Let clients use remote access

Portal remote access lets people at a client connect to their own computers from the portal, for example to reach an office desktop from home. It is off until you turn it on, and then a person reaches an endpoint only through a grant. This page shows how to set the limits for a client and how to grant access.

Before you begin

• You need clientportal:remote.
• Remote access runs on the same agent and relay as your technicians’ sessions. See Remote access.
• The people you grant access to hold Use remote access in the portal, directly or through a group. See Set portal roles, groups, and the permission ceiling.

How the mode is decided

Three parties limit a portal session, and the endpoint’s own policy limits it further:

1. Your ceiling for the client: the most the client can ever use.
2. The client’s policy, which the client’s owners set in the portal within your ceiling.
3. The grant, which names who, which endpoints, and the most permissive mode.
4. The endpoint’s remote access policy, from its profiles. See Configure access modes and consent.

A session uses the most permissive mode that all four allow. If your ceiling or the client’s policy says to always ask, every session asks for consent. A session is recorded when the grant, the client’s policy, or your ceiling requires it.

Mode in the console	In the portal	What happens
Unattended	Any time	Connects without anybody at the machine.
Attended	With a notice	Connects straight away. The person at the machine sees a banner while it lasts.
Ask for consent	Ask first	The person at the machine must accept each connection.

The prompt at the endpoint names the person and the organization, such as Jane Doe (Example Corp, client portal) wants to connect to this computer., so the person at the machine knows it is not your team.

Set the ceiling

1. Select Clients, then Record on the client’s row, then the Client portal tab.
2. Select Remote access.
3. Turn on Portal users may be given remote access.
4. Under Modes the client may use, tick the modes to allow.
5. Optionally, in Longest grant, in days, enter the longest a grant may last. Empty allows grants with no end date.
6. Choose the safeguards:
   • Record every portal session.
   • Always ask the person at the machine. This turns every grant into ask for consent, whatever its mode.
   • Ask for a second factor again before each connection. The user confirms who they are if they have not in the last five minutes. It is on by default.
7. Select Save ceiling.

When you lower the ceiling, grants it no longer allows are revoked, and their live sessions end.

Below the ceiling, the page shows the client’s own policy: Modes they allow, Left after your ceiling, the default mode for new grants, and whether they require recording.

Grant access

You can grant access yourself, and so can people at the client with Grant remote access, within the same limits.

1. On Remote access, under Grants, select Grant access.
2. In Who, choose One person or A group, then the person or group.
3. Choose what the grant reaches:
   • One endpoint
   • Every endpoint at a site
   • A device group
   • Endpoints with a tag
   • Endpoints assigned to them: the endpoints whose primary user or assignee is the person’s Linked user. A group grant reaches each member’s own. See Invite and manage portal users.
4. Choose the Mode. Only modes that both the client’s policy and your ceiling allow are offered. It starts on the client’s default: unattended for Endpoints assigned to them, and ask for consent for the rest, unless the client changed them.
5. Under What they can do, tick See the screen, Use the keyboard, Use the mouse, Copy and paste, and Transfer files as needed. With only See the screen, the grant is view-only: the relay and the endpoint both refuse keyboard and mouse input.
6. Optionally, turn on Record every session. It is already on when the client’s policy or your ceiling requires it.
7. Set Starts (empty starts now) and Ends (empty never ends). An end date is required when your ceiling sets a longest grant.
8. In Note, say why, for whoever reads the grant list later.
9. Select Grant access.

When several grants cover an endpoint, a session gets what any of them allows. When a grant ends, live sessions narrow to what the remaining grants allow.

A grant on a site, device group, or tag follows the endpoints: an endpoint added to the site later is covered, and one moved out is not.

Revoke access

Select Revoke on a grant. Its live sessions end at once. Access also ends when:

• the grant reaches its end date, which also stops a session in progress,
• the person is suspended or offboarded, or leaves the group,
• directory sync suspends the person, or
• you lower the ceiling below the grant.

Recordings

Portal sessions appear in the console’s remote session history with your team’s, named like Jane Doe (Example Corp, client portal), and their recordings are kept and watched there. The client’s activity log shows that a session was recorded and asks them to contact you to see it. See Record remote sessions.

Verify

• The grant shows Live in the grant list, with how many endpoints it covers now.
• The person sees the endpoint under Remote access in the portal, with Connect.

Next steps

• Using the client portal: connect to your computers
• Configure access modes and consent