Free 2FA with Google Authenticator using Netscaler nFactor.
Having Citrix Cloud licensing is possible to configure push notification instead of OTP. Most of the companies today have MFA with O365 but this can be a very cost effective solution for 3rd parties with temporary access to your business.
1. Register your device through Netscaler gateway (can be limited to source IP).
2. Scan barcode with Google Authenticator
3. Access Citrix with free 2FA