Written 2026-08-28. Covers the rule that silently kills VBA access and what to do when it fires. Companion to the Citrix setup pages. No client information on this page.

TLDR

Log into VBA systems (Citrix > VBMS) at least once every 30 days or your VA account is disabled. Getting it back takes up to 20 to 30 business days. There is no warning email before it happens, and nothing at OSDRI watches this for you.

What Consequence
Inactive 30 days Account disabled
Inactive 180 days Account deleted
Reactivation Up to 20 to 30 business days, NOT immediate
Locked out, who to call ESD 855-673-4357, select Option 2
PIV problems [email protected]
System access problems ESD or yourit.va.gov

Policy effective 2026-03-23. Activity is tracked per account, not per device. Any valid sign-on counts: onsite, VPN, Azure, or Citrix.

The 30-day reset, do this monthly

This is the whole job. It takes about three minutes.

  1. Insert your PIV card into the reader.
  2. Go to the VA Access Gateway and click "Click here to use Smartcard". See the warning below, this is where people get stuck.
  3. Pick your PIV Authentication certificate when the browser prompts, then enter your PIV PIN.
  4. Launch VBA - VBApp Desktop.
  5. Open VBMS once: https://www.vbms.vba.va.gov/vbmsp2/vso-ng#!/category/all
  6. Log out cleanly.

That is a valid sign-on and it resets the clock.

<aside> 🚪

The splash page has TWO doors and the wrong one is a dead end for affiliates.

If you find yourself typing a username, you are on the wrong door. Go back and take the Smartcard link.

</aside>

Picking the right certificate

Your PIV card carries several certificates and in the browser picker they can look identical, same name, same issuer, same dates. Only one works for login.