> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://help.trugrid.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # TruGrid Secure RDP - Trusted Devices [Overview](#2-overview) [Requirements](#2-requirements) [How a device becomes trusted](#2-how-a-device-becomes-trusted) [Device statuses](#2-device-statuses) [IGEL UMS enrollment](#2-igel-ums-enrollment) [The IGEL UMS code](#2-the-igel-ums-code) [List the device](#2-step-1-list-the-device-in-the-trugrid-portal) [Adding the code to the UMS profile](#2-step-2-put-the-igel-ums-code-in-a-ums-profile) [Sign in from the device](#2-step-3-sign-in-from-the-device) [Resetting or removing a device](#2-resetting-or-removing-a-device) [Logs](#2-logs) ## Overview Trusted Devices lets you list think client devices in the TruGrid portal so that users signing in from them skip the MFA prompt. It works like Trusted IP, but the trust is tied to the device instead of a network location. || At the moment, only IGEL devices are supported. We will be adding more types of thin clients moving forward. | Trusted Devices never blocks a sign-in. If a listed device cannot be verified, the user signs in the normal way via EntraID login flow. || The user's own MFA settings are not changed. MFA still applies when the same user signs in from any other device, from Windows or Mac, or through the web portal. ## Requirements * The domain is a Hybrid domain. In other domain types a listed device stays Pending and sign-in is unchanged. * Users sign in through the TruGrid ThinClient Connector. Windows, Mac and web portal sign-ins are not affected. * You have admin access to the domain: MSP admin, SP tech admin, MSP technician or customer admin. * You have the device's Unit ID. It is shown in Thin client management console, on the device itself and in the device hostname. ## How a device becomes trusted A listed device enrolls itself the first time a user of the domain signs in from it through the TruGrid ThinClient Connector. That sign-in is done without MFA, and the device status changes from Pending to Trusted. || Enrollment is not tied to a specific user. Any user of the domain can be the first to sign in, and once the device is Trusted, every user of the domain skips MFA on it. A Pending device gets three successful sign-ins without MFA to complete enrollment. Normally the first one is enough; the extra two cover an enrollment that was interrupted, for example by a network drop or a closed app. If the device is still Pending after that, further sign-ins prompt for MFA as usual until you remove and re-add the device (see Resetting or removing a device). At every later sign-in the Connector confirms it is still the same device. Users see nothing of this; they just sign in without the MFA prompt. ## Device statuses | Status | Meaning | Sign-in from this device | | ---- | ---- | ---- | | Pending | Listed, waiting for the first sign-in from the device. Also the status of any device listed in a non-Hybrid domain. | Up to three sign-ins without MFA to complete enrollment, then normal sign-in with MFA | | Trusted | Enrolled. The portal has confirmed the device. | Without MFA, for all users of the domain | | Suspended | A sign-in used this Device ID but did not match the enrolled device. The portal shows the reason and the time. | Normal sign-in with MFA. The status returns to Trusted on the next successful check from the enrolled device | ### IGEL UMS enrollment Trusted Devices involves two consoles and one device. The TruGrid portal decides which devices are trusted, IGEL UMS delivers the settings to those devices, and the TruGrid Connector on the device does the enrollment. The terms used in this article: | Term | What it is | Where you work with it | | ---- | ---- | ---- | | IGEL OS | The Linux-based operating system on the endpoint, used on thin clients and repurposed PCs. The TruGrid Connector runs on it as an app. | On the device | | IGEL UMS | IGEL Universal Management Suite, IGEL's central management console. It inventories the devices, holds their configuration and pushes apps and settings to them. | The UMS console, used by the IGEL admin | | Unit ID | The identifier UMS uses for a device. It is derived from the MAC address of the device's primary network interface and also appears in the default hostname. | UMS device list, the device itself, the hostname | | Profile | A configuration object in UMS. Settings in a profile are applied to every device the profile is assigned to. | UMS > Configuration Objects > Profiles | | IGEL registry | The settings store of IGEL OS. Apps expose their settings as registry keys that a profile can set. The TruGrid Connector's keys start with app.tg_connector. | Profile > Edit Configuration > System > Registry | | TruGrid Connector for IGEL | The TruGrid app for IGEL OS, delivered to devices through UMS. Users sign in to TruGrid through it. | Installed on the device via UMS | | Trusted Devices (IGEL) | The TruGrid portal feature where you list Unit IDs so that sign-ins from those devices skip MFA. | TruGrid portal > Security Management > Trusted Devices (IGEL) | | IGEL UMS code | A code the portal issues once per domain. Placed in a UMS profile, it lets the Connector on a listed device enroll it. | Shown on the Trusted Devices (IGEL) page; set in UMS as app.tg_connector.device_trust.enrollment_code | ## How enrollment works 1. The TruGrid admin lists the device's Unit ID in the portal. The device shows as Pending. 2. The IGEL admin puts the domain's IGEL UMS code in a UMS profile and assigns the profile to the device. 3. A user of the domain signs in from the device through the TruGrid Connector. The Connector enrolls the device and the portal marks it Trusted. 4. From then on, every user of the domain signs in from that device without MFA. At each sign-in the Connector confirms it is still the same device. What does not change: * The user's own MFA settings. MFA still applies when the same user signs in from any other device or through the web portal. * Sign-ins from a Trusted IP. Those already skip MFA; Trusted Devices covers the same IGEL devices when they are outside your Trusted IP ranges. * Access. Trusted Devices never blocks a sign-in. If a device cannot be verified, the user signs in the normal way, with MFA. ## Before you start | This [article](https://help.trugrid.com/en/article/trugrid-securerdp-igel-device-management-794idp/) goes over the process of installing the TruGrid IGEL Connector. * The TruGrid domain is a Hybrid domain. In other domain types a listed device stays Pending and sign-in is unchanged. * The devices run IGEL OS and are managed in IGEL UMS. * The TruGrid Connector for IGEL is installed on the devices through UMS. See IGEL Connector installation article. * You have admin access to the domain in the TruGrid portal: MSP admin, SP tech admin, MSP technician or customer admin. * You have admin access to IGEL UMS, or an IGEL admin who will create and assign the profile for you. * You have the Unit ID of each device. In UMS it is in the device list; it is also shown on the device itself and in its default hostname. ## The IGEL UMS code | The IGEL UMS code is issued once per domain. Every device you list under Trusted Devices (IGEL) uses the same code, so you set it once in a UMS profile and assign that profile to each device you want to trust. * The code is shown on the Trusted Devices (IGEL) page in the portal. Copy it from there when you create the profile. * Adding or removing devices does not change the code. A new device only needs the existing profile assigned. * The Connector uses the code only to enroll the device. Once a device is Trusted, the code plays no further part in sign-in. * Without a matching code the Connector does not start enrollment. The device signs in the normal way, with MFA, and stays Pending. ## Step 1: List the device in the TruGrid portal 1. Open the domain and go to Security Management > Trusted Devices (IGEL). 2. Click Add devices and enter the Unit ID of each device. 3. Save. Each device is listed with the status Pending. 4. Copy the IGEL UMS code shown on the page. You will paste it into UMS in Step 2. ![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_x5gvaj.png) ### Device ID format * 6 to 64 characters: letters, digits, # and \_. * A Unit ID can be entered with or without separators. The portal normalizes it, so 00:e0:c5:aa:1b:2c and 00E0C5AA1B2C are the same device. * One active entry per Device ID per domain. ## Step 2: Put the IGEL UMS code in a UMS profile The profile is how the code reaches the Connector on each device. UMS writes the profile's registry settings to every device the profile is assigned to; the Connector reads the code from there when it enrolls. 1. In UMS, go to Configuration Objects > Profiles and create a new profile. Select TruGrid Connector in the profile. 2. Open Edit Configuration > System > Registry and find app.tg_connector.device_trust.enrollment_code. 3. Turn on the toggle, paste the IGEL UMS code and click Save and Close. 4. Assign the profile to the devices you listed in Step 1, apply the change and reboot them. ![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_axl1xn.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_1r9qf61.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_19rtqt5.png) | One profile is enough for the whole domain. When you list more devices later, assign the same profile to them. ## Step 3: Sign in from the device After the profile is applied and the device has rebooted, it enrolls itself the first time a user of the domain signs in from it through the TruGrid Connector. That sign-in is done without MFA, and the device status in the portal changes from Pending to Trusted. | Enrollment is not tied to a specific user. Any user of the domain can be the first to sign in. Once the device is Trusted, every user of the domain skips MFA on it. A Pending device gets three successful sign-ins without MFA to complete enrollment. Normally the first one is enough; the extra two cover an enrollment that was interrupted, for example by a network drop or a closed app. If the device is still Pending after that, further sign-ins prompt for MFA as usual until you remove and re-add the device (see Resetting or removing a device). At every later sign-in the Connector confirms it is still the same device. Users see nothing of this; they just sign in without the MFA prompt. ![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_1mvij5n.png) ## Resetting or removing a device Remove a device from the list in the portal to withdraw its trust. Users on that device are prompted for MFA again from the next sign-in. Nothing needs to change in UMS; the profile can stay assigned. Removing a device fully revokes its enrollment. If you add the same Unit ID again, it starts as Pending and enrolls again at the next sign-in, using the profile it already has. Remove and re-add a device when: * it stays Pending after three sign-ins; * it is Suspended and you want to start over; * the physical device was replaced or reimaged and keeps the same Unit ID; * you want it to enroll again for any other reason. If a replaced device gets a new Unit ID, list the new ID in the portal and remove the old one. The profile applies to the new device as soon as it is assigned in UMS. ## Logs In the TruGrid portal, every add, remove, enrollment and warning on a trusted device is written to the domain's activity logs. Use them to see when a device enrolled, who removed one, or why a device became Suspended. On the IGEL device itself, the TruGrid Connector writes its logs to /userhome/.config/trugrid-connector. TruGrid Support may ask for these if a device does not enroll. You can reach the device through UMS, for example with Shadow.