dromano

Hello! after some digging i found that there is indeed a way to disable the passkey prompt in the extension via GPO or by the user himself. Within the documentation that you have provided there is a example JSON that starts with:

{

"settings": {

//.......

}

}

this JSON should show all available keys to be set by the GPO but seems to be outdated. If you want to disable the passkey prompt by default with your GPO add this key with the value false in your settings

{

"settings": {

showPasskeyPrompt: false

// other settings.....

}

}

this should disable the passkey prompt functionality entirely and show the option unchecked in the general settings. If you wish to manually disable the passkey option, this is where you would do it.

If you are having any troubles implementing this option, please let us know.

Best Regards,

Samuel Boucher.

@Samuel Boucher

This is great news, thank you! I will get this setup now, appreciated.

We recently deployed Devolutions Workspace extension to our users, quickly realized that there was not an option to control the Passkey option. I was told by support that this would need to be a feature request?

Seems odd to allow all the existing options to be customized via deployment without control of passkey functions. Right now, it's a manual process I have to provide instructions on to disable per the settings of the extension and can only be done via GUI by the user, seems like this does not make sense as its always getting in the way and we don't want people using this for passkeys right now.

Below was my inquiry to support:

Looking over > Configure the Workspace browser extension in Google Chrome or Edge using GPOs - Devolutions Documentation

I don’t see a way to disable the passkey prompt? Is that a possible to configure for users (disable the prompt for passkey).

Hi everyone,

We have good news to share on this front, in our next release 2026.1, users will be able to set any combination of MFA factors at once. Allowing you to combine TOTP, Yubikey, SMS and more if you'd like. We're also adding Passkey support to the growing list of factors.

This is only phase 1 of modernizing Devolutions Server's authentication, phase 2 which is TBD, will allow users to set multiple factors of the same type as well. (special shout out to our very patient users dual wielding Yubikeys).

Cheers,

@Luc Fauvel

This great news, appreciate the support and listening to feedback!

+1 for this request.

@mad

I do really hope they work this in, it comes up quite a bit for out small team, someone works from home and forgets their yubikey...one of us needs to go in and reset for them to totp as you can't use both and pick between (but can in RDM).

Jafran, I have found a problem with this in use...If a user had their clipboard paste method set to legacy prior to policy being enforced, the UI for them is greyed out to allow setting process exclusions (my guess is because legacy does not use this feature, so the app greys it out)...so setting the Paste Once secure method via GPO then prevents the user from properly adding process exclusions (sine the app UI shows legacy is selected still just orange to show its being set by GPO).

I think this should be possible to allow users to still add process exclusions when they had legacy set, then policy enforces Paste Once secure...or give admins control of excluded processes settings via GPO itself, I think it would be better to allow the UI to function but would like at least one of those to be true.

Let me know if you need further clarification.

-Derek

Hello,

Thank you for your interest. It will probably not be part of 2025.2 planned in June because we have a lot of work ahead of us, but it should be part of our next development cycle. I'm keeping that improvement in mind; we will post back here once we have an update.

Best regards,

I am glad this is finally getting some traction, we have had this happen quite a few times since I posted and the one-time burnable codes are too cumbersome to deal with vs TOTP.

Much appreciate the working this into release at some point, will be a welcomed change for many, I am sure.

-Derek

A way to set via GPO (I don’t see it) or another way (reg key) to force RDM Settings > Application > Clipboard > Advanced > “Clipboard copy method” to Paste once (secure)

Thank you François, appreciate it

We just migrated from RDM backed by SQL to RDM backed by DVLS for better security of our datasource.

One thing I am confused on is why the only MFA alternate is Backup Codes and Email, we don't want email setup, which leaves us only with Backup Codes.

Currently in RDM we have a mix of MFA options setup, YubiKey Primary, Duo for when YubiKey is not around and TOTP as a last resort if internet is down.

Problem is DVLS will only allow you to pick one MFA option to setup, its would be great if there was a way to allow the user to pick at time of auth on the DVLS page to choose Duo if the user does not have their YubiKey with them instead of needing to rely on Backup codes. (We lock down web portal access so if a user burns through the backup codes we have to re-enable the web login perms. then allow them to generate codes, then we have to remove the web portal access...not ideal and much slower needing to get codes out of our PW Manager app on mobile.

The web portal already has the alternate MFA button and a dropdown for codes or email...so the GUI is already ready for this feature :-) Would be great to see the above as an option for us at some point in the future.

Thank you,

-Derek

Just letting you know that I can confirm this will be available in 2022.2.16.0, RDM will remember the previously used 2FA method.

Regards,

Great thanks so much!

Hello,

Just to let you know, with RDM 2022.2, the default will now be to prompt for which 2FA you want to use if you configured multiple ones under File>Options>Security. The option can be changed back to the previous mode (checking against all configured 2FA methods, rather than choosing one), and it can also be forced for all users in the System Settings or through GPO.

Regards,

Hubert thank you to you and your team to make this an option for users of your product.

This does solve my concern of being locked out when no internet with TOTP as a configured fallback...however there is one tedious extra step now though every time I unlock the app I am first presented with a choice now instead of my preferred method (Yubikey or Duo depending on user) being prompting right away, now we are force to choose from the dropdown each time then click ok button, just to get to the first step of unlocking....its a bit clunky.

What would be great is if it could at least remember my last used option and make that the default in the drop down menu, like each time its pushing to the dropdown to select it always reverts to TOTP as the first option, which is the one I want as my backup option only. I would imagine this would be easier to implement then what may be the preferred method of only prompting for default of Yubikey or Duo without the dropdown selection at all (skips one more step) and only offering alternate dropdown after the primary is canceled or not successful. (This would eliminate 3 separate clicks just to get to my preferred 2FA option)

Hubert that would be perfect. Thanks

Hello,

I saw you also posted in this thread. Are you talking about the same scenario (the application 2FA options, located in File > Options > Security), or something else? If not, which 2FA are you talking about?

Regards,

Yes I am talking about the same option but for a different reason, after I added the request I saw that other thread and figured I would comment in there to. Not sure if it would be implemented in the same way, but as long as you have more then 1 option I guess that would solve mine as well since I could have Duo and TOTP and use Duo mainly then use TOTP if Duo is not working

Thank you for the details. By Fido do you mean Yubikey/Duo in this section?

If we're talking about this section then I agree that this would be a good option to have and I can open a ticket so we can look into adding this to RDM. As you mention, at the moment they are all additive, which can be useful for some, but I would figure for the majority of users, an option to choose between multiple 2FA methods is more useful.

Regards,

This would be really helpful in the event of and internet/service outage for the 2FA that are internet required, Duo and Yubikey require talking to internet to function, so having the TOTP as a secondary option for those in the event of a failure to communicate you would be prompted for the code instead.

I was wondering since DUO requires working internet what happens

in the event of not being able to be reached and getting locked out of

RDM?

What would be a great feature add, allow configure of fallback

2FA to the TOTP code option that works without internet, its slower so it’s like a

secondary 2FA option.