In an environment where you have Duo Agent and Citrix FAS for SSO into your VDAs, you’ll need to make some registry changes to get FAS to work.
The changes you need to make on the VDA are shown below. Note that the top GUID in both screen shots is for the Citrix SSOn Credential Provider and {81C8E4DC-B376-4D88-BCCD-BD0DD65BEE2B} is the CitrixMirrorCredentialProvider (FAS). If you are running an older version of Citrix the Citrix SSOn Credential Provider might need to be different.
A quick way to figure out what the working GUID should be is to log on to a VDA that does not have the Duo Agent on it and look at this registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnProvider
That will be the GUID you want to use along with the CitrixMirrorCredentialProvider.