Citrix to Azure Virtual Desktop Migration

Why do organisations move from Citrix to Azure Virtual Desktop?

Usually for a combination of reasons, and the strongest come from how Azure Virtual Desktop is built rather than from anything Citrix does wrong. Citrix remains a capable platform, and a move only makes sense where these reasons outweigh the work of the migration itself.

Timing usually comes from the Citrix side. Citrix publishes an end-of-life date for each release in its product lifecycle matrix: Citrix Virtual Apps and Desktops 2203 LTSR, for example, reaches end of life on 23 March 2027, with extended support for eligible customers. A date like that is a decision point, whether the decision is to upgrade Citrix or to move, and a programme of this size needs to start well before it.

How does a Citrix to AVD migration run as a programme?

In five stages, each with its own scope, exit criteria and sign-off. Microsoft runs Azure Virtual Desktop's broker and gateway as a service, and you manage only the images and session host virtual machines in your own subscription, so the move is a rebuild rather than a conversion: new host pools are built, golden images are brought into Azure or rebuilt, profiles are migrated or rebuilt, and applications are delivered through App Attach or installed in the image.

Assessment is where large migrations are won or lost. Microsoft notes that services such as Azure Migrate can help assess existing infrastructure and dependencies, but the session hosts themselves are always new, so the work that matters is knowing exactly what has to run on them.

What does the assessment cover in a large Citrix estate?

Everything a user would notice if it stopped working. We start from what Citrix actually publishes and who launches it, because in an estate that has grown over years the published list and the used list are rarely the same.

Session host sizing starts from Microsoft's published guidance, which sets a maximum number of users per vCPU for each workload type, and is then confirmed in the pilot with real users, because Microsoft itself describes those figures as initial estimates.

How is a migration of this size governed, and who does what?

Through a small programme board that meets on a fixed cadence, owns the wave plan and signs off each stage. A migration of a thousand seats or more touches every department, so decisions about dates, exceptions and acceptance cannot sit with the technical team alone.

Each stage ends with written sign-off against exit criteria agreed at the start. We run a migration under the same ISO 27001 and ISO 9001 management systems as the rest of our work, so change control, access and records follow a documented process rather than a project's habits.

How are applications handled: compatibility, MSIX and App Attach?

Application by application, because one undocumented dependency can hold up a whole wave. Each application is tested on the target operating system and given one of three routes: built into the golden image, installed through Intune, or attached at sign-in with App Attach.

There are prerequisites worth planning early. Every MSIX and Appx package needs a code signing certificate that the session hosts trust, packages sit on an SMB file share in the same Azure region as the session hosts, and Microsoft advises against sharing that file share with FSLogix profile containers. Where an application cannot be packaged, it goes in the image or through Intune instead, and the assessment says which applications those will be.

How are identity and user profiles handled?

Identity comes first, because it decides who can sign in at all. Azure Virtual Desktop requires users to be discoverable in Microsoft Entra ID: identities that exist only in Active Directory Domain Services are not supported. Most estates of this size already sync Active Directory to Entra ID with Microsoft Entra Connect, and the check is that each user's UPN or SID matches between the two, which Microsoft requires for hybrid identities.

Sign-in to the service goes through Entra ID, which is where Conditional Access and multifactor authentication apply. Microsoft recommends single sign-on with Microsoft Entra authentication, so users are not asked for credentials again at the session host. Smart card and Windows Hello for Business sign-in to the session needs Kerberos, which means line of sight to a domain controller or a KDC proxy, and we plan for that wherever those methods are in use.

Profiles move to FSLogix profile containers, which Microsoft recommends for Azure Virtual Desktop. Each user's profile is a single virtual disk attached at sign-in, stored on Azure Files or Azure NetApp Files in the same region as the session hosts. Existing profiles are either migrated into containers or rebuilt, decided per user group: a clean profile often clears problems people have lived with for years, while some groups need their settings carried across.

FSLogix matters for OneDrive too: without profile containers, Microsoft does not support OneDrive in non-persistent virtual desktops.

How do Citrix and Azure Virtual Desktop run side by side?

For the length of the programme, by design. Users move in waves, and each wave keeps access to Citrix until its applications, printing and sign-in have been confirmed on Azure Virtual Desktop. If something fails that the pilot did not find, the affected users go back to Citrix the same day while it is fixed.

The wave plan is built backwards from the date that matters most to you, often a Citrix renewal or a release end-of-life date, with contingency before it. If the dates cannot be met safely, the assessment says so while there is still time to extend Citrix on sensible terms.

What do you hand over at the end?

If you would rather not run it yourselves, our team can carry on running and optimising the estate after the last wave. Either way the handover pack is the same, so the choice stays open.

Why Systech for a Citrix to AVD migration?

Because the work is done by a team that delivers virtual desktops every day, under certified management systems. Systech is ISO 27001 and ISO 9001 certified and a Microsoft partner, our support is 100% UK-based, and our engineers are certified to AZ-140, Microsoft's Azure Virtual Desktop specialty exam.

Our virtual desktop work covers cloud Azure Virtual Desktop, AVD Hybrid, Windows 365 and Remote Desktop Services, so the recommendation is not tied to one platform. The team includes our founder, Ryan Mangan, a Microsoft MVP for Azure Virtual Desktop and author of Packt's Mastering Azure Virtual Desktop.

How do we start?

With a call. Tell us roughly how many users you have, what Citrix publishes today and what is driving the timing, and we will tell you how we would approach it and what the assessment would cover. If you are earlier in the decision than that, our free virtual desktop review is a shorter first step.