Citrix DaaS for Citrix Service Providers

This article describes howCitrix Service Providers (CSP)can set up Citrix DaaS (formerly Citrix Virtual Apps and Desktops service) for tenant customers in Citrix Cloud. For an overview of the features available for Citrix Partners, seeCitrix Cloud for Partners.

Requirements

• You are aCitrix Service Provider partner.
• You have a Citrix Cloud account.
• You have a subscription to Citrix DaaS.

Limitations and known issues

Limitations

• Tenant name changes take up to 24 hours to apply across all interfaces.
• When creating a tenant, the email address must be unique.
• Filtering inManage > Full Configurationby scope (similar to Monitor) is not available. To see the resources attached to a scope, selectAdministratorsin the left pane. On theScopestab, select the scope and then selectEdit Scopein the Action pane.

Known issues

• After scopes are assigned to a resource, you cannot use the management console to remove or unassign them. Those tasks are supported only through PowerShell.
• Manage > Full Configurationdoes not enforce scopes. You are responsible for selecting the appropriate scope when creating machine catalogs, delivery groups, and application groups.
• When more than 15 scopes are created (auto-created and custom), the Citrix Cloud custom access information for an administrator (Identity and Access Management > Administrators) does not display correctly. Workaround: Limit scopes to 15 or fewer.

Add a customer

1. Sign in to Citrix Cloud with your CSP credentials. SelectCustomersin the upper left menu.
2. From the Customer Dashboard, selectInvite or Add. Provide the requested information.
3. If the customer does not have a Citrix Cloud account, adding the customer creates a customer account. Adding the customer also automatically adds you as a full access administrator of that customer’s account.
4. If the customer has a Citrix Cloud account:
   1. A Citrix Cloud URL displays, which you copy and send to the customer. For details of this process, seeInviting a customer to connect.
   2. The customer must add you as a full access administrator to their account. SeeAdd administrators to a Citrix Cloud account.

You can add more administrators later and control which customers they can see on theManageandMonitorconsoles.

Add Citrix DaaS to a customer

1. Sign in to Citrix Cloud with your CSP credentials. SelectCustomersin the upper left menu.
2. From the Customer Dashboard, in the ellipsis menu for the customer, selectAdd Service.
3. InSelect a service to add, selectVirtual Apps and Desktops.
4. SelectContinue.

完成这个过程后,客户onboarded to your Citrix DaaS subscription.

When the onboarding completes, a new customer scope is created automatically in Citrix DaaS. The scope is visible in theManage > Full Configurationdisplay. This scope is unique to that customer. You canrename the scope, but you cannot delete it.

Use this scope to tailor access for other administrators. For example, let’s say you have 10 customers and two administrators. Using the unique scope, you can restrict one administrator’s access to only three of the customers. The other administrator can access one of those three customers, plus two other customers. For details, seeControl administrator access to customers.

Set up a resource location

A resource location holds the machines that deliver apps and desktops for your customers, and infrastructure components such as Citrix Cloud Connectors. For details, seeConnect to Citrix Cloud.

Set up catalogs and groups to deliver apps and desktops

A catalog is a group of identical virtual machines. When you create a catalog, an image is used (with other settings) as a template for creating the machines. For details, seeCreate machine catalogs.

selec交付组是一组机器ted from one or more machine catalogs. The delivery group specifies which users can use those machines, plus the applications or desktops available to those users. For details, seeCreate delivery groups.

Application groups let you manage collections of applications. You can create application groups for applications shared across different delivery groups or used by a subset of users within delivery groups. For details, seeCreate application groups.

When configuring groups, be sure that:

• The delivery group’s scope is a subset of the machine catalog’s scope. For example, assume the catalog’s scope is A and B. The delivery group’s scope can be either A or B, or A and B.
• The application group’s scope is a subset of the delivery group’s scope. For example, assume the delivery groups associated with an application group have scope A and B. The application group’s scope can be either A or B, or A and B.

Federated domains

Federated domains enable customer users to use credentials from a domain attached to your resource location to sign in to their workspace. This allows you to provide dedicated workspaces to your customers that customer users can access using a custom workspace URL (for example, customer.cloud.com), while the resource location is still on your Citrix Cloud account. You can provide dedicated workspaces alongside the shared workspace that customers can access using your CSP workspace URL (for example, csppartner.cloud.com).

To enable customers to access their dedicated workspace, you add them to the appropriate domains that you manage. After configuring the workspace throughWorkspace Configuration, customers’ users can sign in to their workspace and access the apps and desktops that you’ve made available.

Add a customer to a domain

1. Sign in to Citrix Cloud with your CSP credentials. SelectCustomersin the upper left menu.
2. From the Customer Dashboard, selectIdentity and Access Managementin the upper left menu.
3. On theDomainstab, selectManage Federated Domainin the domain’s ellipsis menu.
4. On theManage Federated Domaincard, in theAvailable customerscolumn, select a customer you want to add to the domain. Select the plus sign next to the customer name. The selected customer now appears in theFederated customerscolumn. Repeat to add other customers. When you’re done, selectApply.

Remove a customer from a domain

When you remove a customer from a domain that you manage, the customer’s users can no longer access their workspaces using credentials from your domain.

1. From the Citrix Cloud menu, selectIdentity and Access Management, then selectDomains.
2. Locate the domain that you want to manage and select the ellipsis button. SelectManage Federated Domain.
3. From the list of federated customers, locate or search for the customers you want to remove and select the X button. SelectRemove allto remove all the customers in the list from the domain. The selected customers move to the list of available customers.
4. SelectApply.
5. Review the customers you selected and selectRemove Customers.

Control administrator access to customers

You can control administrator access to customers by using the unique scope that was created when you added Citrix DaaS to the customer. You can configure access when you add an administrator or later.

To learn about restricting access using roles and scopes in Citrix DaaS, seeDelegated administration.

Add an administrator with restricted access

1. Sign in to Citrix Cloud with your CSP credentials. SelectCustomersin the upper left menu.
2. From the Customer Dashboard, selectIdentity and Access Managementin the upper left menu.
3. On theAdministratorstab, selectAdd Administrators From, and then selectCitrix Identity.
4. Type the email address of the person you’re adding as an administrator, and then selectInvite.
5. Configure the appropriate access permissions for the administrator. Citrix recommends selectingCustom access, unless you want the administrator to have management control of Citrix Cloud and all subscribed services.
6. After selectingCustom access, select one or more role and scope pairs for Citrix DaaS, as needed. Be sure to enable only entries that contain the unique scope that was created for the customer.
7. When you’re done selecting role and scope pairs, selectSend Invite.

When the administrator accepts the invitation, they have the access that you assigned.

Edit delegated administration permissions for administrators

1. Sign in to Citrix Cloud with your CSP credentials. SelectCustomersin the upper left menu.
2. From the Customer dashboard, selectIdentity and Access Managementin the upper left menu.
3. On theAdministratorstab, selectEdit Accessfrom the ellipsis menu for the administrator.
4. Select and clear role and scope pairs for Citrix DaaS, as needed. Be sure to enable only entries that contain the unique scope that was created for the customer.
5. SelectSave.

View customer administrators and their assigned roles and scopes

1. Sign in to Citrix Cloud with your CSP credentials. SelectCustomersin the upper left menu.
2. From the Customer Dashboard, selectMy Services > DaaSin the upper left menu.
3. In Citrix DaaS, selectManage > Full Configuration.
4. SelectAdministratorsin the left pane.

Information is available on three tabs:

• TheAdministratorstab lists the administrators that have been created, plus their roles and scopes.
• TheRolestab lists all roles. To view role details, select the role in the middle pane. The lower portion of that pane lists the object types and associated permissions for the role. Select theAdministratorstab in the lower pane to display a list of administrators who currently have this role.
• TheScopestab lists all the scopes, including the scopes generated for customers of Citrix partners.

Configure workspaces

The customer has their own workspace with a uniquecustomer.cloud.comURL. This workspace is where the customer’s users access their published apps and desktops.

The workspace URL is displayed in two places:

• From the Customer dashboard, selectWorkspace Configurationfrom the menu in the upper left menu.
• From the Citrix DaaSWelcomepage (theOverviewtab), the workspace URL appears at the bottom of the page.

You can change access and authentication to a workspace. You can also customize the workspace appearance and preferences. For details, see the following articles:

• Configure workspaces
• Secure workspaces

Monitor a customer’s service

TheMonitordashboard in a CSP environment is essentially the same as a non-CSP environment. SeeMonitorfor details.

By default, theMonitordashboard displays information about all customers. To display information about one customer, useSelect Customer.

Keep in mind that the ability to see Monitor displays for a customer is controlled by the administrator’s configured access. The access must include a role and scope pair that includes the customer’s unique scope.

If you used built-in roles to configure access: The built-in roles control whether the administrator can see theManageandMonitordisplays. If you select only role and customer-scope pairs that do not includeMonitortab visibility, that administrator cannot see theMonitortab for any selected customers. For example, if you give an administrator onlyRead Only Administrator,customerABCaccess, that administrator cannot see theMonitortab for customer ABC, because read only administrators cannot access Monitor displays.

Remove a Service

Prerequisites

• Ensure that your customer scope is not linked to any Citrix DaaS objects. If they are linked, you cannot remove the service. To unlink scopes, go toCitrix Studio > Administrators > Scopesand edit the scope.
• To know your customer scope and manage it, seeCreate and manage scope.

1. Sign in to Citrix Cloud with your Citrix Service Providers credentials.

2. On theCustomer dashboard, click theEllipsismenu (…) of the customer from where you want to remove a service and selectRemove Service.

   

   TheService to Removepage appears.

   

3. ClickRemoveto remove the service.