1. Check the On-prem Delivery Controller / DaaS Broker Site configuration:
   Open PowerShell as administrator and run:

    

    

    

   asnp citrix*
   Get-BrokerSite | Select-Object RequireXmlServiceKeyForNFuse, RequireXmlServiceKeyForSta, XmlServiceKey1, XmlServiceKey2

   Output showing the requirement is enabled:

    

    

    

   RequireXmlServiceKeyForNFuse : True RequireXmlServiceKeyForSta : True XmlServiceKey1 :

2. Check the StoreFront Store Farm configuration:
   On the StoreFront server, open PowerShell as administrator and run:

    

    

    

   asnp citrix* Get-STFStoreService | ForEach-Object { Get-STFStoreFarm -StoreService $_ | Select-Object FarmName, Servers, TransportType, Port, XMLValidationEnabled, XMLValidationSecret }

   Output showing validation is disabled on StoreFront:

    

    

    

   FarmName : Framname XMLValidationEnabled : False XMLValidationSecret :

This issue occurs when the Citrix Delivery Controller or Citrix DaaS site is configured to require XML Service Security Keys (RequireXmlServiceKeyForNFuse = True), but the StoreFront Store Farm configuration does not have XML Validation enabled (XMLValidationEnabled = False).

Because StoreFront does not attach the expected shared secret key in the request header, the Citrix XML Broker (wpnbr.dll) rejects the background health check (TRequestServerFarmData) and user enumeration requests with an HTTP 401 Unauthorized error. StoreFront then marks the Delivery Controllers / Cloud Connectors as Failed in its active service pool.

Choose one of the following options:

Option 1:If XML keys are not required, disable XML Service Key Requirement on the Broker 
Run the following PowerShell command on the Delivery Controller or via Citrix Remote PowerShell SDK:

asnp citrix*
Set-BrokerSite -RequireXmlServiceKeyForNFuse $false -RequireXmlServiceKeyForSta $false

Option 2: If Secure XML validation is required in your environment, enable and Match XML Validation on StoreFront
1.Note the active XmlServiceKey1 string from the Get-BrokerSite output in the Verification step above.

2.On the StoreFront server, configure the farm with the key and enable validation:
asnp citrix*
# Replace StoreName with your store name (e.g., /Citrix/Store)
$Store = Get-STFStoreService -VirtualPath "/Citrix/StoreName"
# Replace FarmName (default is "Controller") and paste the XmlServiceKey1 value
Set-STFStoreFarm -StoreService $Store -FarmName "Controller" -XMLValidationEnabled $true -XMLValidationSecret "XmlServiceKey1"
Restart IIS on the StoreFront server to apply the changes.
iisreset
If using a StoreFront Server Group, propagate changes to all member servers from the StoreFront Management Console.

• Users log in to the Citrix StoreFront web or native Workspace App and see: "Your home looks empty" or no resources/desktops/applications are enumerated.

• StoreFront Server Windows Event Viewer > Applications and Services Logs > Citrix Delivery Services logs the following events:

  • Event ID 4012 (Citrix Store Service):

    None of the Citrix XML Services configured for farm Controller are in the list of active services, so none were contacted.

  • Event ID 4010 (Citrix Store Service):

    The Citrix XML Service at address :443 has failed the background health check and has been temporarily removed from the list of active services. Failure details: The Citrix XML Service object cannot find an auth header. This message was reported from the XML Service at address https:///scripts/wpnbr.dll [NFuseProtocol.TRequestServerFarmData].

• Network connectivity (Test-NetConnection on port 80 or 443) to the Delivery Controller / Cloud Connector is successful.

• Switching transport between HTTP (port 80) and HTTPS (port 443) results in the same failure.