Citrix Cloud SSO Repeated MFA Prompts,Users experience repeated MFA prompts when accessing resources via Citrix Cloud despite successful authentication.

book

Article ID: CTX696739

calendar_today

Updated On:

Description

Users report repeated MFA prompts during Citrix Cloud login despite successful authentication.

Observations:

  • Issue occurs only with Citrix Cloud SSO
  • Local StoreFront authentication works as expected
  • VDAs are on-premises and functioning normally
  • Cloud Connectors are healthy and not reporting issues

Analysis:

  • Authentication was falling back to Entra Connect Seamless SSO
  • Seamless SSO relied on Kerberos keys using RC4 encryption
  • Recent Windows updates deprecated RC4 cipher support
  • This caused authentication failures, resulting in repeated MFA prompts

Environment

This article is provided for informational purposes only and reflects the specific scenario observed in this case. The behavior described may vary depending on environment configuration, product versions, and external dependencies such as Microsoft Entra ID and operating system updates.

Citrix does not guarantee that the solution outlined will resolve all instances of similar issues. Customers are advised to validate the approach in a test environment before applying changes in production.

Any changes involving third-party components (for example, Microsoft Entra Connect, Kerberos authentication, or Windows updates) should be reviewed and implemented in accordance with vendor recommendations and organizational policies.

Cause

The issue was caused by an authentication fallback scenario involving Entra Connect Seamless SSO.

  • Citrix Cloud authentication was falling back to Seamless SSO
  • Seamless SSO relied on Kerberos keys using RC4 encryption
  • Recent Windows updates deprecated RC4 cipher support
  • This resulted in failed seamless authentication and repeated MFA prompts during login

Resolution

The issue was resolved by updating the Kerberos authentication configuration.

Steps:

  1. Identify the Entra Connect Sync server
  2. Rotate/reset the Kerberos keys used for Seamless SSO
  3. Allow changes to replicate across domain controllers
  4. Validate login via Citrix Cloud

Result:

  • Authentication fallback behavior was eliminated
  • Seamless SSO resumed normal operation
  • Users confirmed no further MFA prompts after key rotation

Issue/Introduction

Users are prompted for credentials and repeated MFA when logging into Citrix Cloud via SSO. On-premises domain is federated, and local StoreFront authentication works without issue. The behavior is observed only when accessing via Citrix Cloud.

Additional Information

Relevant Microsoft / Citrix Concepts

  • Entra Connect Seamless SSO relies on Kerberos tickets and encryption types
  • RC4 deprecation impacts environments where Kerberos keys are not rotated
  • Citrix Cloud SSO depends on upstream identity provider health (Entra ID / AD)

Recommended Validation Commands

  • dsregcmd /status → Validate Azure AD join and SSO state
  • klist → Verify Kerberos ticket encryption type
  • Check Entra Connect Sync health and recent changes

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Reference Articles 

Microsoft recommends using modern encryption methods such as AES for Kerberos authentication and periodically rotating Kerberos keys to maintain secure SSO functionality.

Powered by Wolken Software