Overview:
Users may be prompted for additional authentication when navigating to cloud store URLS if StoreFront Cloud is configured to use a federated identity provider.

Example:
Users may be prompted for Azure AD credentials when Using AAD for Authentication to cloud stores, even if the user has a valid Microsoft authentication token.

Scenario

• Authenticate to an existing O365 or Azure AD provisioned resource
• Browser retains the Microsoft authentication token for the session
• Navigate to the store URL  (configured to use AAD as the IdP)
• Previous authentication token is NOT accepted by the store
• User is prompted again prompted to provide Azure AD credentials to login to the store

IMPORTANT: 
Customers should consult their internal security teams before requesting an exception to determine which settings are best for their environment and security posture.

This behavior can now be modified directly by the following Cloud setting:

• Always prompt end users for their credentials:
  • "StoreFront Cloud\Customize\Preferences\Store sessions"

Note: This feature alone does not allow Single Sign-On into a Desktop VDA or Published Application session, and Citrix Federated Authentication Service (FAS) will be required to be in place for Single Sign-On to occur. Learn more here.

Problem Cause

• Citrix recently made a change with within the Azure AD StoreFront Cloud integration to resolve a security concern.
• To ensure that a user is properly and securely authenticated when accessing a cloud store, the Engineering team has added the “prompt=login” parameter to every authentication request to the IdP of record.
• This parameter forces the user to be prompted for authentication whenever there is not a valid session.
• This was done to align with Industry-standard security practices.

Users may be prompted for additional authentication when navigating to cloud store URLS if StoreFront Cloud is configured to use a federated identity provider.

Customize security and privacy policies:

https://docs.citrix.com/en-us/citrix-workspace/experience/sessions 

Microsoft has documented how Azure AD should be configured for applications that use “prompt=login”:

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/ad-fs-prompt-login

Citrix CTP Contributions:

https://jkindon.com/2019/09/20/azure-ad-and-citrix-workspace-sso/