Citrix CVAD Hybrid Environment – “Identity Provider Access Denied” After NetScaler ADC Upgrade.
​
Hi everyone,
We have a hybrid Citrix CVAD environment with both on-premises and cloud infrastructure.
We recently upgraded both NetScaler ADCs. After the upgrade, some vulnerabilities were detected, so we shut down one ADC. Currently, only one ADC is operational.
Since then, multiple users have reported an “Identity Provider Access Denied” error while trying to access Citrix. The error occurs after the authentication process, but we haven't confirmed whether it is directly related to the ADC upgrade or shutting down one ADC.
What we have observed:
- Multiple users are experiencing the error when accessing Citrix.
- Our Global Administrator granted additional permissions/access to some affected users, after which they were able to log in successfully.
- However, a few users are still experiencing the same error.
- Several other users can access Citrix without any issues.
We haven't identified the root cause yet and are trying to understand whether this is related to NetScaler, Citrix authentication, or Microsoft Entra ID.
Questions for experienced Citrix/NetScaler admins:
Could shutting down one ADC after the upgrade cause this kind of issue for specific users?
Could this be related to SAML authentication, the identity provider configuration, Entra ID enterprise application permissions, or Conditional Access?
Why would granting additional permissions resolve the issue for some users but not others?
Which logs should we check to identify the exact failure point?
What troubleshooting steps would you recommend for a hybrid CVAD environment?
We want to identify the actual root cause rather than continue granting additional permissions as a workaround.
Has anyone encountered a similar issue after a NetScaler ADC upgrade?
Any suggestions would be appreciated. Thanks in advance!