Remember Trusted Devices and Apply Risk-Based Device Authorization

Hello,

Since the introduction of the new device authorization mechanism in Devolutions Server 2026.2.19.0, users must confirm "Yes, it's me" for every login when using Windows SSO or an external identity provider.

While we fully understand and support the security improvements introduced to address the vulnerability described in DEVO-2026-0035, the current implementation can create unnecessary friction for users who regularly access the system from the same trusted workstation.

We would like to request an enhancement that allows trusted devices to be remembered and uses a risk-based authorization model.

Proposed Behavior
After a successful device authorization, the device could be marked as trusted for a configurable period or until specific conditions change.

The authorization prompt would only be displayed when:

• The login originates from a new device.
• The login originates from a significantly different geographic location.
• The login pattern is considered unusual or high risk.
• The trusted device status has expired or been revoked by an administrator.

For previously approved and regularly used devices, users would not be prompted to confirm every login.

Benefits

• Maintains the security improvements introduced by the current implementation.
• Improves user experience by reducing repetitive confirmation prompts.
• Aligns with the approach used by many modern identity providers and MFA solutions that support trusted devices and risk-based authentication.
• Reduces support requests and user confusion regarding repeated authorization prompts.

Environment

• Product: Devolutions Server
• Version: 2026.2.19.0
• Authentication: Windows SSO / Microsoft Entra ID
• Client: Remote Desktop Manager

Thank you for considering this enhancement. We believe it would provide a good balance between security and usability while preserving the protection introduced by the recent security changes.

Best regards,
Christian