Before you begin
- Atlas Reach enabled for the tenant, with the Atlas Reach agent installed and the device approved
- The reach.control permission. Every reach.* permission belongs to the built-in administrator role only, and you can add them to a custom role
- On macOS, the Screen Recording grant (to view) and the Accessibility grant (to control) for the agent
Start a session
Go to Atlas Reach → Devices. Each online device row has three ways in:
- Connect: opens the remote console with full control of the screen, keyboard and mouse.
- View only (the eye icon, "Watch the screen without sending input"): you see the screen but send no input.
- Terminal (the terminal icon): opens a background PowerShell terminal without disturbing the user. It needs Allow Remote Shell turned on for the device's host pool.
If these buttons are greyed out with "You don't have permission to control this device", your role does not have reach.control. Ask an administrator to add it to your role.
Consent: whether the user is asked first
The Remote session consent card on the Atlas Reach Devices tab sets the tenant default. Each host pool can override it from the Settings section of its left-hand menu.
- Consent required: the person at the device must click to allow the session before you see anything.
- Notify only (the default): the session starts straight away and the user is told that someone is connected.
- Silent (unattended): no prompt. Use it for unattended machines such as servers and kiosks.
Under Consent required, the prompt waits 30 seconds. If the prompt goes unanswered, or nobody is signed in, the session follows your choice: Auto-decline (fail closed), the default, refuses the session; Auto-accept (unattended hosts) lets it start. Terminal sessions run in the background and do not show the consent prompt.
What the person at the device sees
While a session is live, a banner stays on the device's screen saying who is viewing or controlling it, with a Stop sharing button the user can click at any time to end the session. The banner also says when you are listening to the device's audio or when your microphone is on.
The console toolbar
- Files: browse the device's drives and folders, download files, and send files by choosing them or dropping them onto the screen. Each file can be up to 100 MB; files are queued and sent one at a time.
- Clipboard: Copy from device and Paste to device move clipboard text in either direction.
- Chat: opens Session chat. Messages are visible to everyone in the session, including the person at the device.
- Keys: sends shortcuts your own computer would intercept, such as Win+L, Alt+Tab, Ctrl+Esc, Print Screen and Alt+F4. Send Ctrl+Alt+Del is available on Windows.
- Reboot & reconnect: restarts the device and reconnects you when it comes back. The session waits up to 5 minutes for the device to return.
- Listen: hear the device's audio (Windows, and Linux with PulseAudio or PipeWire). Microphone: talk to the user through the device's speakers (Windows only).
- Quality: Auto, Best quality, Balanced or Best speed. Zoom: Fit to window, or 50% to 200%. Monitor: All, or one monitor at a time. You can also switch between Remote resolution and Native resolution and open Stats.
- Annotation tools (pen, arrow, rectangle and laser pointer), full screen and an on-screen keyboard.
Privacy controls
Use the privacy controls when the screen shows something the person in the room should not see, or when they must not touch the keyboard while you work.
- Privacy screen: blanks the device's physical screen while you keep working on it.
- Block local input: stops the local keyboard and mouse while you are connected.
- Lock on end: locks the device when the session ends. It works on Windows, macOS and Linux.
Privacy screen and Block local input are fully supported on Windows. On macOS and Linux you can turn them on in the console, but they are not switched on automatically by your "by default" privacy settings.
Session recording
Recording is set per host pool in Atlas Reach Session Recording, and in Session Recording in Settings → Configuration Matrix for wider scopes.
- Off (the default): nothing is recorded.
- On-demand: you choose whether to record when you start the session.
- Always: every session is recorded.
Recordings are kept for 30 days by default (change it with Recording Retention) and each tenant has a 4 GB recording budget. Replay them from the Recordings card on the Atlas Reach Devices tab or from a device's Sessions tab. Replaying a recording also needs the audit.view permission.
Session length and dropped connections
- Sessions last up to 240 minutes by default. Change it with Maximum Session Length in the Configuration Matrix, from 5 to 1,440 minutes, for the whole tenant or one host pool.
- Five minutes before the limit you are warned. Click Extend to add 30 minutes.
- If your own connection drops, the session is held for 60 seconds so you can pick up where you left off.
- A session with no screen activity in either direction for 2 minutes ends as idle.
Working with another operator
When a colleague opens a device that is already in a session, they choose how to join:
- Shadow (view only): watch alongside the current operator without sending input. Up to four people can shadow a session.
- Take control: become the driving operator. The previous operator stays connected as a viewer.
A shadow who is finished clicks Leave session, which leaves the session running for everyone else. End session closes it for everyone.
End-to-end encryption
Set Atlas Reach Session Encryption to End-to-end for a host pool (the alternative is Relay) and the session is encrypted between your browser and the device. The toolbar shows a code: read it to the user so they can check it against the code in their banner. If either end cannot use end-to-end encryption, the session is refused rather than downgraded.
Wake an offline device (Wake-on-LAN)
An offline device that supports Wake-on-LAN shows a Wake button (the power icon) in its row. Atlas Reach asks an online device on the same subnet to send the wake signal. There is no confirmation that the device woke: watch for it to come online, then connect.
- The device is already reachable: Wake is not needed, so the button is disabled.
- No MAC address or subnet on record: the device cannot be woken. Re-enroll it with a current agent so it reports them.
- The device is pending approval: approve it on the Devices tab first. Revoked devices have no Wake button.
- The Atlas agent is turned off for the device's host pool.
- No online device on the same subnet is available to send the signal: switch on another device on that network first.
Host pool settings
Open a host pool, go to Settings → Remote Management → Atlas Reach to override the tenant settings for that pool:
- Atlas Reach File Transfer and Atlas Reach Clipboard: allow or block the Files and clipboard tools.
- Atlas Reach Session Recording: Off, On-demand or Always.
- Atlas Reach Session Encryption: Relay or End-to-end.
- Remote session consent: the consent mode for this pool.
- Allow Remote Shell: allow or block the terminal.
Platform notes
- macOS: grant Screen Recording (to view) and Accessibility (to control) to the agent.
- Linux on Wayland: the user approves the first screen share. If they choose to remember it, later sessions start without asking.
- Linux clipboard: needs xclip or xsel installed on the device.
- Windows Server Core: there is no desktop to share, so Connect offers PowerShell (and PowerShell 7 if it is installed).