How to extend your on premises XenApp XenDesktop environment to Citrix Cloud XA XD Service and Microsoft Azure

For the longest time when I was still a Citrix Admin I did not fully understand what Citrix Cloud was. Years ago when I first heard this term I thought to myself, “Yup, as if we need another Azure or AWS to enter the playing field”. This is one of the biggest misconceptions I still have to clear up now as I consult with customers and help them optimize their environments. Citrix Cloud really has nothing to do with the “cloud” in the sense of putting workloads in it. Citrix Cloud is just really a group of services (think PaaS as in Platform-as-a-Service) that helps make a Citrix Admin’s life easier. These services just happen to live in the cloud, mostly within Azure and a bit in AWS because Citrix chose a multi-cloud strategy for their services like many companies. Citrix pays them directly to host these services just like you would as a customer. There is no compute or resources in Citrix Cloud, those still reside in either your datacenters, Azure, AWS, or whatever cloud provider(s) your company decides to align with. Citrix Cloud just helps you stay flexible to get to where you want to be operationally in a much quicker way.

Why should all Citrix Admins be reading this?

The XenApp XenDesktop Service in Citrix Cloud is usually what most people are interested in when I talk to them about simplifying their Citrix environment. Not every service in Citrix Cloud may be right for your company and that’s okay, it’s a-la-carte and you can pay for what you want to use. Beyond even the Citrix product stack, part of my job is to help companies figure out what cloud technologies to utilize and what to leave on prem for a hybrid cloud approach. I’m not a do everything in the cloud cheerleader by any means, I take a pragmatic approach based on the company’s needs. There are also some free services in Citrix Cloud that you get as part of your Support renewal that I really like such as Smart Check in the Smart Tools Service which can run all sorts of health and config checks in your environment or even utilize other tools like the Citrix Optimizer check. If you’re a NetScaler user, I even wrote about another useful service in Citrix Cloud I like called NetScaler MA Service here: http://www.jasonsamuel.com/2017/11/07/using-netscaler-ma-service-in-citrix-cloud-to-monitor-and-manage-all-your-netscalers-easily/

I never understood the value of the XenApp XenDesktop Service when I was still on the admin side and in charge of day to day operations. I led a large team of Citrix Admins and we were a pretty nimble bunch, the day a new version of NetScaler or StoreFront drops we’d already have it in our Dev environment and were playing with it. We hungered for new technology to make our environment better. Now after doing full time consulting and working with so many companies I have found only a handful can move at this pace. Many times operational barriers, head count, office politics, lack of education, archaic change management, or some other dependencies prevent a company from moving forward at the rate their users need. And this in turn sometimes leads to black eyes for the Citrix team because Citrix is a technology with a lot of dependencies that all need to work really well in order for the users to have a good experience.

Simplification. If I could sum up XenApp XenDesktop Service in one word I would call it that. When Citrix decided to make XenApp more modular by moving from IMA to FMA architecture in 7.x this changed everything. The dependency on SQL was more important than ever. The second SQL or the network had a blip or a slow down, your XenApp users would be impacted. Later on LHC was retooled and reintroduced but you still have a massive dependency on SQL. When you start getting into geographic distances between data centers, suddenly the SQL latency starts coming into play and you have to worry if you are deploying the right architecture for your environment. Build silos or use zones? What about future state? What about your company acquiring another and flipping your design on it’s head? So many variables. Even with countless white boarding sessions and design reviews you’re never fully sure that’s the architecture that will stick around for the next 5+ years as your company grows.

Hows does XenApp XenDesktop Service help simplify?

It gets rid of stuff that takes up your time maintaining so you can concentrate on more important things.

No more of these:

• SQL
• Delivery Controllers
• Studio
• Director
• License Server
• MPLS or other expensive dedicated circuits between datacenters (at least from a Citrix infrastructure perspective, other stuff you may do will need them of course.)

XenApp XenDesktop Service takes all these roles in and Citrix manages it for you. SQL is still there, but you never touch it or are exposed to it. Delivery Controllers are still there, but you manage it through your browser in a cloud hosted Studio and Director. They handle the License Server aspect too. For MPLS, I’m not advocating severing you links between datacenters, you’ll still want that for other things like application/database dependencies, file transfer, backups, home drives, mapped drives, etc. I just want to point out that from a Citrix infrastructure dependency stance, you don’t need any traffic going between them (like worrying about SQL latency over a circuit with a traditional all on prem deployment).

XenApp XenDesktop Service uses so many POPs (point of presence) that you really don’t need to worry about latency when you are talking about geographically dispersed datacenters. Basically there will always be an Azure or AWS datacenter close to your own datacenters that latency is not going to be an issue.

Look at this map of Azure datacenters for example, do any of your current datacenters or users sit close to these blue dots? Go ahead and click on the picture for a larger version where you can see all 42 Azure regions clearly. There’s a really good reason Microsoft builds their datacenters where they do. It’s about being strategic:

So what the heck do I manage?! Am I out of a job?

You manage the VDAs, so XenApp servers and Windows 10 virtual desktops. You manage Receiver. You manage profiles, personalization, group policy. You manage the apps or the app owners that install the apps that go into your VDAs. You manage the images. You manage all the things that you currently do. You still manage things within Studio and Director, there is no managed service here where Citrix is pushing the buttons for you. You are still fully in control of the success of your environment.

Let me tell you how you ARE going to be out of a job. Citrix has gone from MultiUser, to WinView, to WinFrame, to MetaFrame, to MetaFrame XP, to MetaFrame Presentation Server, to Presentation Server, to XenApp IMA based architecture, and then finally to XenApp FMA based architecture. Every time this happened you sharpened your skills and had to learn how to use it. Sink or swim. If you swam, you kept your job. If you didn’t keep up with the tech, you would be laid off and someone eager to learn would take your place. This is exactly what is happening with Citrix Cloud XenApp and XenDesktop Service. The momentum for a cloud based control plane to plug into your FMA infrastructure is what this is about. And it’s not losing any steam. Citrix is very focused on the services in Citrix Cloud and is already developing new features there first before they come to on premises only versions. It’s not just Citrix, it’s every software vendor. It’s every app on your phone or website you use. They all have some aspect of cloud computing to help simplify things.

No matter which vertical you work in, you need to be looking at the services offered in Citrix Cloud and learning what it can do at the very least. In my opinion this is a great resume builder. I remember when I was leading a Citrix team, when hiring people and I saw a resume that was showcasing work with Presentation Server when 7.x had been out for so long I always had to do a double take. I don’t mean to sound stuck up but this either meant the environment for this person was so hostile he or she couldn’t convince anyone of change, or they themselves were the problem and were not in love with technology enough to go out there and learn something new every day they came to work. We were on 7.x pushing boundaries, I sympathize with the first type of person but I have no use for you if you’re the second type. If you want to stay employable going forward when pretty much every company has some kind of cloud initiative or at the very least is webifying apps (as in stop using installed Windows apps and using ones accessed via web browser instead) you need to evolve BEFORE your company does and anticipate it’s needs, not sit around waiting.

I was on a trip recently and someone told me, there are two types of people in an organization. Those that fight change till the end until they get replaced, and those that understand and embrace the change and get to stick around. I thought about this on the flight home and it’s the classic “Who Moved My Cheese?” scenario. It’s a great book an old manager gave to me much earlier in my career: https://en.wikipedia.org/wiki/Who_Moved_My_Cheese%3F. Give it a read and think about where you are going in your career as you make your decisions.

How do all these things in XA XD Service connect back to my on prem XenApp/XenDesktop environment?

That’s the beauty of this. For every datacenter you have VDAs in, you need 2 plain jane servers with no roles installed on them. Your standard server image will probably do just fine. Server 2016 or Server 2012 R2 both work fine. On these servers you install a little agent called “Citrix Cloud Connector”. This little guy is what connects all those pieces in the XA XD Service back to your VDAs. It does this securely over HTTPS (port 443). No VPN tunnel or special circuit like ExpressRoute for Azure or Direct Connect for AWS needed. It’s just outbound Internet traffic. I’ll walk you through the whole setup later down below, it’s just a couple of minutes work and you’re done.

The Connectors get auto updated when they check in with the Citrix Cloud control plane and only one at a time if there is an update available. You just manage Windows Updates on the servers like normal. Everything in the Citrix Cloud control plane (SQL, Delivery Controllers, etc.) get updated every 2 weeks automatically by Citrix and you won’t even notice it because maintenance is done while keeping everything highly available. Just think of them as always up to date with the latest code. Will XA/XD Service be bug free. No, of course not. Nothing is bug free. There are bugs in on prem versions as there are in cloud versions of anything. Heck I just reported a bug in Netflix the other day. But which will get fixed first and into prod without you ever having to lift a finger? Yup, the cloud version.

Option 1 – Cloud Hosted StoreFront and NetScaler

There are two ways to extend your on premises XenApp and XenDesktop environment to this new XA XD Service control plane. The first option is to leverage cloud hosted StoreFront and NetScaler Gateway Service. In their current state they are too simplistic for my taste and most of my customers. Cloud hosted StoreFront is already in the process of being replaced by the new Workspace experience (more on this later) and NetScaler Gateway Service (NGS) will become more robust this year. I predict I’ll be doing more of these kinds of deployments this year, especially as customers with NetScalers that only use the gateway functionality come up for hardware refresh. Depending on their use cases and ELA agreements it may be more cost effective for some customers to use NGS.

Option 2 – Using On Premises StoreFront and NetScaler

The second option is to use your existing NetScalers and StoreFront if you have them available. This is what I’ve been doing mostly for flexibility reasons but I predict in 2018 this will change because the cloud versions of these components are going to get more features, more on this later:

Option 3 – Using Microsoft Azure to help leverage workloads

There is also a third way to extend your on premises environment and this is more around the workloads. Some companies want to treat Azure as their datacenter and therefore deploy VDAs there. I’ve been doing quite a bit of this lately too and in my opinion, this is the route I would recommend to most Fortune 500 companies out there. It just makes financial sense to get out of the datacenter “business” so you can spend more time developing good platforms and user experiences for your users. This unlocks all those Azure regions I talked about above and you can remain highly flexible to offer a low latency Citrix experience to wherever your users are located in the world:

How do I start using XA XD Service?

Well let’s get down to it then. If your company hasn’t bought it as part of a license renewal already, just use the trial like I do for my customers when they want to test it out.

1. Login with your MyCitrix ID at https://citrix.cloud.com

2. You’ll see a service tile for the XenApp XenDesktop Service. Click on it to start the trial. One thing I’ve run into is people worried to click this button because time starts counting down and they’re afraid they don’t have enough time to do their testing with all the other responsibilities they have. Don’t worry about that, if you run out of time talk to your local Citrix SE for help and they can work something out. No one should be afraid to request a trial:

3. It’s going to pop up with this little questionnaire to fill out. Go ahead and select your answers. I like the drop down for use cases because it is basically telling you some of the ways of using the service to your company’s benefit:

4. Then the service tile will say View trial status like this:

5. When you click it, it will say this:

6. It is not an immediate approval. I’ve seen it take as much as a few days to get the trial approved and provisioned for you. At this point I usually get a bit of coffee and go work on something else. And if you know me, well this picture is not an exaggeration. 🙂 :

7. Once you are approved you’ll notice the XenApp and XenDesktop Service tile now says “Manage” which means it’s ready for you. Don’t click on it yet. Instead click “Edit or Add New” for the Resource Location. Adding your datacenter is the fundamental step to use the XA XD Service so I always start there:

8. The next screen will ask you to download the Citrix Cloud Connector the proxy or bridge if you will between your datacenter and the XA XD Service control plane. Go ahead and hit the blue Download button:

9. The file is a little 40 MB file called “cwcconnector.exe”. Don’t run it yet. If you do try and run it it’s going to fail during install. Instead, right click on it and go to Properties:

10. You will see at the bottom of the General tab it will say “This file came from another computer and might be blocked to help protect this computer”. Check the “Unblock” check box and hit OK:

11. Now the second critical step to install it, right click on the executable and “Run as administrator”:

12. Click Yes at the UAC prompt:

13. The first thing it does is try and see if it can reach the Citrix Cloud control plane. In many of my customers datacenters, outbound Internet access is blocked from the server subnet so it has to be cleared on the web proxy and firewall to allow for this communication to work. Citrix has documentation on what you need to allow here, it’s just outbound 443 communication to these URLs: https://docs.citrix.com/en-us/citrix-cloud/overview/requirements/internet-connectivity-requirements.html. For other people who don’t have to allow this communication, the Connectivity Test will say Successful pretty quickly like this:

14. Now the next step is to sign in with your MyCitrix ID using the same account you used to login to citrix.cloud.com earlier in a web browser. Hit Sign In:

15. Enter your credentials and hit Sign In:

16. Installation will kick off:

17. It’s actually a really quick install, if you blink you’ll miss all the little stuff it tells you its doing:

18. And then it does one more Service Connectivity test to register the agent in Citrix Cloud:

19. Hey look! The agent tells me to get more coffee! 🙂

20. Connectivity Test Successful!

21. Now open up your Windows Services and you’ll see exactly what the Citrix Cloud Connector is composed of. It’s just a bunch of services.

And if you want to see the install logs for each of these services they are in:

C:\ProgramData\Citrix\WorkspaceCloud\InstallLogs

And for current Citrix Cloud Connecter Agent logs go to:

C:\ProgramData\Citrix\WorkspaceCloud\Logs\InProgress

22. Go to Programs and Features and you can see the Citrix Cloud Connector has been installed as well as the support Microsoft Visual C++ 2015 Redistributables for x86 and x64:

23. No go back to the web browser you still have open and hit Refresh, doesn’t have to be on the server and can be on your workstation’s web browser. Cloud doesn’t care where you are. 🙂

24. You’ll notice it will say My Resource Location now and have 1 Cloud Connector. The background is orange because it is warning you that you should deploy 2 so that it’s highly available.

25. If you click on it you’ll actually see the FQDN for the first server you just installed the Cloud Connector on here. You can see I only have a CC01. There is a warning message along the top saying “To maintain high availability, we recommend at least two connectors in the Active Directory forest that this domain is a member of.” There’s no load balancing or anything you have to do. Remember, this is outbound traffic and the XA XD Service will intelligently handle all that. All you need to do is bring up another server and install the Cloud Connector just like you did the first one.

26. Before you do that go back a screen and click the 3 dots. Hit the Rename button.

27. Change the name to the datacenter name you just installed the Connector in. In my case I installed it in my “Houston Datacenter”:

28. I’m going to spare you screenshots of me installing another Cloud Connector, it’s just as quick and easy as the first one. Once it checks in you’ll see the orange has now turned to grey and will say 2 Cloud Connectors for your datacenter:

29. When you click the tile you’ll see both Cloud Connector server FQDNs on the next page. That’s it, you’re done! You’ve now successfully bridged your XenApp/XenDesktop environment with the Citrix Cloud control plane. Updates to the Cloud Connector are handled by Citrix as the server checks in with the control plane and reboots are staggered once a rebooted VM is detected to be back up (and that’s assuming a reboot is involved). There is a great deal of intelligence at work here. Even if by accident your SCCM Admin or something reboots both servers at the same time for Windows Updates for example, don’t worry. It does not impact any ICA sessions as those are already brokered connections between Receiver and wherever the VDA is located. This traffic is being proxied via NetScaler on prem or NetScaler Gateway Service on 443 and is independent of control plane traffic.

30. Go back to the citrix.cloud.com home page and hit Manage under the XenApp and XenDesktop Service tile now:

31. A bunch of stuff describing how the XenApp and XenDesktop Service works. Read it over, you’ve already done this. Just hit Manage Service:

32. Hey look, it’s Studio! Yup, it’s the same Windows MMC driven Studio you are used to delivered via web using an HTML5 Receiver session. The first thing you should do is click the Zones module in the left nav. Yeah I know, most of us head straight for Machine Catalogs or Hosting in a new Citrix environment but when it comes to Citrix Cloud XA XD Service, Zones is where you need to start:

33. You’ll get the pop up telling you how Zones work. It’s just like on prem, Zones are used to group resources in geographic regions together. Even if you only have 1 datacenter, you now really have 2. Citrix Cloud’s XA XD Service is your control plane so it will see your datacenter as a zone. Go ahead and click Close on the popup:

34. You can see when the Connectors checked in and I had renamed it to “Houston Datacenter”, it all happened here in the Zones section as well. You can see my Houston Datacenter has my two Cloud Connector servers in it. If I have more than 1 datacenter I’d drop Cloud Connectors in that datacenter too and then it would show up as another zone for me to use:

35. Go to Hosting in the left nav and hit Add Connection in the right nav. Hit the Connection Type dropdown and you can see all the options. This is the key piece for a company’s cloud strategy. The ability to spin up XenApp or XenDesktop workloads anywhere. On prem or in a public cloud provider. You can see your options at the time of writing this article are:

On Prem:

• Citrix Xenserver
• Microsoft System Center Virtual Machine Manager (for Hyper-V)
• VMware vSphere

Public Cloud:

• Microsoft Azure (ARM)
• Microsoft Azure Classic (yeah, don’t use this. You should be using ARM)
• Amazon EC2

36. Many of my customers want to start with managing the VDAs in their datacenter so VMware vSphere is usually the first option configured. You can see all you need to do is point it at vCenter and give it some service account credentials that have access and you’re ready to start managing. But wait, how do you log in with a domain account in this new cloud based Studio?

37. Because you installed Cloud Connector on a domain joined server, it knows about your domain and can now automatically use it just like any other app installed on a domain joined server. In the top left click the 3 bars (hamburger) and click Identity and Access Management:

38. Now click the Domains tab:

39. You can see the Forest name, the Functional Level (in my case Windows Server 2016), and my Houston Datacenter with the FQDN of both my Cloud Connector servers. And if you click the 3 dots you can always disable a domain from being used by clicking “Do not use” if you want:

40. Another little tip I want to share. Citrix Cloud by default will not notify you of issues because Citrix doesn’t want to spam you without your consent. So in the top right go click on your name and go to your Account Settings. Click on the My Profile tab and flip on Email Notifications. Leave the default Error, Warning, and Informational events on. In the future I wish to see some kind of reminder notification along the top letting you know you haven’t flipped on notifications so more people know they need to flip this on to get emails:

41. Back in the XenApp and XenDesktop Service, click the little drop down next to Manage and click Service Delivery:

42. Now you’ll see the options for Cloud Hosted StoreFront and NetScaler Gateway Service. I have honestly been deploying XA XD Service with on premises versions of StoreFront and NetScaler Gateway for customers because they already had them and they are far more customizable. Cloud Hosted StoreFront is about to be replaced by Workspace which is 10x better and more customizable. It is already rolling out to people’s accounts and I’ll do a separate article on that soon.

43. If you do use the Cloud Hosted StoreFront right now you’ll notice it gives you a URL that ends in xendesktop.net:

44. If you would like to use your own NetScaler Gateway for SSL ICA proxy, just uncheck the button and specify the URL:

45. And what about Director? Click the Monitor button (and make sure Ad Block is off in your browser or it might get stuck at Loading for a while):

46. And then you’ll see the same Director you have always known just like Studio. Also note along the top you have options for Trends, Filters, Alerts, and Applications:

47. Under Trends you have options for all the reports managements your boss is usually interested in:

• Sessions
• Failures
• Logon Performance
• Load Evaluator Index
• Capacity Management
• Machine Usage
• Resource Utilization
• Application Failures
• Custom Reports

48. Under Alerts you can setup all the alerting you like and specify your SMTP server. It supports SSL/TLS as well:

49. If you click Downloads you’ll notice you can download a PowerShell SDK. This is the XenApp and XenDesktop PowerShell SDK that is similar in function to Azure PowerShell. It allows you to manage the control plane from your desktop or laptop. It will prompt you for your Citrix Cloud account credentials similar to how Azure PowerShell prompts you for your Microsoft Azure subscription credentials.

50. When you are on the Download page, expand the View Documentation area and click Documentation:

51. And that will take you to the latest PowerShell documentation with all the cmdlets you need to manage the XenApp and XenDesktop Service control plane in a programmatic fashion. Notice the Get-XdAuthentication cmdlet to authenticate with:

52. And if you scroll down to the bottom it talks about accessing the Monitor Server (cloud based Director) OData API in Citrix Cloud. There’s also a Tech Preview of the Catalog Service API if you’d like to try that out:

Final Thoughts – Pretty easy right?

I hope this little intro guide has helped you see how you can use utilize Citrix Cloud to make your life easier. The XenApp and XenDesktop Service has undergone a ton of work since I first saw it and I really think it’s at a point where it brings a lot of value to the table. You should definitely be using it or at the very least be learning how it all works so you are in a better position to help your company evolve to a modern hybrid cloud based model as well as keep your skills sharp and marketable. If you have any questions or comments please feel free to leave them below.

Jason Samuel

Jason Samuel is a visionary product leader and trusted advisor with a proven track record of shaping strategy and driving technology innovation. With extensive expertise in enterprise end-user computing, security, cloud, automation, and virtualization technologies, Jason has become a globally recognized authority in the IT industry. His career spans consulting for hundreds of Fortune 500 enterprises across diverse business sectors worldwide, delivering cutting-edge digital solutions from Citrix, Microsoft, VMware, Amazon, Google, and NVIDIA that seamlessly balance security with exceptional user experiences.

Jason’s leadership is amplified by his dedication to knowledge-sharing as an author, speaker, podcaster, and mentor within the global IT and technology community. Recognized with numerous prestigious awards, Jason’s contributions underscore his commitment to advancing technology and empowering organizations to achieve transformative results.  Follow him on LinkedIn.