Provide pass-through auth on-prem Citrix EntraID-joined clients Windows Hello Modern Auth

[Björn Schläfli]

Is it possible to provide pass-through authentication to EntraID-joined clients for a on-prem Citrix Virtual Apps & Desktops site using Windows Hello for Business modern authentication?

It is possible to authenticate by upn and password on the entraid-joined client, what lets pass-through authentication to the on-prem site work.

But the users, which use modern authentication like face recognition or PIN are able to open Citrix Workspace App and see all the apps they have access to, but they're authenticated using AzureAD\... (which is understandable). What are my chances to provide sso pass-through authentication to them?

I know this one: Domain pass-through to Citrix Workspace using Azure Active Directory as the identity provider -> But we don't use Citrix Cloud

Do I need FAS and how do I have to configure it for this?

I already know how to configure FAS for using it with Citrix Netscaler Gateway and EntraID SAML.

[Björn Schläfli]

Domain pass-through access matrix | Citrix Workspace app 2402 LTSR for Windows

Nothing of this article fits to my environment. 

What I need:

Endpoint joined to -> AAD

IdP -> AAD

VDA joined to -> AD

Windows Hello / FIDO2 SSO to VDA -> How?