Feature Request

Good morning, I am configuring a new DVLS 2026.2 environment. Our company needs to implement an SSO authentication process to allow users to authenticate to the Devolutions Server datasource from Remote Desktop Manager (RDM). From the options currently available in the administrative settings, I can see dedicated configuration sections for Okta and PingOne. Unfortunately, we do not use either of these platforms and would need the ability to configure a generic OIDC or SAML client instead. Ideally, this integration should also support the import and synchronization of users and groups. Is there already a way to achieve this today? If not, would it be possible to consider implementing this functionality in one of the upcoming releases? Thank you.

Hi, I send this feature request as part of our ongoing evaluation of a potential migration to Devolutions Server. Being able to manage the full lifecycle of our vault entries programmatically through the REST API, rather than the PowerShell module, is an important aspect of this evaluation. I would like to request support for creating and fully managing connection/session objects through the REST API, in addition to Username/Password credentials. Based on our recent tests, we can already do the following through REST API v1: Create, read, update, move and delete folders Create, read, update and delete Username/Password Credential objects List and filter vault entries with pagination Rotate Web and RDP secrets by PATCHing the linked Credential object However, creating the actual connection/session entries is not possible through the public REST API . POST /api/v1/vault/{vaultId}/entry returns HTTP 422 for these entry types: RDPConfigured WebBrowser AWS (AWS Dashboard) DataReport RDPConfigured and WebBrowser appear in GET /api/v1/entry/definition, so we expected them to be creatable via REST. AWS and DataReport do not appear in that definition at all. Support confirmed that REST API v1 is currently designed around Username/Password credential management, and that session creation requires the PowerShell module. Because of this, provisioning new sessions still requires PowerShell even when folders and credentials can already be created via REST. A related gap is linking: we cannot set CredentialConnectionID / CredentialConnectionSavedPath through REST when creating or updating a Web or RDP entry. Linking a connection to an existing Credential object currently requires PowerShell. Ideally, REST API v1 would support: POST (create) for RDPConfigured, WebBrowser, AWS and DataReport entries The ability to set/update the linked Credential reference (CredentialConnectionID) on RDP and WebBrowser entries via REST PATCH of connection metadata for those same entry types (host, URL and other non-secret properties) Inclusion of AWS and DataReport in GET /api/v1/entry/definition, consistent with the types we can already list This would allow us to onboard and maintain new objects entirely through REST, instead of mixing REST for folders/credentials with PowerShell import for sessions. The switch to REST API is especially important for our use case, as we need these operations to be automated consistently through an external integration. REST would make these flows faster and more consistent than invoking the PowerShell module for every new object. I believe this would be a valuable addition, particularly for environments where vault entry lifecycle management needs to be integrated with external automation and API-based workflows. Thanks!

Current when you try to PUT/PATCH a SSH Shell device, you get device type not supported. We would like the ability to modify the Hostname, Host/IP, and the Tags assigned to the devices.

Using: Devolutions Server Version 2026.2.15.0 RDM Version 2026.2.17.0 Below is an example of one of the SSHShell devices from (/api/v1/vault/{vaultId}/entry/{id}). No 'Host", or IP Information is being returned. { "createdBy": "<user>", "createdOn": "2024-12-17T16:49:26", "data": { "domain": "", "username": "" }, "description": "", "id": "<device id>", "modifiedBy": "<user>", "modifiedOn": "2025-04-09T17:15:31", "name": "<Device name>", "path": "<PATH>", "subType": "", "tags": [], "type": "SSHShell" }, Per support: "The host is not returned for SSHShell entries because the documented REST API (/api/v1/vault/{vaultId}/entry/{id}) is built around Credentials entries. For other entry types, the data object only contains the basic fields you see (domain and username). We did not find a parameter or filter in the API documentation that adds the host to the response. We also found no newer version that changes this, so updating DVLS would not resolve it. For that reason, we cannot provide a documentation page justifying an upgrade for this need."

Hello, Since the introduction of the new device authorization mechanism in Devolutions Server 2026.2.19.0 , users must confirm "Yes, it's me" for every login when using Windows SSO or an external identity provider. While we fully understand and support the security improvements introduced to address the vulnerability described in DEVO-2026-0035, the current implementation can create unnecessary friction for users who regularly access the system from the same trusted workstation. We would like to request an enhancement that allows trusted devices to be remembered and uses a risk-based authorization model . Proposed Behavior After a successful device authorization, the device could be marked as trusted for a configurable period or until specific conditions change. The authorization prompt would only be displayed when: The login originates from a new device. The login originates from a significantly different geographic location. The login pattern is considered unusual or high risk. The trusted device status has expired or been revoked by an administrator. For previously approved and regularly used devices, users would not be prompted to confirm every login. Benefits Maintains the security improvements introduced by the current implementation. Improves user experience by reducing repetitive confirmation prompts. Aligns with the approach used by many modern identity providers and MFA solutions that support trusted devices and risk-based authentication. Reduces support requests and user confusion regarding repeated authorization prompts. Environment Product: Devolutions Server Version: 2026.2.19.0 Authentication: Windows SSO / Microsoft Entra ID Client: Remote Desktop Manager Thank you for considering this enhancement. We believe it would provide a good balance between security and usability while preserving the protection introduced by the recent security changes. Best regards, Christian

We need to limit the offline retention period for our vaults to 7 days. For reasons that are completely unclear to me, this restriction also applies to the Personal Vault. The Personal Vault should be decoupled from this setting. Employees store information in their Personal Vault such as the password required to access the other vaults. Therefore, restricting the offline availability of the Personal Vault makes little sense. Since it is a personal vault, it should be up to each individual user to decide how long it remains available offline. best regards Andreas

Currently, in DVLS version 2026.3.12 there is no support for using PAM Accounts to open, for example, RDP sessions. It would be nice to give the ability to have the 'connect' button available to them, discard the need to maintain two entries (PAM Account and DVLS Privileged Account) for a single access. In our case scenario, we have set up multiple 'generic' PAM domain accounts, which will be used by several contractors (one at a time, of course), therefore the need to setup the permissions of these entries. NOTE: We can use Launcher and RDM successfully, but we're trying to make the most of the web interface so some contractors with restricted internal policies may not be able to install neither of them (RDM or Launcher). Thank you! Regards, Elaine Berenguer

Please add an Authentification Option to the Backup Manager. Unfortunately we can't use unauthentificated shares. It is a security requirement.

At the moment, we can initiate RDP sessions to servers directly from the DVLS website through the DVLS Gateway using PAM. Wonderful! Would it also be possible to access HTML websites through a web browser via the DVLS Gateway using PAM? [image]

RDM/DVLS already record sessions (Session Recording, Privileged Session Monitoring). What is missing for MSPs like me is an automatic evaluation of those sessions, for example: a per-session summary (customer/vault, target system, start/end time, duration, protocol) that can be exported or fetched via API, ideally an AI-generated short description of what was done in the session (based on window titles, executed commands, keystroke metadata), a monthly report per vault/customer that can be attached to an invoice as proof of work. Use case: as an MSP without a full ticketing system, I need to generate monthly activity statements for my customers. Today I have to reconstruct this manually from calendars and logs; RDM already has all the raw data. An exportable session report (CSV/JSON/PDF or REST API) would save enormous time - the AI summary would be the icing on the cake, and could run on-premises for GDPR compliance. I would be happy to provide more details or act as an early tester.

Can you please add the "treat space as AND" option like in RDM and the Chrome Plugin Devolutions password manager, also in DVLS: [image] Thanks!

Hello, We are posting this request on behalf of another of our customers. Current behavior When a user requests temporary access to an entry in Remote Desktop Manager or the Devolutions Server web interface, the duration always starts at 30 minutes. This default cannot be changed, so the requester has to select a longer duration on every request. Request Allow administrators to configure the default duration of Temporary access requests, for example in the Temporary access settings of a vault, folder or entry, alongside the Mode and Authorizers. Use case The customer uses Temporary access to control access to production servers, and users request access to each server separately. Their work sessions are usually longer than 30 minutes. A configurable default would match the request to their typical session length, without having to change it on each request. We are sharing this request on the forum to see whether other customers and community members are interested. If this would be useful to you, please let us know in the replies. This helps us prioritize requests.

We are using devolutions server with devolutions password manager but are missing the possibility to register more than one passkey as a 2nd factor per user. Please add the possibility to add more than one passkey per user. (all other methods like TOTP are not 100% safe from a security way and not user friendly if using more than one machine) Your product is a password safe and as a password safe supporting the safest multifactor methods on a user friendly way should be your top priority. Thank you very much! [image]

Hello. I saw other topics, but I have 2 topics to address, so I created a new post. Would it be possible to set : an e-mail address for entry expiration notifications ? In our case, we would like to be able to send an e-mail to our support inbox, so we can create a ticket. set the number of days before the expiration needs to be sent. This could be managed with baselines so we could choose a baseline for certificates, another for passwords, or for a specific customer or whatever. Thank you and best regards. Marcel

On behalf of a customer: When a non-admin user creates a vault, we would like a user group to be automatically added as a Vault member. Right now, an administrator has to open each new vault and manually add the group. French: Lorsqu'un utilisateur non administrateur crée un coffre, nous aimerions qu'un groupe d'utilisateurs y soit ajouté automatiquement en tant que membres du coffre. En ce moment, un administrateur doit ouvrir chaque nouveau coffre et y ajouter le groupe manuellement.

Hi We have a bunch of people using Devolutions Launcher. Among other things, they use it to access webpages and apparently the WebView2 cache becomes a problem over time. In RDM we see the "Clear cache" setting which we assume clears the cache every time the webpage is either launched or closed...could this option please be made available to be configured via Web frontend as well? [image] Thank you

Hi there We use the "Expiring" feature a lot. E-Mails are fine, but we would appreciate a notification with Webhooks. Can you implement something like that? Best regards, John

Hi! After seeing the warning "This entry type is deprecated and will eventually be removed ..." I converted all legacy Website entries using advanced search in RDM (filter by connection type) Select all > Right click > Edit > Edit (special actions) > Web > Convert Website (legacy) to Website That worked for shared vaults in RDM, but it doesn't work for user vaults, and especially not for users that don't use RDM. So my feature request would be a way in DVLS web to be able to search all legacy entries and if possible convert them. Currently you can't select the legacy connection type for filtering entries. Or, just do the conversion automatically during a database update, if that's possible. Thanks! Daniel

Hi Devolutions team, We store Microsoft SQL Server entries in Devolutions Server and would like to access them through the web interface. Support has confirmed that this entry type is currently unsupported there. As a result, its details, including the password, are not reliably available in the browser. We have to open Remote Desktop Manager to view, reveal or copy the password. Could you add full support for Microsoft SQL Server entries in the web interface, including the ability to view the entry details and reveal and copy the stored password? We are currently using Devolutions Server 2026.2.12.0. Thank you!

We want to use more Smart Folders in our Devolution Server. And we thought it would be great to be able to not only search by name but also by eg. host. That would allow a more error free display of devices within the same VLAN for exaple, because that way the problem with forgetting to set a tag can be eliminated. For that case it would also be extremely practical to state an IP range. In our case for that to work flawlessly tho an addistional feater would be great, namely being able to specify the tree in which the folder should search instead of just the entire vault.

Hi! When installing DVLS updates there's two small things I noticed 1. When the update is installed and the scheduler service is stopped, admin users immediately receive alert notifocations (emails) with "Scheduler - Offline" and "Scheduler - No standby scheduler available". Could you add a delay to these alerts? Usually the scheduler will be up again within a few minutes during a update or a system reboot. I think the alert should only be triggered if the scheduler is unavailable for an extended period, like an hour for example. 2. I think the order of operations during the update installation process is wrong: Right now the application is stopped before the files are downloaded and extracted. Depending on bandwidth this could take some time. The files could be downloaded and extracted before the application is stopped, to reduce downtime. This would also improve error handling when the download fails for some reason. [image] Thank you! Best regards, Daniel

Il serait utile d'ajouter une fonctionnalité permettant d'envoyer automatiquement une notification par courriel lorsqu'une licence Devolutions approche de sa date d'expiration. Actuellement, Remote Desktop Manager affiche un avertissement lorsqu'une licence arrive à moins de 30 jours de son expiration, tandis que Devolutions Server affiche visuellement l'état de la licence dans Administration > Licences . Cependant, aucune notification par courriel n'est envoyée aux administrateurs. Cela nécessite donc qu'un administrateur consulte manuellement l'application ou la page des licences afin de constater qu'une licence approche de son expiration. Fonctionnalité proposée Ajouter un mécanisme de notification permettant aux administrateurs de : Activer les notifications d'expiration de licence. Définir le nombre de jours avant l'expiration pour recevoir une notification (par exemple : 90, 60, 30, 15 ou 7 jours). Configurer un ou plusieurs destinataires. Envoyer les notifications à l'aide de la configuration SMTP déjà présente dans Devolutions Server. Optionnellement, envoyer plusieurs rappels à différentes échéances. Cette fonctionnalité pourrait également être intégrée au système existant Administration > Configuration > Notifications > Abonnements , avec une nouvelle catégorie ou un nouvel événement lié aux licences. Exemple Un administrateur pourrait configurer : Licence Devolutions Server expire dans 30 jours → Envoyer un courriel à l'équipe TI. Le courriel pourrait contenir : Produit concerné Type de licence Date d'expiration Nombre de jours restants Nombre de licences/utilisateurs, lorsque pertinent Cas d'utilisation Dans un environnement d'entreprise, l'expiration d'une licence peut avoir un impact opérationnel important. Une notification proactive permettrait aux équipes TI de commencer le processus de renouvellement suffisamment tôt sans dépendre d'une vérification manuelle dans RDM ou Devolutions Server. Le système de notification par courriel étant déjà disponible dans Devolutions Server pour d'autres événements et pour les entrées arrivant à expiration, l'ajout d'un événement « Licence bientôt expirée » constituerait une extension logique du mécanisme existant.

I like the option to define a seperate Master password per vault. We use this to give our T0 Passwords a bit additional safety in addition to the user authentication with FIDO2. But the logical step would be, instead of asking for a master password of the vault being able to enforce 2.d factor check (like passkey...) again when clicking on the vault where configured.

We just migrated from RDM backed by SQL to RDM backed by DVLS for better security of our datasource. One thing I am confused on is why the only MFA alternate is Backup Codes and Email, we don't want email setup, which leaves us only with Backup Codes. Currently in RDM we have a mix of MFA options setup, YubiKey Primary, Duo for when YubiKey is not around and TOTP as a last resort if internet is down. Problem is DVLS will only allow you to pick one MFA option to setup, its would be great if there was a way to allow the user to pick at time of auth on the DVLS page to choose Duo if the user does not have their YubiKey with them instead of needing to rely on Backup codes. (We lock down web portal access so if a user burns through the backup codes we have to re-enable the web login perms. then allow them to generate codes, then we have to remove the web portal access...not ideal and much slower needing to get codes out of our PW Manager app on mobile. The web portal already has the alternate MFA button and a dropdown for codes or email...so the GUI is already ready for this feature :-) Would be great to see the above as an option for us at some point in the future. Thank you, -Derek

When using the PAM module in combination with password rotation it's very likely you will use the credential type DVLS privileged account for most of your assets in Remote Desktop Manager. This cedential type is not available/working in the web version of Devolutions Server. Because of this the web version of Devolutions Server is not usable. Can this be added in Devolutions Server?