Let Users Reach Their Own Computer from the User Portal

Assign a primary user to an Atlas Reach device so it appears under My computers in the User Portal, where that person can connect to it remotely from.

Before you begin

  • Atlas Reach enabled for the tenant, with the Atlas Reach agent installed on the device and the device approved
  • The User Portal turned on for the tenant (see User Portal)
  • The built-in administrator role, to assign or change a primary user. Anyone with reach.view can see who the primary user is
  • The person you assign signs in to the User Portal with the same Microsoft Entra account you pick

Assign the primary user

  1. Go to Atlas Reach → Devices and open the device.
  2. On the Overview tab, find the Primary user card. It reads No primary user assigned until you pick someone.
  3. Click Search for a user… and choose the person from your Microsoft Entra directory. Atlas saves the choice straight away and shows Primary user updated.

A device has one primary user at a time, and one person can be the primary user of several devices, such as a desktop in the office and a second workstation in the lab. Each one appears in their portal.

Change or remove the primary user

  • Change: click Change on the Primary user card and pick someone else. The previous person loses access to the device in the portal at once.
  • Remove: click the × (Remove primary user) on the card. The device leaves that person's portal.
  • Every assignment, change and removal is recorded in the audit log with who made it.

Who can assign a primary user

Assigning someone a primary user gives them full control of that machine, so only administrators can do it. A technician who can remote-control devices (reach.control) cannot hand that ability to someone else. Anyone with reach.view can see who a device's primary user is.

Which devices can have a primary user

  • Physical and virtual computers enrolled with the Atlas Reach agent, on Windows, macOS and Linux.
  • Not session hosts in an Azure Virtual Desktop host pool. Users already reach those under My Desktops in the portal, so the Primary user card is not shown for them.
  • Not revoked devices or Quick Support connections. A Quick Support computer is not enrolled, so it has no owner to assign.

What the user sees

When the person signs in to the User Portal, a My computers section lists each device they are the primary user of, on the home page and in the portal sidebar. Each one shows whether it is Online, or Offline with when it was last seen.

  1. The user clicks Connect next to an online computer.
  2. The remote console opens in the portal, in the browser, with full control of the screen, keyboard and mouse.
  3. If the computer is locked, they sign in with their usual Windows password.

If a computer shows Offline, it is switched off, asleep or off the network. Your help desk can wake it from Atlas Reach with Wake-on-LAN (see Remote Control a Managed Device), or someone on site can switch it on.

Which policies apply to the user's sessions

A session the primary user starts follows the same rules as one your help desk starts: the device must be approved, and your recording, privacy, file transfer, clipboard and encryption settings all apply. Each session is recorded in the audit log as started by the primary user.

  • Consent: if the device's consent mode is Consent required, it is treated as Notify only for the primary user. They are connecting to their own computer, often an unattended desk, where nobody could accept the prompt. The on-screen banner still tells anyone at the device that a session is live.
  • Notify only and Silent apply unchanged.
  • If someone from IT support is already connected, the user is told the computer is in use and can try again once the support session ends. A primary user cannot join or take over another person's session.
  • Primary users get a screen session only. They cannot open the background terminal.

If My computers doesn't appear

The section only appears when the user has at least one computer to open. Check that:

  • The user is assigned as the primary user, and they signed in to the portal with that same account.
  • The User Portal is turned on for the tenant, and your subscription includes the User Portal and Atlas Reach.
  • The device is enrolled and approved, not revoked, and is not a session host in a host pool.

Next steps