A Citrix Engineer needs to restrict access to an application so it can only be accessed from external connections. Where should the engineer go to configure this restriction?

StoreFront does not have an 'External Access' feature that restricts which published applications are available based on connection type.

The Access Policy in a Delivery Group lets administrators define connection filters, including restricting access exclusively to connections arriving through NetScaler Gateway (external) or only from direct internal connections. This granular control is applied at the Delivery Group level, directly governing which connection paths can reach the published resource.

Citrix Studio security policies control session behavior and ICA settings, not connection-source-based application access restrictions.

NetScaler Gateway session policies manage the gateway session parameters and authentication, not which specific applications are accessible from a given connection type.