Executive Summary
Project Overview
This project delivered a complete Citrix DaaS environment migration and platform re-architecture for a large enterprise healthcare organization. The existing Citrix infrastructure was deployed in a legacy Azure environment with no structured landing zone, inconsistent networking, and manual provisioning workflows.
The migration program re-established the entire Citrix DaaS platform on a new Azure Landing Zone foundation — including Hub-Spoke networking, identity integration, policy governance, and modular Infrastructure-as-Code pipelines. All production workloads were migrated with zero unplanned downtime.
Problem Statement
Challenges & Business Drivers
Legacy Environment Pain Points
- Citrix DaaS deployed in an unstructured Azure environment with no formal Landing Zone
- Flat networking with no Hub-Spoke segregation, creating security and compliance risk
- Manual golden image builds with no automation or version control
- Citrix Cloud Connectors and FAS servers provisioned ad hoc with no IaC
- No consistent Azure Policy enforcement — resources drifting from security baseline
- Multiple overlapping VDI pools with no lifecycle management process
- FSLogix profiles stored on legacy file servers without Azure Files integration
Business Objectives
- Migrate all Citrix DaaS workloads to a secure, governed Azure Landing Zone
- Eliminate manual provisioning with full IaC coverage (Bicep + PowerShell)
- Enable rapid, repeatable golden image deployments via automation pipelines
- Improve security posture with Azure Policy, RBAC, and network segmentation
- Zero unplanned downtime during the migration program
Architecture
Target State Architecture Diagram
Figure 1 — Target State: Citrix DaaS on Azure Landing Zone (Hub-Spoke Architecture)
Delivery Approach
Migration Phases
| Phase | Name | Activities | Status |
|---|---|---|---|
| 1 | Discovery & Export | Inventory legacy Citrix environment. Built modular PowerShell export framework to capture all machine catalogs, delivery groups, policies, connectors, and application configurations. Documented existing networking topology and identity dependencies. | ✅ Complete |
| 2 | Landing Zone Foundation | Deployed Hub-Spoke VNet topology using Bicep modules. Configured Azure Firewall, Bastion, Private DNS, NSGs, route tables, and Azure Policy assignments. Established identity integration via Entra ID Connect. Configured Log Analytics workspace and Defender for Cloud. | ✅ Complete |
| 3 | Citrix Platform Build | Provisioned Citrix Cloud Connectors (HA pair) via Bicep + PowerShell. Deployed FAS servers for federated authentication. Built new golden image using automated factory pipeline. Configured FSLogix profile containers on Azure Files. Registered connectors with Citrix Cloud and validated connectivity. | ✅ Complete |
| 4 | Phased User Migration | Created new machine catalogs and delivery groups mirroring the legacy environment. Executed phased user onboarding (pilot → department groups → full production). Legacy VDIs placed into maintenance mode progressively. Post-migration validation, FSLogix profile verification, and performance baseline captured. | ✅ Complete |
Technical Details
Solution Components
Azure Landing Zone — Hub-Spoke Foundation
- Hub VNet with Azure Firewall for centralized egress and traffic inspection
- Azure Bastion for secure, RDP-free administrative access
- Private DNS zones for internal name resolution across spokes
- Entra ID Connect for hybrid identity synchronization
- Azure Policy initiative for Citrix DaaS compliance baseline
- Log Analytics workspace integrated with all resources for unified monitoring
Citrix DaaS Platform — New Deployment
- Citrix Cloud Connectors deployed as HA pair via Bicep, auto-registered to Citrix Cloud tenant
- FAS (Federated Authentication Service) servers for seamless SSO and certificate-based authentication
- WEM (Workspace Environment Manager) agents deployed across all VDA pools
- Machine catalogs created from golden image with PowerShell provisioning automation
- Delivery groups recreated with matching access policies, tags, and priority groups
- 50+ application catalogs migrated and validated pre-cutover
Automation & IaC Framework
- Bicep modules for: VNet/Subnets, NSGs, VMs, Storage Accounts, Key Vault, Log Analytics
- PowerShell export framework: full Citrix configuration capture to JSON/CSV
- Golden image automation: snapshot → Sysprep → catalog update pipeline
- CI/CD pipeline for automated Bicep deployments with parameter files per environment
- Post-deployment validation scripts for connector health, FSLogix, and session testing
Migration Flow
Legacy → Target State Migration Flow
Figure 2 — Four-Phase Migration Timeline & Delivery Sequence
Results
Outcomes & Business Value
Delivered Results
- 10,000+ users migrated to the new Citrix DaaS platform with zero unplanned downtime
- 50+ application catalogs validated and published to delivery groups
- 70% reduction in golden image deployment time through automation
- 100% IaC coverage — all infrastructure defined and repeatable via Bicep + PowerShell
- Azure Policy compliance baseline enforced across all Citrix resources from day one
- FSLogix profiles migrated to Azure Files with ADDS Kerberos authentication (AES-256)
- FAS federated authentication enabled seamless SSO across the new platform
- Legacy VDI environment fully decommissioned after phased cutover validation
Technology Stack
Tools & Technologies
Azure Services
VNet · Firewall · Bastion · Azure Files · Key Vault · Log Analytics · Policy · Defender for Cloud · Entra ID
Citrix Platform
Citrix DaaS · Cloud Connectors · FAS · WEM · Machine Catalogs · Delivery Groups · StoreFront
IaC & Automation
Bicep · PowerShell · Azure CLI · CI/CD Pipelines · Parameter Files · Validation Scripts
Identity & Security
Entra ID · ADDS · FSLogix · Conditional Access · NSG · Route Tables · RBAC