MONTREAL – November 10, 2026 -- Devolutions will let IT teams approve, install and update software across enrolled devices without granting local administrator rights, as part of the first phase of its endpoint privilege management roadmap. The features are expected to reach general availability in December 2026.
Device enrollment and UniGetUI extend PAM from access control to software governance
The update adds device enrollment from existing mobile device management (MDM) solutions and centralized software management powered by UniGetUI. It is designed to work alongside Microsoft Intune. Administrators can view enrolled devices in the same workspace they use for privileged access management (PAM) and manage software across major package managers.
The move extends Devolutions PAM from controlling who accesses enterprise systems to governing what runs on them. The company says the aim is to cut unnecessary administrator privileges while simplifying daily IT operations.
Devolutions pitches hours-long deployment against months-long PAM rollouts
Devolutions says its PAM module is the first to combine privileged access management and remote connections in one workflow. It says the module is designed to deploy in hours, whereas traditional PAM solutions can take months. A recent Devolutions survey of 1,372 users found Remote Desktop Manager users saving an average of 5.7 hours per week.
CEO David Hervieux said PAM has historically been built for large security teams with big budgets. He said cyber insurers and auditors increasingly expect PAM coverage, and that the company wants to give IT teams and managed service providers (MSPs) controls they can deploy quickly.
Scoped roles and a dedicated Auditor role target MSP and compliance requirements
Recent PAM enhancements include:
- Scoped administrator roles: A Workspace administrator can manage users and platform settings without seeing vault contents. Devolutions cites MSPs managing multiple client environments and organizations with strict separation-of-duties requirements as the main beneficiaries.
- Auditor role: Compliance teams can review activity logs and session metadata without accessing privileged credentials.
- Unified vault: Privileged credentials sit in the same vault as the connection entries they are used with, under one set of permissions.
- Checkout requests and approvals: Users request time-limited access, with multi-factor authentication available. Reviewers approve, deny or modify requests from the web interface, mobile app or Remote Desktop Manager. When a checkout ends, the password rotates automatically and just-in-time (JIT) permissions are removed.
- Extendable checkouts and reusable JIT accounts: Work that runs past its window can continue under approval and time limits. Reusable accounts keep mailboxes, licenses and history tied to one identity.
- Session recording and audit logging: Privileged sessions can be recorded and played back, and every privileged action is logged. Predefined PAM reports are included.
Devolutions prices PAM at $650 per user per year and demos new features at Microsoft Ignite
The new features will be demonstrated at Microsoft Ignite, November 17-20, at booth 6271R. Devolutions PAM is available now. Existing customers can add the module to their current Remote Desktop Manager, whether on a cloud or self-hosted workspace.
New customers receive the workspace with their purchase, either self-hosted or cloud-based. Pricing is by named user: the Privileged Access Management package costs $650 per user per year, billed annually, with standard support included. A 14-day free trial is available.