Configuring a Citrix Gateway application on the Azure portal

September 14, 2021

Contributed by:

The following section lists steps to configure a Citrix Gateway application on the Azure portal.

Prerequisite

Azure global admin credentials
Intune licensing is enabled
For Intune Integration you need to create a Citrix Gateway application on Azure portal.
Once the Citrix Gateway application is created, configure the OAuth policy on Citrix Gateway using the following application specific information:
- Client ID / Application ID
- Client Secret / Application Key
- Azure Tenant ID
Citrix Gateway uses the app client id and client secret to communicate with Azure and check for NAC compliance.

To create Citrix Gateway App on Azure

Log in to portal.azure.com
ClickAzure Active Directory.
ClickApp registrationsand clickNew registration.
On theRegister an applicationpage, enter an app name and clickRegister.
Navigate toAuthentication, clickAdd URI, enter FDQN for Citrix Gateway, and clickSave.
Navigate to theOverviewpage to get Client ID, Tenant ID, and Object ID.
Navigate toAPI permissionsand clickAdd a permission.
1. Scroll down and selectAzure AD Graph.
2. ChooseApplication permissions, selectApplication.Read.All, and then clickAdd permissions.
3. ClickGrant admin consent forand selectYes.
4. Verify that the permissions are granted for your tenant.
Note:

All Azure AD applications that call thehttps://login.microsoftonline.comor thehttps://graph.windows.netservice endpoints require the API permission to be assigned for the gateway to be able to call the NAC API. The available API Permissions are:
- Application.Read.All
- Application.ReadWrite.All
- Application.OwnedBy
- Directory.Read.All
The preferred permission isApplication.Read.All.

For more details, seehttps://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-intune-service-discovery-api-endpoint-will-require/ba-p/2428040
Click theMicrosoft Graphtile to configure API permissions for Microsoft Graph.
Click theDelegated permissionstile.
Select the following permissions, and clickAdd permissions.
- Email
- openid
- Profile
- Directory.AccessAsUser.All
- User.Read
- User.Read.All
- User.ReadBasic.All
Additional permission for Intune NAC check:

All Azure AD applications that call thehttps://login.microsoftonline.comor thehttps://graph.windows.netservice endpoints require the API permission to be assigned for the gateway to be able to call the NAC API. The available API Permissions are:
- Application.Read.All
- Application.ReadWrite.All
- Application.OwnedBy
- Directory.Read.All
The preferred permission isApplication.Read.All.

For more details, seehttps://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-intune-service-discovery-api-endpoint-will-require/ba-p/2428040
Click theIntunetile to configure API permissions for Intune.
Click theApplication permissionstile and theDelegated permissionstile to add permissions for Get_device_compliance and Get_data_warehouse respectively.
Select the following permissions and clickAdd permissions.
- Get_device_compliance - Application permissions
- Get_data_warehouse - Delegated permissions
The following page lists the configured API permissions.
Navigate toCertificates & secretsand clickNew client secret.
Under theAdd a client secretpage, enter description, select expiry, and clickAdd.
The following screen shows the configured client secret.

Note

The client secret is displayed only once when it is generated. You must copy the displayed client secret locally. Use the same client secret along with client ID associated with the newly registered app while configuring the OAuth action on the Citrix Gateway appliance for Intune.

The application configuration on Azure portal is now complete.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring a Citrix Gateway application on the Azure portal

September 14, 2021

Contributed by:

September 14, 2021

Contributed by:

Configuring a Citrix Gateway application on the Azure portal

Prerequisite

To create Citrix Gateway App on Azure

In this article