I had enabled Multi-Factor or two factor authentication on premise using VPX. Can I enable this on cloud too?
The VPX provided with XenApp and/or XenDesktop service must be used for HDX proxy only (based on EULA ) and not for authentication. Authentication on cloud is done using on premise AD via cloud connector or using Azure Active Directory.
https://docs.citrix.com/en-us/citrix-gateway-service/faq.html
AAA / IdP
Authentication, Authorization, and Accounting, more commonly known as AAA, is a feature of on-premises Citrix Gateway. The primary use case from the standpoint of user access to Citrix resources are advanced Windows authentication mechanisms, third-party identity providers (Google, Okta, and Ping), RADIUS MFA, conditional access policies, and many others. (Also remember that the exception is Azure Active Directory. For a long time now, you've been able to integrate it directly into Citrix Cloud without the on-premises Gateway, enabling some of these more advanced authentication scenarios.) The new Gateway IdP functionality is beneficial for helping enterprises migrate to Citrix Cloud. However, a hybrid infrastructure based on on-premises Gateway is necessary. Although Gateway IdP can be used with Workspace, this type of deployment still requires the management and maintenance of the on-premises Gateway device.
https://www.brianmadden.com/opinion/Bring-your-own-Citrix-Gateway-to-Citrix-Cloud