---
title: "Let clients use remote access"
description: "Allow a client's portal users to connect to their own computers, set the most they can ever do, and grant access to an endpoint, site, device group, or tag."
url: "https://support.outpostplatform.com/client-portal/remote-access/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "MSP plan. Client portal tab > Remote access. The MSP ceiling: on or off (off by default), allowed modes, longest grant, record every session, always ask, second factor before each connection. Client owners set their policy and grants within it. A grant reaches an endpoint, site, device group, or tag. The mode is the intersection of grant, policy, ceiling, and the endpoint's policy."
availability:
  plans: ["msp"]
  permission: "clientportal:remote"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/client-portal/remote-access.md"
license: "CC BY 4.0"
---

# Let clients use remote access

Portal remote access lets people at a client connect to their own computers
from the portal, for example to reach an office desktop from home. It is off
until you turn it on, and then a person reaches an endpoint only through a
grant. This page shows how to set the limits for a client and how to grant
access.

## Before you begin

- You need `clientportal:remote`.
- Remote access runs on the same agent and relay as your technicians'
  sessions. See [Remote access](/remote-access/).
- The people you grant access to hold **Use remote access** in the portal,
  directly or through a group. See
  [Set portal roles, groups, and the permission ceiling](/client-portal/roles-and-ceiling/).

## How the mode is decided

Three parties limit a portal session, and the endpoint's own policy limits it
further:

1. **Your ceiling** for the client: the most the client can ever use.
2. **The client's policy**, which the client's owners set in the portal
   within your ceiling.
3. **The grant**, which names who, which endpoints, and the most permissive
   mode.
4. **The endpoint's remote access policy**, from its profiles. See
   [Configure access modes and consent](/remote-access/access-modes/).

A session uses the most permissive mode that all four allow. If your ceiling
or the client's policy says to always ask, every session asks for consent. A
session is recorded when the grant, the client's policy, or your ceiling
requires it.

| Mode in the console | In the portal | What happens |
| --- | --- | --- |
| **Unattended** | **Any time** | Connects without anybody at the machine. |
| **Attended** | **With a notice** | Connects straight away. The person at the machine sees a banner while it lasts. |
| **Ask for consent** | **Ask first** | The person at the machine must accept each connection. |

The prompt at the endpoint names the person and the organization, such as
**Jane Doe (Example Corp, client portal) wants to connect to this computer.**, so the person at
the machine knows it is not your team.

## Set the ceiling

1. Select **Clients**, then **Record** on the client's row, then the **Client
   portal** tab.
2. Select **Remote access**.
3. Turn on **Portal users may be given remote access**.
4. Under **Modes the client may use**, tick the modes to allow.
5. Optionally, in **Longest grant, in days**, enter the longest a grant may
   last. Empty allows grants with no end date.
6. Choose the safeguards:
   - **Record every portal session.**
   - **Always ask the person at the machine.** This turns every grant into ask
     for consent, whatever its mode.
   - **Ask for a second factor again before each connection.** The user
     confirms who they are if they have not in the last five minutes. It is on
     by default.
7. Select **Save ceiling**.

When you lower the ceiling, grants it no longer allows are revoked, and their
live sessions end.

Below the ceiling, the page shows the client's own policy: **Modes they
allow**, **Left after your ceiling**, the default mode for new grants, and
whether they require recording.

## Grant access

You can grant access yourself, and so can people at the client with **Grant
remote access**, within the same limits.

1. On **Remote access**, under **Grants**, select **Grant access**.
2. In **Who**, choose **One person** or **A group**, then the person or group.
3. Choose what the grant reaches:
   - **One endpoint**
   - **Every endpoint at a site**
   - **A device group**
   - **Endpoints with a tag**
   - **Endpoints assigned to them**: the endpoints whose primary user or
     assignee is the person's **Linked user**. A group grant reaches each
     member's own. See
     [Invite and manage portal users](/client-portal/users/#invite-a-user).
4. Choose the **Mode**. Only modes that both the client's policy and your
   ceiling allow are offered. It starts on the client's default: unattended
   for **Endpoints assigned to them**, and ask for consent for the rest,
   unless the client changed them.
5. Under **What they can do**, tick **See the screen**, **Use the keyboard**,
   **Use the mouse**, **Copy and paste**, and **Transfer files** as needed.
   With only **See the screen**, the grant is view-only: the relay and the
   endpoint both refuse keyboard and mouse input.
6. Optionally, turn on **Record every session**. It is already on when the
   client's policy or your ceiling requires it.
7. Set **Starts** (empty starts now) and **Ends** (empty never ends). An end
   date is required when your ceiling sets a longest grant.
8. In **Note**, say why, for whoever reads the grant list later.
9. Select **Grant access**.

When several grants cover an endpoint, a session gets what any of them
allows. When a grant ends, live sessions narrow to what the remaining
grants allow.

A grant on a site, device group, or tag follows the endpoints: an endpoint
added to the site later is covered, and one moved out is not.

## Revoke access

Select **Revoke** on a grant. Its live sessions end at once. Access also ends
when:

- the grant reaches its end date, which also stops a session in progress,
- the person is suspended or offboarded, or leaves the group,
- directory sync suspends the person, or
- you lower the ceiling below the grant.

## Recordings

Portal sessions appear in the console's remote session history with your
team's, named like **Jane Doe (Example Corp, client portal)**, and their
recordings are kept and watched there. The client's activity log shows that a session
was recorded and asks them to contact you to see it. See
[Record remote sessions](/remote-access/session-recording/).

## Verify

- The grant shows **Live** in the grant list, with how many endpoints it
  covers now.
- The person sees the endpoint under **Remote access** in the portal, with
  **Connect**.

## Next steps

- [Using the client portal: connect to your computers](/portal-guide/remote-access/)
- [Configure access modes and consent](/remote-access/access-modes/)