Question 1

Which devices can I connect to with Atlas Reach?

Accepted Answer

Live view and control works on enrolled Windows devices: session hosts and physical Windows endpoints running the Atlas AVD Agent. Operators choose view-only or full control per session. The Atlas Reach agent for macOS and Linux lands Macs, Linux workstations, and Linux VMs on the same Devices page speaking the identical device-facing contract, with live health monitoring and remote view and control on those platforms.

Question 2

Who can start a remote session?

Accepted Answer

Only an authorized operator entitled to Atlas Reach. Remote control is available by default and an admin can switch it off for the whole deployment. Every session is audited. A fleet that does not want the capability at all can install the agent telemetry-only, which leaves remote control out entirely, and that install-time choice is one the server can never override.

Question 3

Does Atlas Reach open an inbound port to my devices?

Accepted Answer

No. The agent holds a persistent outbound connection to the server (the same authenticated channel it reports telemetry on), and the server relays the session to the operator. Nothing connects inbound to the device, and because the control channel authenticates with the device's own credential, revoking a device means it can no longer be reached.

Question 4

What does Atlas Reach cost?

Accepted Answer

Atlas Reach is metered in units, like the End User Portal and Atlas Ink: one unit per calendar month for every managed device the agent is installed on that is not an AVD session host: physical Windows, Mac, and Linux endpoints, Azure VMs that are not session hosts, and VMs that run outside Azure. Only an AVD session host in a host pool Atlas has synced is free, however much Reach is used on it; a session host not yet in your synced inventory is billed like any other managed device until it is. Atlas Resolve, the DNS filter the same agent runs, is included with Atlas Reach and uses no units of its own: filtering DNS on a device adds nothing to that device's Reach unit. A unit is always $1, drawn from your subscription's pooled monthly unit allowance, with more prepaid units available to add whenever you need them (there is no overage bill).

Question 5

Why are synced AVD session hosts free, and when is a device billed?

Accepted Answer

Managing your Azure Virtual Desktop session hosts is what the per-tenant plan price already buys, so any AVD session host in a host pool Atlas has synced is free. Every other device the agent manages is a unit: physical endpoints, Azure VMs that are not session hosts (a jump box, a file server, a dev or IaaS VM), and VMs running outside Azure. The free status rests on verification, not on what the agent reports: Atlas confirms a session host against your synced host pools, so a session host not yet in inventory is billed as a managed device until Atlas can verify it.

Question 6

How do devices get enrolled?

Accepted Answer

A tenant admin mints an enrollment token on the Atlas Reach Devices page and bakes it into the agent install. The device enrolls once, receives its own long-lived device credential, and every later connection authenticates with that credential. One enrollment token binds to exactly one tenant, so a device can never report into someone else's environment.

Atlas Reach: Remote View & Control for AVD