Managed Remote Desktop is available only in enabled deployments. Enrollment and inventory can be available before live viewing. Windows remote control and the macOS viewing/control rollout remain in development, and managed Remote Desktop tools are not yet available to Copilot. Confirm the capabilities enabled for your organization with your administrator before planning a support session.
Choose the right remote feature
A host can have both an enrolled Remote Agent and existing SSH, RDP, or web protocols. Managed access uses the enrolled device identity; it does not require a permanent remote-access password in Key Chain. The device’s support code is an identifier, never permission to connect.
Before a session
You need an enabled Studio desktop build, access to the host in the selected organization, a compatible enrolled agent, and a device whose desktop is ready. Web administration can manage devices and profiles; viewing requires the desktop viewer. The current endpoint package scope is Windows 10/11 x64 and Apple silicon Macs. Windows ARM64, Windows Server/RDS, Intel Macs, Linux, and mobile endpoints are outside that scope. A package or an Online badge does not establish that viewing or control is available on that endpoint. On macOS, the endpoint needs Screen Recording permission to capture the desktop. Control also requires the applicable Accessibility permission. Use the agent’s permission status, Open Settings, and Recheck guidance. Installing the package does not silently grant Screen Recording, and pre-login/FileVault desktop access is unsupported.Inspect a managed device
Open the host’s Device Details before connecting. Check the customer/site placement, device identity, agent version, and the timestamps beside its health information.
Online is not the same as ready. A computer can report healthy heartbeats while locked, without an active user, or without capture permission. Inventory can remain Fresh while the computer is Offline. Inventory older than 24 hours is marked Stale; use its capture time when assessing the values.
Detected OS, CPU, memory, disks, displays, and other reported inventory are read-only. They are separate from the names and device labels you edit in the host record.
Request a view
In an enabled deployment, viewing follows the device’s effective policy. First pass the access, readiness, compatibility, and policy preflight; then request the view. This flow stops at View; control has a separate capability and authorization path.1
Choose the host explicitly
Confirm the organization and customer/site folder, then select Connect remotely. Selecting a host or search result does not start a managed session.
2
Review the preflight
Check the exact endpoint, readiness, effective policy and its source, and whether someone at the computer must approve. The request starts with View; it does not grant control.
3
Select Request view
If the action is unavailable, follow the displayed reason. A missing viewer, disabled deployment, revoked device, or unavailable console requires its own remedy.
4
Wait for the required local approval
Under approval-required policy, the person at the endpoint must allow the request. A denial or timeout does not authorize another route into the desktop.
5
End the session when finished
Use Disconnect and check that the viewer reports the ended state. Switching tabs is not a disconnect.
View and Control are separate
Viewing does not authorize clicks or typing. Where Control is enabled in a supported deployment, Request control requires a role that permits control, a ready input capability, and separate authorization. Approval-required policy also requires a fresh local approval for that scope. Release control gives up input; Disconnect ends the session. Windows input/control is still being completed. Do not treat a visible Control action, a profile setting, or an unattended policy as a guarantee that control works. Lock, sign-in, UAC, and user-switch behavior must follow the endpoint’s reported supported capabilities.Consent and folder policy
The service evaluates the organization default and the nearest explicit folder override for the device’s current placement.
Administrators manage these rules. Before changing a folder to unattended or disabled, review the affected devices, inheriting folders, explicit overrides, and the stated effect on active sessions. Moving a host can change the policy that applies to it without re-enrollment.
An unassigned device or unresolved policy is not a shortcut to unattended access. Resolve placement or policy with an administrator before connecting.
Enroll one device or a fleet
Organization administrators use Administration → Remote Desktop. The workspace has Overview, Deployment, Devices, and Activity sections. In an enabled deployment:- Open Deployment → Create enrollment profile.
- Choose One device or Fleet, and give the profile a recognizable name.
- Choose the customer/site folder, or leave the devices Unassigned for later placement.
- Set the intended platform, architecture, update channel, expiry, and maximum uses. Use only platform/architecture combinations for which your administrator supplies an approved package.
- Create the profile and securely save its enrollment secret while it is displayed.
- Deliver the approved Altostrat Remote Agent package and enrollment material through your organization’s installation or RMM/MDM process.
- Review profile progress and Show enrolled devices, then inspect each device’s placement and readiness.
Unassigned and quarantined devices
Use Devices to review Unassigned and Quarantined devices. An administrator can assign or relink a device to the appropriate host and folder. Placement does not repair a quarantined identity. Prepare golden images before device identity is generated. Cloning an already enrolled machine can create an identity conflict that requires administrator recovery. Repeated enrollment attempts or moving the record into another folder do not resolve that conflict. Device administration also includes credential rotation and revocation where enabled. Review the confirmation and completion state; revocation, profile revocation, and deleting a host record have different effects. Retained inventory and activity can remain after access is revoked.Activity and troubleshooting
Activity records remote-session lifecycle facts: operator, device, request and consent outcome, policy, timing, connection path, and safe failure reason. The operator view covers the last 90 days. It is separate from Terminal History and does not record screen contents, typed text, or clipboard contents. Open an event or session to inspect its timeline and copy the redacted support summary. Include the diagnostic ID, time, platform, and agent/Studio versions when asking for help.Current limits
Managed Remote Desktop does not provide file transfer, clipboard synchronization, remote shell, audio, session recording, or hidden access. Use separately authorized Studio protocols and tools for those jobs. Copilot’s existing Windows RDP tools apply to RDP sessions. Local Computer Use applies to the workstation running Studio. Neither is a substitute for the unavailable managed Remote Desktop AI workflow.Related
Hosts and credentials
Keep customer folders, host protocols, credentials, and detected inventory distinct.
Organization administration
Review organization roles, access, and administrative responsibilities.