human body muscles

Manually creating a Service Principal for XenDesktop Essentials

I have been looking at the customer experience around XenDesktop Essentials lately, and I have helped a few customers with issues around defining their Service Principal accounts.

Backing up a bit.  What is this Service Principal account and what is it used for?

The Service Principal is the username / secret that is used by Citrix Cloud to talk to the Azure API and perform machine lifecycle actions in your Azure Subscription.

You could call it a delegated user, or an application user, or simply an application account.
The Service Principal is not a new concept in the enterprise world.  In my background we always created very restricted user accounts for use by applications, granting only those permissions that were necessary for the application to perform its functions.

I know there is guidance on using various PowerShell scripts to do this.  But quite honestly, it is so few clicks in the Azure Portal, you might as well do it there.  Far less hassle than installing the Azure cmdlets.

Plus - by doing it this way, you can quickly identify if you have the permissions necessary, and get it fixed or pass the responsibility to the person that can do it.

First, login to the Azure Account that Citrix will be deploying workstations to.
Next make sure that you have a subscription container for the Citrix stuff and a Virtual Network for the workstations to use all ready to go.

Create the App Registration / Service Principal

1. Select the Azure Active Directory blade in the Azure Account
2. Select App registrations
3. Select Add +
4. Enter a name, leave the application type as web app / API, and enter a Sign-on URL such as https://localhost/xde
5. Select Create

1. Once the registration is created, select it to view its settings
2. Select Required permissions
3. Select Windows Azure Active Directory
4. Select Sign in and read user profile and
5. Select Read all users basic profiles
6. Select Save
7. Select Add, Select an API, Select Windows Azure Service Management API, Select Select
8. Select Access Azure Service Management as organization users
9. Select Select
10. Select Done

1. In the Settings, Select Keys
2. Enter a Key description, select a duration
3. Select Save
4. Copy the Value of the key  (this value is necessary when this Service Principal is used with Citrix Cloud - and there are warnings that you can never see this key again)

1. Select the Billing Blade
2. Select the Subscription that you would like Citrix Cloud to be using
3. Select Access control
4. Select + Add
5. Under Role select Contributor
6. Under Select, type in the name of the App Registration you created (mine was xendesktop)
7. Select the Azure AD user
8. Select Save

visit link download