Network and Security
Session Policy
This page is the security view of session policy: what the controls are and how they are enforced. The steps for setting them are on Device Features.
The controls
Section titled “The controls”Administrators set the policy in the console, for the whole organisation or for individual people. A per-user value replaces the organisation value for that setting only.
What a session may carry
Section titled “What a session may carry”| Control | Allows or blocks |
|---|---|
| USB sharing | Sharing USB devices plugged into the user’s device with the workstation. |
| Copy and paste to the workstation | Copying on the user’s device and pasting on the workstation. |
| Copy and paste from the workstation | Copying on the workstation and pasting on the user’s device. |
Each is set on its own, so an organisation can allow pasting into the workstation and block copying out of it.
What the workstation does
Section titled “What the workstation does”| Control | Options |
|---|---|
| When a session disconnects | Do nothing, lock the workstation, or sign the user out after a set number of minutes, with or without locking first. |
| Idle | Lock the workstation after a set number of minutes with no input from the user’s device. |
| Silent sign-in | Turn Windows sign-in with Entra ID on or off. |
A control the policy does not mention is allowed.
How the policy reaches a session
Section titled “How the policy reaches a session”The policy is carried inside the session token, which is signed by your organisation’s identity service, so neither the app nor the workstation can be given a policy the console did not set. The host applies it at the start of every session. A change applies from each user’s next connection; sessions already running keep the policy they started with.
When a feature is blocked, the app says so at the point the user tries to use it, and the rest of the session continues. See What users see.
Connecting to a workstation already in use
Section titled “Connecting to a workstation already in use”| Who can connect | Only people assigned to the workstation. The connection service refuses a token for any other workstation. |
| What the connecting device sees | That the workstation is in use and who is using it, with two choices: Take over or Ask to share. |
| Take over | Moves the session to the connecting device and disconnects the other. A connecting device that makes no choice within 10 seconds takes over. |
| Ask to share | The current user is prompted and has 30 seconds to answer. A request with no answer results in a take-over. |
| Shared session | Both people see and work on the same desktop. Only one person’s microphone, webcam and USB devices reach the workstation at a time. |
What each person sees is on Moving Between Devices and Sharing a Session.
USB devices
Section titled “USB devices”USB sharing is on by default and can be turned off per workstation or by organisation policy. Devices are classified before anything is shared.
| Class | Handling |
|---|---|
| USB hubs, the device’s system disk, its built-in keyboard and mouse, network adapters, display adapters, audio and video devices | Refused. |
| Mass storage | Always asks the person before it is shared. |
| Smart card readers, security keys and other HID devices | Shared when the person selects them. FIDO security keys such as YubiKey are recognised as security keys and can be shared to the workstation. |
The USB drivers installed on the workstation are signed by Microsoft through the Windows hardware developer programme.
| Where to turn USB off | How |
|---|---|
| For the organisation or one user | Device features in the console. See Device Features. |
| On one user device | The UsbRedirection value. See Deploying the Client. |
| On one workstation | Host Settings. |
How users share a device is on USB Devices.
Related pages
Section titled “Related pages”Questions
Section titled “Questions”Can a user change the policy on their own device?
Section titled “Can a user change the policy on their own device?”No. The policy is inside the signed session token and is applied by the host. A setting on the user’s device can only turn a feature off, never on.
Does blocking copy and paste stop files as well as text?
Section titled “Does blocking copy and paste stop files as well as text?”Yes. Copy and paste in Remotle carries text, pictures and files, and the two controls cover the clipboard in each direction.
Can I let one person share USB devices while the organisation blocks them?
Section titled “Can I let one person share USB devices while the organisation blocks them?”Yes. Add a per-user exception in Device features and set USB to Allow for that person.