Devolutions Expands PAM With Device Enrollment and Centralised Software Management

Removing local administrator rights can reduce unnecessary access, but IT teams still need a practical way to install and update the software employees use. Devolutions is expanding its platform with device enrollment and centralised software management, aiming to connect that everyday work with the controls already used for privileged access.

Announced November 9, the capabilities represent the first phase of the company’s endpoint privilege management roadmap. They are designed to work alongside existing mobile device management systems, including Microsoft Intune, and use UniGetUI-powered software management to let administrators approve, install and update packages without granting users local administrator rights.

The new features are expected to become generally available in December 2026. They extend the platform beyond controlling who can access a system toward governing the software running on enrolled machines, while keeping connections, credentials and privileged workflows in a shared workspace.

Device Enrollment Connects Access Controls With Endpoint Work

Privileged access management and endpoint software management address related problems. PAM controls access to powerful accounts and sessions; endpoint controls determine how software is installed and maintained on the machines those accounts reach.

Devolutions plans to bring enrolled devices into the same workspace administrators use for PAM. Its announcement describes enrollment from existing MDM solutions, rather than requiring organisations to abandon their device-management investments. Microsoft Intune is specifically named as a system the new functionality is designed to complement.

The practical goal is to separate a legitimate software request from a permanent grant of administrator privileges. An approved installation should not require giving an employee broad authority to make unrelated changes afterward. Centralising that workflow could also reduce the need for administrators to move between separate tools for access and routine endpoint maintenance.

The announcement does not specify the complete supported device matrix or every package manager available in the enterprise release. Those implementation details will matter when teams assess how the December capabilities fit their existing estate.

UniGetUI Brings Multiple Package Managers Into One Interface

The software-management component builds on UniGetUI, Devolutions’ open-source interface for package managers. The existing product brings together software discovery, installation, updating and removal across systems including WinGet, Chocolatey, Scoop, Pip, Npm and PowerShell Gallery.

UniGetUI also supports bulk operations and exporting package lists for use on another machine. That background helps explain its role in the announcement: it provides a common way to handle software distributed through different package ecosystems, while the upcoming enterprise features add central approval and management around enrolled devices.

The existing open-source application and the new enterprise workflow should be distinguished. UniGetUI’s current capabilities provide technical context; they do not establish that every package source, option or deployment pattern will be supported in the first centralised release.

Scoped Roles Reduce the Reach of Administrative Accounts

The endpoint roadmap accompanies recent PAM enhancements aimed at making privileges more granular. A Workspace administrator can manage users and platform settings without automatically gaining access to vault contents. A dedicated Auditor role lets security and compliance staff inspect activity logs and session metadata without retrieving privileged credentials.

That separation is useful for managed service providers working across customer environments and organisations that require different people to administer the platform, use credentials and review activity. A broad administrative title need not imply authority over every secret in the system.

Devolutions also combines connection entries and PAM credentials in one vault. The aim is to keep a privileged credential associated with the connection that uses it, with one permissions structure governing the workflow.

“PAM has historically been built for large security teams with big budgets and months to spare, but that’s not how IT teams work,” said Devolutions CEO David Hervieux, in the announcement. The company positions its platform around controls that system administrators and smaller IT teams can use during routine work.

Time-Limited Access, Rotation and Session Evidence

The Devolutions PAM offering integrates privileged workflows with Remote Desktop Manager and either a self-hosted or cloud workspace. Its website describes account discovery, step-up authentication, just-in-time elevation and session oversight as parts of that approach.

In the release, users can request time-limited credential checkouts, with multi-factor authentication available. Reviewers can approve, deny or modify requests through the web interface, mobile application or Remote Desktop Manager. At the end of a checkout, passwords are rotated automatically and just-in-time permissions are removed.

Approved extensions can accommodate work that outlasts its original window. Reusable just-in-time accounts also preserve the identity associated with mailboxes, licences and history, while time limits and approval controls govern access. Privileged session recording, activity logs and predefined reports provide evidence for subsequent review.

These capabilities address different points in the access lifecycle: approval before access, limits during use and credential or permission changes afterward. Their effectiveness depends on the policies an organisation configures and the systems it brings into scope.

December Rollout and Current PAM Pricing

Devolutions plans to demonstrate the new device-enrollment and software-management features at Microsoft Ignite, November 17–20, ahead of their expected December 2026 general availability. The existing PAM module remains available now, with a 14-day trial.

According to the announcement, the Privileged Access Management package costs $650 per named user per year, billed annually, with standard support included. Existing customers can add the module to their current workspace; for new customers, the package includes the workspace it runs in. The release does not separately price the forthcoming endpoint capabilities.

The direction is a closer connection between access governance and daily endpoint work. By combining controlled credentials, remote connections and approved software operations, Devolutions is trying to make least privilege easier to sustain after the initial security policy has been written.