Download the Citrix Workspace App
Citrix Workspace app is the easy-to-install client software that provides seamless secure access to everything you need to get work done.
Give users access to apps, not your network
Citrix SecurAccess ZTNA, helps organizations replace broad network access with secure, application-level access. Users, contractors, partners, and third parties connect only to the specific applications they are authorized to use — without exposing the broader corporate network.
Secure access for the applications people actually need
Citrix SecurAccess ZTNA helps IT teams provide access at the right level: the application. Instead of extending trust across the network, organizations can connect users to approved private, web, SaaS, and hybrid applications based on identity, device, and context.
Compared to a VPN, Citrix SecurAccess ZTNA delivers more flexible connectivity and better security
Remote and hybrid work
Liberate your workers from slow and glitchy VPNs with fast direct access to applications based on their identity
BYOD programs
Give your workers the freedom to use their personal devices (bring your own device, or BYOD) to securely access corporate resources in compliance with corporate security policies
Hybrid environments
Ensure consistent security policies for worker access to applications hosted across on-premises and cloud environments
Capabilities of Citrix SecurAccess ZTNA
Before establishing a session, Citrix SecurAccess ZTNA evaluates user identity and device posture to inform contextual access policies and single sign-on.
Citrix StoreFront integration
Citrix SecurAccess ZTNA integrates with Citrix StoreFront™ to provide a single access point for approved applications. Users can access web, SaaS, virtual applications, and desktops through a consistent SSO experience.
Adaptive authentication
Identity-aware authentication, including MFA, helps verify users before access is granted. Authentication requirements can adapt based on risk, with additional verification applied when users access sensitive applications or higher-risk resources.
Logging and monitoring
Detailed logging and monitoring help you meet regulatory requirements and improve your overall security posture.
Citrix SecurAccess ZTNA continuously evaluates access based on identity, device posture, location, and network context. Policies can dynamically allow, restrict, or require additional authentication as risk changes.
User identity
- Identity integration: Integrates with IAM providers including Cisco Duo, Ping, Entra ID, and Okta, with support for SSO and MFA.
- Role-based access: Applies least-privilege access based on user roles and permissions.
Device posture
- Continous assesment: Evaluates device security and compliance signals, such as OS status and endpoint security, before and during access.
Location and network context
- Location-aware access: Adjusts policies based on geographic location and associated risk.
- Network trust: Applies additional controls or blocks access from unknown or untrusted networks.
Citrix SecurAccess ZTNA supports both agent-based and agentless access, so you can apply the right level of control for different users, devices, and applications.
Agent-based secure access
Best for managed devices and environments requiring deeper endpoint controls.
- Continuous device posture assesment
- Advanced endpoint and access controls
- Dynamic access enforcement
- Secure tunneling and encryption
Agentless browser-based secure access
Best for unmanaged devices, contractors, partners, and temporary access.
- No software installation required
- Browser-based access to approved applications
- Faster onboarding for BYOD and third parties
- Continuous policy enforcement
Instead of granting broad network access, Citrix SecurAccess ZTNA provides access only to authorized applications, reducing exposure to unnecessary network resources.
Application-specific access controls include:
- Granular access: Grant access to specific applications based on user authorization.
- Contextual policy enforcement: Apply policies based on identity, device posture, role, and other risk signals.
- Continuous monitoring: Reevaluate access as context changes and require additional verification or revoke access when needed.
ANALYST REPORT
Careful considerations for choosing a zero trust network access product and vendor
What makes ZTNA with Citrix different
Citrix SecurAccess ZTNA extends zero trust access across virtual, web, SaaS, and client-server applications without adding another point solution.
Faster deployment
- Deploy as a cloud service or in a hybrid model.
Simpler management
- Manage secure access and application delivery through familiar Citrix tools.
- Gain end-to-end visibility and troubleshooting with Citrix Director and Citrix uberAgent® .
Consistent security
- Apply common identity, device posture, and contextual access policies across application types.
- Integrate with leading identity providers and enforce granular, least-privilege access.
Better end-user experience
- Give users SSO access to approved applications through a consistent Citrix experience.
- Provide secure access from different devices and locations without relying on traditional network-level VPN access.
Capabilities only Citrix SecurAccess ZTNA offers
On-premises deployment mode
Routes traffic entirely through your on-premises Citrix DaaS environment, making it easier to get security approval because it uses existing approved components
Flexible authentication
Works seamlessly with modern authentication methods as well as legacy authentication methods like Kerberos and NTLM; supports form-based authentication; and eliminates the need to rewrite authentication protocols for legacy applications
Attribute-based IdP selection
Supports attribute-based identity providers, which is a common use case for M&A
Cloud VDI-to-data center secure application access
Provides secure access on a per-application basis from cloud VDI to internal applications in a data center or private cloud without using Azure ExpressRoute or any other VPN solution; uses microsegmentation for granular access control to on-premises resources from cloud VDI; and supports single and multi-session VDI
Remote browser isolation
Provides a seamless workflow for admins to configure end-user access permissions for launching web applications in a remote browser in the cloud
Unified end-user experience
Integrates with Citrix StoreFront — a secure portal that uses SSO to enforce access policies at a single point — which conveniently allows users to access all of their approved applications, including web and SaaS applications as well as VDI applications, in one place
Unified admin experience
Provides a much simpler admin experience because admins can click a button in Citrix Web Studio to access the Citrix SecurAccess ZTNA UI to configure access to web and SaaS applications
Unified support experience
Makes it easy to pinpoint issues because a single admin portal for management and operations and the use of a single tool, Citrix Director, streamlines help desk triage and the troubleshooting of virtual and private applications
VPN and ZTNA co-existence
Enables a seamless transition from VPN to ZTNA on an end-user device because NetScaler Gateway (configured as a VPN) and the Citrix SecurAccess ZTNA agent are built with the same code base, allowing for a smooth and phased VPN-to-ZTNA migration instead of a forklift approach
Citrix SecurAccess ZTNA and SASE/SSE co-existence
Complements secure web gateway (SWG) and cloud access security broker (CASB) controls offered by SASE/SSE vendors for securing external traffic
ZTNA for web and SaaS applications
Provides secure access to all applications — including web and SaaS applications in addition to proprietary applications and VDI applications — on-premises and in the cloud, effectively reducing the complexity of managing multiple ZTNA solutions
Reduced costs
Comes included in the Citrix Platform and Universal Hybrid Multi-Cloud License, providing the opportunity for both vendor and cost consolidation
Key use cases for Citrix SecurAccess ZTNA
A modern zero-trust security model is preferable to traditional perimeter security, but you can begin implementing zero-trust capabilities in a phased approach while also using a VPN. It’s common to start with ZTNA for unmanaged devices for remote and hybrid employees and contractors as a first step.
Employee access to private web, TCP, and UDP applications from managed devices
Citrix SecurAccess ZTNA provides better company data protection and context-based authentication to provide just-enough access rights to employees' required resources. Allowing employees to access private web applications using their preferred browsers improves the user experience. Employees can also access client-server (TCP and UDP) applications without any additional setup by admins, making the access process seamless and hassle free for IT and employees.
Contractor access to private web applications from unmanaged devices and native browsers
Citrix SecurAccess ZTNA provides secure and contextual-based access to SaaS and internal web applications through a unified portal or direct link using a native browser. Applications configured with contextual policies will launch in an isolated remote browser to mitigate threats, enforce additional security policies, and protect sensitive data by creating an air gap between the user's device and the application.
Cloud VDI user access to private applications from cloud VDI without a VPN
Allowing employees, partners, and contractors to use their own devices can pose a security risk. To mitigate this risk, companies deploy VDI in the cloud, isolated from their company networks. After users log on to their cloud desktops, Citrix SecurAccess ZTNA automatically establishes a secure connection to the company network, granting the user access to private applications using a zero-trust approach. This robust security measure ensures data security and provides an air gap between the user's device and the company network.
IT/ VPN admin access management of managed devices over ZTNA connectivity
Maintaining and securing company devices can be difficult, especially the devices of remote employees and employees who travel frequently. Citrix SecurAccess ZTNA helps IT admins establish a zero-trust-based machine tunnel after the device starts, which allows devices to remain compliant so that company application and data access can be granted.
Capabilities of Citrix SecurAccess ZTNA
Before initiating a session, Citrix SecurAccess ZTNA verifies a user's identity using single sign-on, device posture assessment, multi-factor authentication (MFA), and adaptive authentication. After establishing a secure session, continuous monitoring ensures adherence to security policies.
- Acts as an identity broker for M&A scenarios
- User authentication across Microsoft Entra ID, Okta, Google Identity, Active Directory, SAML 2.0 IdP, and more
- Attribute-based IdP selection for authentication
- Conditional-authentication with multi-factor authentication MFA
- Machine-based authentication
Citrix SecurAccess ZTNA employs the zero trust principle of "never trust, always verify" to continually validate access to applications and data. Access policies adapt dynamically based on contextual factors such as user location, device status, and network trust. For instance, access may be restricted or additional authentication required if a user connects from an untrusted network.
- Device posture checks
- Generic and vendor-specific checks
- CrowdStrike and Intune integration
- Network location and geolocation
- Continuous monitoring and enforcement
- Dynamic access revocation
- Adaptive data leak security controls
Citrix SecurAccess ZTNA offers flexible choices for secure access with both agent-based and agentless options, providing a balance between advanced security and convenience for the user.
- Agentless with Citrix SecurAccessTM with Chrome Enterprise for web and SaaS applications
- Agentless with native browser for web applications
- Agent-based for TCP and UDP applications
- Managed and unmanaged devices
- Employees, partners, and contractors
Citrix SecurAccess ZTNA enforces policies that provide access to specific applications rather than broad network access. This approach minimizes the attack surface by ensuring that users can only access the applications necessary for their job roles.
- FQDN, IP: port: protocol, IP range, CIDR block, domain name (single or wildcard)
- Automated application discovery and publishing
- Policy definitions, intuitive rule builder
- Single sign-on support (SSO)
- SAML
- Kerberos
- Form-based
- Basic
RESOURCES
Learn more about Citrix SecurAccess ZTNA
Technical brief
Tech brief: Citrix SecurAccess ZTNA
Blog
How to set up BYOD users with cloud-hosted virtual desktops for zero trust network access to private applications
Data sheet
Data sheet: Citrix SecurAccess ZTNA