Accounts that can sign in with an emailed code. Technicians see and
connect to their tenants' machines; clients see their own machines
only. SSO users are managed in your identity provider, not here.
Rows marked config come from the server's
CP_OTP_USERS and are read-only — add the
same email here to override one.
Email
Type
Tenants
Role
Status
Roles
A role decides which features its users can use. It never widens
which machines they can reach — tenant access stays on the account.
Admin always has every capability. Technician and Client are the
defaults for their account types; assign a custom role to a user
on the Users tab to override.
Changes here apply to this tenant only; roles marked
“customized” differ from their global defaults.
SSO group mapping
Give members of an identity-provider group a role automatically at
sign-in. The first matching mapping wins; users in none of these
groups keep their account type's default role. Manual assignments
on the Users tab are never overwritten.
IdP group
Role
Enrollment codes
Agents enroll with an active code to join a tenant.
Code
Tenant
Status
Expires
Tenant consent
Snapshotted into each session token.
ID
Company name
Consent policy
Require signing
Auto-update
Automatic agent updates
Agents in opted-in tenants are rolled forward in small waves
(3 machines first, then 10, five minutes apart). The rollout
stops on its own if machines report failures or begin an
update and never come back — and stays stopped until
someone clears it here.
Loading…
Agent installer
The Access-agent installer this server hands out, and the
build it pushes on update. Replacing it here swaps the file and records its
version together - they are announced to agents as a pair, so a version that
disagrees with the file makes updates silently no-op.
Status
—
Version
—
Size
—
Uploaded
—
SHA-256
—
Path
—
This relay personalizes installers in the self-signed tier (Tier B/C), which
appends configuration into Authenticode-covered bytes and signs afterwards, so
it needs an unsigned base. Upload the file under
installer/output/unsigned/
(build-installer.ps1 -AlsoUnsignedBase), not the
signed artifact beside it.
Uploading…
Viewer installer
The technician viewer this server hands out, and the
build it advertises to installed viewers. Notify-only: a viewer is told a
newer build exists, never updated out from under someone mid-session.
Status
—
Version
—
Size
—
Uploaded
—
SHA-256
—
Path
—
Uploading…
Audit retention
How long connection history and the event log are
kept. A background task purges older rows hourly. Set 0 to keep forever.
Live sessions are never purged.
Deploy the Access agent
Config rides in the signed filename — double-click, Next, done.
Run the downloaded file — it installs the viewer and then connects
to automatically. After that, Connect
opens instantly from this page.
The viewer installer isn't hosted on this server yet — build it with
installer/build-viewer-installer.ps1 and set
CP_VIEWER_INSTALLER_PATH, or install the
viewer manually, then try again.