Limit access to published apps

[Acropolis Admin]

Hello,

 

We currently have 14 apps published in Citrix cloud with an on-premise VDA.  All AD users have access to all the apps, but we would like to setup 2 groups: one for management and one for regular users.  Management would have access to all apps and regular users would only have access to some apps.

 

Everything is configured in a single Delivery Group and users are managed via Library (and all AD users are currently subscribers to this Library offering).  Doing some research on this, I came across few posts on this forum that discuss limiting app visibility to users/groups by going to app properties and selecting users/groups.  However, it appears that this is not an option any more if the delivery groups are "Managed by Citrix Cloud": https://support.citrix.com/article/CTX285179/unable-to-limit-visibility-of-applications-to-specific-user-groups

 

I've reached out to Citrix support and their recommendation was to configure a new Library Offering.  However in order to do that, a new Delivery group has to be setup, which requires a new machine/VDA to be added to machine catalog and that's a whole lot of extra work and expense just to be able to restrict few users from accessing apps.

 

I looked at few other options, such as possibly creating application groups under Applications and then adding users to those groups, however it does not allow adding existing apps to the new application group.

 

Suggestions/advice would be much appreciated.

[James Kindon]

Ditch library subscriptions and use traditional studio based options - so much easier, so much more control, no fluff

[Acropolis Admin]

On 12/17/2022 at 5:45 PM, James Kindon said:

Ditch library subscriptions and use traditional studio based options - so much easier, so much more control, no fluff

 

Could Studio work with existing environment? Or would have have to setup new VDA, Delivery Groups, etc?

https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/install-configure/install-core/install-web-studio.html

 

[James Kindon]

You already have access to Studio if you have DaaS - you need to go into the DaaS service and select the studio drop down, then change your delivery groups 

 

[Acropolis Admin]

I'm not seeing the option for Studio anywhere.  Here's a screenshot of what I see when I get into DaaS

 

[James Kindon]

That is studio ? Click on Delivery Groups and go from there ? 

[Acropolis Admin]

16 hours ago, James Kindon said:

That is studio ? Click on Delivery Groups and go from there ? 

I looked at that too, but I am not seeing the same options as your screenshot.  There's no option to restrict users from Delivery Group menu. That is most likely due to it being managed by Citrix Cloud:

 

 

[James Kindon]

Ah fair play, just create a new DG - I don't think they can be switched (might be a backend way but likely faster just to create a new one)

[Acropolis Admin]

After Citrix support wasted a bunch of time and being no help at all, I was able to eventually figure this out on my own so I wanted to provide an update in case someone else comes across same issue.

 

If you navigate to Applications, right click on an app, and open properties there's supposed to be an option to "Limit Visibility" where you can specify groups/users, however that wasn't showing up for me.  I found that if I remove the app and then add it back, the "Limit Visibility" option was then available.  No idea why that makes a difference.

 

Ultimately what I ended up doing was creating an Application Group and assigning users/groups to that app group.  This is something I tried to do initially, but I wasn't able to add existing apps to this group.  I'd have to go back and add an app to Delivery group (creating a duplicate) in order to be able to add it to the group I was trying to restrict.  What I found out is that if you open properties for an existing app and click on Groups,  you can assign it to the newly created group from there without issues and that's what I ended up doing.  For the apps that were supposed to be restricted, I removed them from any other groups and added them to the Restricted apps group.  The rest of the apps stayed in the default Delivery group and were accessible by everyone.

 

Simple solution and it worked out great.