SSO in Office 365 ProPlus on Citrix VDA/RDS - Sign in Prompt

Hello,

I've the same settup and saw the same problem.

I used the article https://support.citrix.com/article/CTX263465 but it doesn't solve my problem.

First of all I disabled MFA in azure ad for this tenant.  I think it's contradicorial to have SSO but enforce to use MFA.  Keep in mind, my customers are very samll ocmpanys and don't have azure ad premium or E3 E5.

Because this limitation, we cannot use trused ip to disable MFA only for the XenApp servers.

This is my problem:

When using seamless mode, Office 365 always asked to login and activation isn't stored.

The workaround is to login in a full screen and activate, but after a while, 30 days token, the login screen reappaer.

I create a support ticket at Citix (Citrix - 80222815) and they tolled me to add an adiditional regsitry key:

• HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Identity
• Name = DisableAADWAM
• Type = REG_DWORD
• Value = 1

So SSO was working already (you an test this by https://myapps.microsoft.com/your

After this change Office 365 was able to activate and token is update at %localappdata%\microsoft\office\16.0\licensing

Beacuse I don't understand the change in the registry (what I'm doing exactly) I created a case with Microsoft (Case 23508770).

I got 9 engineers in a periode of 2 months but nobody understands seamless mode.  The most of them where thinking I'm using office web apps because they where confused by login in with netsclaer/storefront.

After 2 months Microsoft concluded that this was a Citrix only problem and that the 2 registry keys (article + additional) may not been modified because this will disable mondern authentication.

Therefor I replied today to the solution of Citrix that there solotuin isn't supported by Microsoft.

I also asked that Citrix will taken this problem to Microsoft because they have an great relationship.

Today I use the Citrix solution that isn't supported.

With 30 days I will know if it is still working.

(when I remove the idnetity key in the registery and remove the tokens, it seem to work).

Kr,

Roel Niesen