling, type a list of domain suffixes separated by commas. To include all domains in tunneling, type none. Default is:,,,,,,,,,,,,,,,,


General issues

Issue Resolution
The “Add Policy Required” message appears when you open an app Add policies in the Microsoft Graph API
There are policy conflicts Only a single policy per app is allowed
The “Failed to package app”message appears when wrapping an app. For the complete message, see the following table The app is integrated with the Intune SDK. You do not need to wrap the app with the Intune
Your app can’t connect to internal resources Ensure that the correct firewall ports are open, you correct tenant ID, and so on

Failed to package app error message:

Failed to package app. This app already has the MAM SDK integrated. The application cannot be wrapped.

NetScaler Gateway issues

Issue Resolution
The permissions required to be configured for the gateway app on Azure are unavailable. Check if a proper Intune license is available. Try using the portal to see if the permission can be added. Contact Microsoft support if the issue persists.
NetScaler Gateway cannot reach and From NS Shell, check if you are able to reach the following Microsoft website: cURL -v -k Then, check whether DNS is configured on NetScaler Gateway. Also check that the firewall settings are correct (in case DNS requests are firewalled).
An error appears in ns.log after you configure OAuthAction. Check if Intune licensing is enabled and the Azure Gateway app has the proper permissions set.
Sh OAuthAction command does not show OAuth status as complete. Check the DNS settings and configured permissions on the Azure Gateway App.
The Android or iOS device does not show the dual authentication prompt. Check if the Dual Factor Device ID logonSchema is bound to the authentication virtual server.

NetScaler Gateway OAuth status and error condition

Status Error condition
AADFORGRAPH Invalid secret, URL not resolved, connection timeout
MDMINFO * down or unreachable
GRAPH Graph endpoint is down unreachable
CERTFETCH Cannot talk to “Token Endpoint: because of a DNS error. To validate this configuration, go to shell and type cURL This command must validate.

Note: When the OAuth status is successful, the status is displayed as COMPLETE.

Set up NetScaler Gateway for using micro VPN with Microsoft Endpoint Manager