MDM · For IT admins

Zero-touch for your team.

People open remoteNX – and their connections, certificates and policies are already there.

In development, coming in the next release. The MDM configuration is implemented but not in the App Store yet. In the current build, telemetryAllowed and reviewPromptAllowed already apply.

What can be pushed

Content	Description
Connections	RDP, Horizon and SSH connections including options
Groups	Structure of the connection list
Tunnels	SSH tunnels including jump-host chains
Horizon servers	Connection Servers and Access tenants
Snippets	Shared commands for the team
Pinned host keys	Known fingerprints, without a prompt on the first connection
Root CAs	Trust anchors for RDP and Horizon TLS (see `trust`)
Client certificates	For Horizon, Access and UAG (see `trust`)
SSH identities	Users and keys, kept in the keychain
Policies	See the table below

Policies

All policies live under policies in the configuration.

Key	Effect	Status
`allowUnmanagedConnections`Boolean	false: only the organisation's connections are shown; the user's own stay on the device but hidden	implemented, coming in the next release
`allowSavingPasswords`Boolean	Allow saving passwords	implemented, coming in the next release
`allowClipboard`Boolean	RDP: allow clipboard redirection (and copy and paste in the terminal)	implemented, coming in the next release
`allowDriveRedirection`Boolean	RDP: false blocks drive redirection entirely. Whether a drive is read-only is the connection's own setting (`rdp.driveRedirectionReadOnly`)	implemented, coming in the next release
`allowMicrophone`Boolean	RDP: allow microphone redirection	implemented, coming in the next release
`minimumTLSVersion`String	RDP: minimum TLS version	implemented, coming in the next release
`requireNLA`Boolean	RDP: require Network Level Authentication on every connection	implemented, coming in the next release
`requireAppLock`Boolean	Require the app lock (Face ID, Touch ID or device passcode) to open remoteNX	implemented, coming in the next release
`appLockTimeoutSeconds`Integer ≥ 0	How long the app may stay in the background before the lock asks again	implemented, coming in the next release
`allowSessionPreviews`Boolean	false: no session thumbnails are stored	implemented, coming in the next release
`allowCommandHistory`Boolean	false: SSH terminals keep no command history on the device	implemented, coming in the next release
`allowFileTransfer`Boolean	false: no downloads from or uploads to SSH hosts (SFTP/SCP); unset follows allowDriveRedirection	implemented, coming in the next release
`hideHostnamesInLiveActivity`Boolean	Hide host names in the Live Activity	implemented, coming in the next release
`telemetryAllowed`Boolean	false: crash reports and usage statistics off and locked	implemented, coming in the next release
`reviewPromptAllowed`Boolean	Allow the App Store rating prompt	implemented, coming in the next release
`sessionIdleTimeoutMinutes`Integer ≥ 1	End sessions after this many idle minutes	implemented, coming in the next release
`allowKeyExport`Boolean	false: private keys cannot be exported or shared	planned
`businessEntitlement`Boolean	Reserved, not used yet	reserved
`crashReportDSN`String	Reserved, not used yet	reserved
`feedbackURL`String	Reserved, not used yet	reserved

Trust: certificates

Key	Effect
`trust.anchorCertificates`array of asset IDs	Managed certificates (IDs from `AppConfig.Certificates`) used as root CAs for RDP and Horizon TLS.
`trust.clientIdentities`array of {hostPatterns, managedIdentity}	Which managed identity answers a TLS client certificate request – for Horizon, Access and UAG, by host pattern.

SSH identities and host keys

Managed SSH identities use the keychain key for SSH logins and tunnels – not for RDP or RD Gateway.
Pinned host keys (knownHosts) work: remoteNX trusts exactly these fingerprints.
SSH certificate authorities (sshCertificateAuthorities) are parsed but not active yet, because libssh2 cannot verify host certificates yet.

Delivery

Apple ManagedApp framework from iOS 18.4 through the declarative configuration com.apple.configuration.app.managed (Declarative Device Management). Certificates and identities arrive as assets and go into the keychain.
Classic Managed App Configuration (com.apple.configuration.managed) for MDMs without DDM.

How it looks in the app

Pushed items carry a Managed label and are read-only.
Settings shows Managed by your organisation and the active policies.
Switches locked by a policy are visible but cannot be changed.

Supported MDM solutions

Intune
Jamf
Workspace ONE
Apple Business Essentials
Any MDM with Declarative Device Management (DDM)

Reference

Preliminary – the full reference comes with the release.

remotenx-config.schema.json – JSON schema of the configuration
sample-org.json – example configuration of an organisation
ddm-app-managed.json – Declarative Device Management with assets
intune-app-config.json – app configuration for Intune
jamf-app-config.plist – app configuration for Jamf

Questions about a rollout?

We help with pilots and with integrating remoteNX into your MDM.

support@remotenx.app