Help › Manage › G3

Rules for your access: consent, control, only from your own access, time limits, lock

Decide for all devices of your access whether consent is needed on the device, who may control, how long a session may last and whether the device is locked afterwards.

Preview this guide has not yet been clicked through on a real device. Button names and steps come from the program but may differ in details.

For: Account administrator
Applies to: Cloud · Own relay
Licence: service "access without confirmation" (only for "Without asking" on browserdesk.de)
Right in the console: Tenant administrator
Controlled device: Windows · macOS · Linux
Control from: Browser
from version: 20261010.24

What it is for

As administrator you decide what applies to all devices of your access: must the person at the device confirm every session? May only someone from your own access control? Does a forgotten session end by itself? Is the device locked afterwards? These rules are in two places in your access's dialog — in the console an access is called tenant.

What you need

A sign-in to the console with the role Tenant administrator or higher.
A Cloud access on browserdesk.de or your own relay.
"Without asking" on browserdesk.de only works if your access has the service "access without confirmation on the device and access before sign-in" (paid Cloud). With Free every session must be confirmed on the device (Prices).
Current devices: time limits from version 20261010.24, lock after the session from 20261010.20. Older devices ignore these settings.

How to do it

Open Tenants and double-click your access (Edit tenant).

Part 1: What applies on the device (tab "Devices & updates")

Tab Devices & updates → section Device settings (tenant):

Group	Row	Effect
Access and permissions	Access confirmation on the device	Without asking, Ask or Block (no connection)
	Allow control (otherwise view only)	Off = the technician only watches
	Share clipboard, File transfer	clipboard and files in the session
	Lock the device after the session	locks the user session 5 seconds after the end (E31)
Session and picture	Disconnect a session without input after	ends a session without input, for example after 30 minutes (E32)
	Maximum session length	ends every session after the chosen time
	Record sessions (WebM)	records every session

Inherited keeps the value of the level above (G2). Then Save.

Part 2: Rules for the whole access (tab "Governance policy")

Tab Governance policy → section Rules. Each row is Inherited, On or Off; on the right effective: shows the value that applies.

Rule	Effect
Control only from the device's own tenant	Off: ID and password are enough. Members and computers of the tenant: whoever controls must belong to your access — signed in in the program or in web access, a computer of the access or an administrator. Only computers of the tenant: connect, wake and restart only from computers that were added to your access.
Allow running scripts	Off blocks scripts, also ending processes and start buttons with scripts (G6, G10)
Allow software management	Off blocks software distribution (G7)
Second factor required for users	members of the access need a code from an authenticator app (B5)
Devices may re-enrol without approval	Off (default): a reinstalled device must be approved first
Show advertising partners	Off hides ad slots in the program

Then Save.

Part 3: From which networks (tab "Security")

Tab Security → Trusted networks: here you decide from which networks administrators reach the console and viewers may control (B7).

How you know it worked

Each row shows the wanted value next to effective:; own values carry (this tenant).
With Ask the device asks at every session whether access is allowed (F1).
With Only computers of the tenant a foreign computer no longer gets in. It sees „Dieser Rechner ist kein Mitglied des Zugangs, zu dem das Gerät gehört. …“ (this computer is not a member of the access the device belongs to).

Good to know

Free accesses can always only be controlled from the own access, and every session must be confirmed on the device — even if something else is set here. On browserdesk.de the same applies to every device that is not in an access with a Cloud licence.
Before switching on Only computers of the tenant: web access (/app) and Connect from the console are then blocked, also for administrators. Remote console, scripts and start buttons from the console keep working. Update the viewer computers first, then switch — older programs are otherwise refused.
Time limits end the session without a waiting period: the technician gets a notice one minute before and may reconnect right away. A technician who only watches counts as "without input".
Two rules have no effect today: Enforce session recording and Allow unattended access are in the list, but BrowserDesk does not evaluate them anywhere. Recording for all devices: row Record sessions (WebM) in the tab Devices & updates set to On. Sessions only with consent: row Access confirmation on the device set to Ask.
Protect single devices in particular: in the device list right-click → Security → Mark as critical — actions need four-eyes approval. Then every session waits for a supervisor's approval under Settings → Four-eyes approvals. Scripts and the remote console are not checked by this mark, even though the menu text says "actions".
There is no table yet of what each role may do in the console. Questions: info@browserdesk.de.

If it does not work

You see	Meaning and remedy
The device asks despite Without asking	On browserdesk.de your access lacks the service "access without confirmation" (Free or expired plan) — check G4. Or the device has its own value: set it to Inherited in its settings (G2).
A technician gets „Dieses Gerät lässt sich nur aus seinem eigenen Zugang steuern — bitte im Programm oder im Web-Adressbuch an diesem Zugang anmelden.“ (this device can only be controlled from its own access — please sign in to this access)	The rule Control only from the device's own tenant is on. The technician signs in to your access in the program (C2).
„Dieser Rechner ist kein Mitglied des Zugangs, zu dem das Gerät gehört. …“ (this computer is not a member of the access)	Level Only computers of the tenant. Add the technician's computer to the access (C2) or switch the level back.
A session ends with a notice about "without input"	Disconnect a session without input after applies. Raise the value or set it to Inherited/off.
"Rules could not be loaded — they stay unchanged."	The tab did not load the current state; saving then deliberately leaves the rules unchanged. Close and reopen the dialog.

← Set a setting at the right level (relay → access → device) See and switch which features your access has →