Citrix Endpoint Management
Connect Citrix Endpoint Management to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Citrix Endpoint Management to collect mdm evidence with automated compliance tests, switched on per workspace.
| Category | MDM |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Citrix Endpoint Management's guide | docs.citrix.com |
Connect with an API token
-
In Citrix Endpoint Management:
- Make sure the Citrix Cloud admin or Endpoint Management account used has Public API access permission in its role-based access configuration (or is a Citrix Cloud administrator or super user).
- In Citrix Cloud, select Identity and Access Management, go to API Access › Secure Clients, type a name for your secure client, and click Create Client. Citrix Cloud generates a secure client ID and secret; download a copy and save it securely, because Citrix Cloud doesn't store them after you close the dialog box.
- Use the client ID and secret to get a bearer token from the Citrix Cloud API (paste it into Safeguard's Citrix Cloud token field), or POST that bearer token to https://<host-name>:<port-number>/xenmobile/api/v1/authentication/login/cloud and paste the returned auth_token into Safeguard's Auth token field.
Where to find the other values:
- Server URL: Your Endpoint Management server address, the <host-name>:<port-number> used in the REST API URLs.
Citrix Endpoint Management shows the secret only once, so copy it before you leave the page.
Citrix Endpoint Management's public documentation does not cover every step.
Auth tokens come from an API call, not a UI. The fetched page does not describe how to build a role with only PUBLIC_API_ACCESS plus device view rights.
Source: docs.citrix.com, checked 2026-10-07.
The permissions Safeguard needs:
PUBLIC_API_ACCESS (view devices). -
On Compliance › Connectors, open Citrix Endpoint Management, click Connect, choose API token and fill in:
Field What to enter Server URL Optional. Your own server: an https address reachable from the internet. Auth token Optional. Stored encrypted and never shown again. Or, instead: Citrix Cloud token (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read Citrix Endpoint Management and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.7, CC6.8, CC7.1 | 5 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.8.1, A.8.7, A.8.8, A.8.9 | 5 |
| HIPAA Security Rule | Automated tests | 164.308(a)(5), 164.310(d)(1) | 5 |
| PCI DSS | Automated tests | 6.3.3, 12.5.1 | 4 |
| NIST CSF 2.0 | Automated tests | ID.AM-01, PR.PS-01, PR.PS-02 | 5 |
These tests are switched on per workspace by the Safeguard team.
Related
- MDM connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks