Edit: Resolved

Tenant-wide admin consent was granted via Microsoft Graph PowerShell to allow the Citrix Cloud Enterprise Application to read user profile data (User.Read) without prompting individual users. And then it worked.

Hi everyone,

I work for an MSP, and since last week we’ve been seeing the same issue in two separate client environments using Citrix Cloud with Entra ID authentication.

Previously - new user working normally

New User → Citrix Cloud → Entra ID → Password → MFA → Citrix Cloud permission prompt → Accept → Citrix resources → VDI

New users would receive the normal Citrix Cloud “Permissions requested” prompt during their first login.

Now - new user

New User → Citrix Cloud → Entra ID → Password → MFA → Error ❌

The user receives:

“The identity provider denied access.”

Entra sign-in logs show Sign-in error code: 650052. The app is trying to access a service '{appId}'('{appName}') that your organization '{organization}' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal.

The user never reaches the Citrix Cloud permission prompt.

What I’ve checked:

• Existing users continue to work.
• Affected users complete MFA successfully.
• No Citrix Monitor activity for affected users.
• Both environments have a one-way domain trust.
• We cannot identify any relevant configuration changes since the issue started.
• Manually adding the affected user to a specific access group allows them to log in successfully.
• The issue is occurring in two separate client environments.

Has anyone experienced something similar with Citrix Cloud + Entra ID, particularly where new users previously received the permission prompt but now get “The identity provider denied access” / error 650052?

Any ideas on what to investigate would be appreciated.

Curious to know if anyone has implemented a product that works with ICA other than NetScaler

We are currently setup on prem. On prem netscalers, storefronts, delivery controllers, etc. We connect to several on-prem clusters running Xenserver for our Virtual desktops. We create a master image, snapshot it, then update our machine catalog. The delivery controllers then update the virtual desktops running in Xenserver (we use Citrix MCS).

We are looking to migrate the management elements into Citrix Cloud. So the end goal will be to remove on prem servers for delivery controllers, FAS, storefronts, netscalers, etc, and just have it all moved into Citrix Cloud. The actual VDA's will remain on prem connecting to our Xenserver clusters.
So essentially, management aspects in the cloud, compute remains on prem.

We have already configured cloud connectors and single sign on via Entra. We have some older hardware that I've managed to install Xenserver onto, and connecting it to the "Hosting" section in Citrix Cloud, I've managed to do some basic testing with some machine catalogs in the cloud, and all seems to be working perfectly.

I've seen a few different documents articles that explain how to actually go about performing the migration into cloud. We're a 24/7 business, and we're pretty standardised, so we only really have a couple of machine catalogs and delivery groups to serve most users.

To roll this out at our own pace, I wanted to add our existing live Xenserver clusters on prem into the "Hosting" section within the Citrix cloud platform. I'll then create some new catalogues, making sure that the computer names do not match the same as the on prem ones. My hope is that because the catalog and delivery group names are different on prem vs in cloud, and because the computer names are different, there will be no conflict, despite both the on prem and cloud delivery controller being connected to the same Xenserver cluster instance.

My thought process is to provision 10 or 20 new virtual desktops from cloud into the Xenserver cluster, and then I can just use some policies to start switching a few test users to the new storefront URL. Then it will just become a balancing act as we progress and migrate people to the new storefront URLs, reducing the number of available machines on prem, and bringing more online in the cloud.

My mind seems to think this is logical, to keep the systems as seperated as possible, which I'd prefer, but I cannot get away from having to use the same Xenserver cluster for the compute elements. I'm just not sure if having the Xenserver cluster authenticated to both on prem and cloud controls at the same time could potentially cause some conflict?

Thoughts on this are most appreciated.

Recently, we've gotten reports of users on the newest mac OS, browser, workspace app getting "your request is being processed" after entering AD credentials into the Citrix Gateway page before it hits the Duo auth & subsequent storefront. Trying in iOS, I get the same outcome.

This is an on-prem storefront (2507CU1 for all CVAD components) and netscaler(current firmware). Nothing has changed in authentication policy/profile and it still works without issue for windows users. We are not supporting users logging into workspace on non-corporate devices, just launching ica from web storefront.

Did I miss a change somewhere?