Replacing RD Gateway changes RDP governance, not just access

At a glance

What this is: This white paper describes a replacement for Microsoft RD Gateway that shifts RDP from network-centric access to policy-controlled, just-in-time session brokering with stronger auditability.

Why it matters: It matters because IAM, PAM, and infrastructure teams need to govern privileged remote access as an identity and evidence problem, not just a connectivity problem.

👉 Read Devolutions' white paper on replacing Microsoft RD Gateway for auditable RDP

Context

RDP exposure is a governance problem as much as a connectivity problem. When remote administration is handled through an internet-facing gateway, the control question is not only whether traffic is encrypted, but whether access is time-bound, attributable, and constrained to the right target host. That is the primary identity security issue in this white paper, because RDP sessions typically involve elevated access.

For teams managing privileged access, the real weakness in gateway-centric designs is that network entry is not the same thing as authorization. A remote session can be technically reachable while still lacking per-session approval, strong evidence, and clear session accountability. This is why RDP governance sits at the intersection of PAM, access policy, and audit readiness, especially in SMB and managed service provider environments.

For a broader identity governance lens on these patterns, see the NHI Lifecycle Management Guide and the Ultimate Guide to NHIs , Key Challenges and Risks. The article's starting point is typical: many organisations inherit remote access designs that solved exposure first and governance second.

Key questions

Q: How should security teams govern privileged RDP access without relying on a gateway as the control boundary?

A: Treat the session as the control unit. Approval, MFA, host scoping, and logging should all happen before the connection opens, so the organisation can prove who accessed which server, for how long, and under what authorization. Connectivity should be the outcome of policy, not the policy itself.

Q: Why does RD Gateway create governance risk even when it hides RDP from the internet?

A: Because hiding the port is not the same as constraining entitlement. If the design cannot prove per-session approval, target specificity, and duration, remote access can remain broad, hard to audit, and easier to abuse even though the network exposure looks reduced.

Q: What breaks when remote administration lacks per-session evidence?

A: Investigations become slow and uncertain because teams cannot reconstruct who approved the session, which host was reached, or whether credentials were injected. That missing context weakens auditability and makes privileged access harder to defend after the fact.

Q: Who is accountable when remote access approvals, MFA, and logging are split across different systems?

A: Accountability becomes fragmented across infrastructure, IAM, and operations teams, which usually means gaps go unresolved. A coherent privileged access model needs one policy owner for approval, one evidence trail for the session, and one process for reviewing exceptions.

Technical breakdown

Why RD Gateway creates an identity control gap

RD Gateway solves one problem by keeping RDP off the open internet, but it still concentrates trust in a gateway that is mostly concerned with entry, not entitlement. That means authentication can succeed while the organisation still lacks session-level proof of who approved access, which host was targeted, and for how long the privilege existed. In identity terms, the gateway is a transport control, not a full authorisation control plane. Practical implication: teams should separate connectivity from entitlement and treat remote administration as a governed access transaction.

Practical implication: do not mistake network reachability controls for privileged access governance.

How just-in-time RDP brokering changes the control model

Just-in-time RDP brokering replaces persistent gateway reachability with session-scoped authorization. The control plane approves a specific user, target host, and time window, then opens only the path needed for that session. This reduces standing exposure because there is no broad network tunnel waiting for reuse, and it also tightens audit trails because the request, approval, and execution are tied together. Credential injection further reduces exposure by keeping privileged passwords out of the user's hands. Practical implication: the session, not the gateway, becomes the unit of control and evidence.

Practical implication: move RDP approvals, time limits, and credential handling into the same policy workflow.

Why audit-ready remote access depends on per-session evidence

Audit-ready RDP means being able to prove requester identity, target host, start and stop times, approval context, and whether credentials were injected or exposed. That evidence matters because investigations often fail when access is only visible at the network layer. Session recording and SIEM forwarding help, but the deeper point is architectural: if the control plane cannot express and retain the session context, the organisation cannot reliably reconstruct privileged activity later. Practical implication: design remote access so evidence is generated at the point of authorization, not after the fact.

Practical implication: require per-session logs and approvals that can stand up in audits and incident reviews.

Threat narrative

Attacker objective: The attacker aims to obtain and reuse privileged remote access to administrative systems while minimizing detection and preserving operational freedom.

1. Entry occurs when internet-facing RDP or gateway authentication is reachable from outside the corporate network, creating a surface for brute force and password spraying against remote access credentials.
2. Escalation occurs when persistent or over-broad access lets an attacker reuse a valid remote path to reach administrative hosts, especially if MFA enforcement is brittle or session scope is not tightly constrained.
3. Impact occurs when the attacker uses remote administration access to operate on target servers with insufficient per-session evidence, making containment and forensic reconstruction slower.

Breaches seen in the wild

• Microsoft SAS Key Breach — Overly permissive Azure SAS token exposes 38TB of Microsoft internal data including secrets and credentials.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

RD Gateway replacement is really a governance redesign, not a transport swap. The core issue is that access architecture should not stop at secure entry, because privileged remote work needs entitlement, time bounds, and evidence as first-class controls. Once organisations understand that, the discussion shifts away from tunnel performance and toward who can create, approve, and prove a session. The practitioner conclusion is simple: remote access must be governed as an identity transaction.

Audit-ready RDP depends on session context, not just authentication logs. A successful login without approval lineage, target specificity, and duration evidence leaves investigators with an incomplete record. That is why per-session logging and recording are not add-ons in regulated environments, they are the mechanism that makes remote administration defensible. Practitioners should treat evidence completeness as a design requirement, not a reporting preference.

Identity blast radius: the real win in brokered RDP is shrinking the distance between approval and execution. When the control plane authorizes only one host for one window, the blast radius of a compromised admin account is materially smaller than in a network-wide gateway model. This aligns with NIST Cybersecurity Framework 2.0 access governance principles and with privileged access discipline in NIST SP 800-53. The practitioner conclusion is to engineer for minimal reachable scope, not maximal convenience.

Least privilege for remote administration fails when the gateway is treated as the control boundary. The gateway can hide RDP from the internet and still leave broad entitlement problems untouched if approvals, MFA, and credential handling live elsewhere. That failure mode is common in lean IT environments because the infrastructure seems secure while the governance layer remains fragmented. The practitioner conclusion is that remote access policy must be evaluated at the session level, not the network perimeter.

Managed service provider environments make the governance case even stronger. When one team services multiple client environments, the risk is not just exposure but cross-tenant overreach and weak evidence segregation. A session-brokered model provides cleaner host scoping, clearer attribution, and better operational separation than relying on multiple brittle gateway configurations. The practitioner conclusion is to prioritize architectures that make accountability portable across tenants and clients.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, which is why privileged access governance now has to assume identity abuse is a normal operating condition.
• That same research shows enterprises that experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, reinforcing the need for tighter session-level control and lifecycle discipline.

What this signals

Identity blast radius: RDP governance will keep moving from perimeter design to session design. As remote work, MSP administration, and regulated audit demands converge, teams that can prove approval lineage and target scoping will have a better control story than teams that only prove connectivity.

The practical shift is toward control planes that integrate MFA, JIT approvals, credential handling, and evidence capture in one place. For practitioners, that means remote administration should be measured by session completeness and audit fidelity, not by whether the gateway stayed up.

The NIST Cybersecurity Framework 2.0 remains a useful reference point for this transition because access control only matters if it is linked to detection and response evidence. The same logic applies to privileged access workflows: if the session cannot be reconstructed, governance has failed even when authentication succeeded.

For practitioners

• Move authorization into a control plane Centralize approval, MFA, and time-boxed access decisions so the RDP session opens only after policy evaluation has succeeded. Keep the target host, requester, and window tied together in one workflow.
• Require per-session evidence for privileged RDP Record requester, host, start and stop times, approval reference, and credential-injection status for every administrative session. Use that evidence as the baseline for audit and incident review.
• Eliminate exposed gateway dependency paths Reduce direct internet exposure and avoid designs that rely on broad gateway reachability for remote administration. Scope access to the approved RDP host only for the duration of the session.
• Standardize JIT approvals for admin workflows Make just-in-time approvals the default for remote administrative access, especially where vendors, contractors, or MSP operators connect into shared environments. Tie each approval to a specific host and business justification.

Key takeaways

• Replacing RD Gateway is fundamentally about changing the unit of control from network entry to governed session access.
• Per-session evidence, time-boxed approval, and credential injection are the controls that make remote administration auditable.
• Teams that still treat RDP as a connectivity problem will miss the real issue, which is privileged access scope and proof.

Key terms

• Task-scoped Authorization: Task-scoped authorization limits an AI agent’s access to the specific data, tools, and actions needed for one bounded objective. It is a stronger fit than static role assignment when the system’s behaviour can change during execution and when overreach creates immediate business risk.
• Credential Injection: Credential injection is the controlled replacement of one credential with another at execution time, usually before a request leaves the host or service boundary. It lets the workload operate with a harmless token or placeholder while the real secret remains protected by infrastructure.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Devolutions' full white paper covers the operational detail this post intentionally leaves for the source:

• Step-by-step deployment guidance for Devolutions Gateway, Devolutions Server, and Remote Desktop Manager in a live environment
• Configuration detail for MFA enforcement, JIT approvals, and credential injection across RDP workflows
• Per-session logging and optional recording options for audit and investigation workflows
• Implementation notes for SMBs, MSPs, and regulated environments that need faster access without broad exposure

👉 Devolutions' full white paper includes the deployment path, policy flow, and audit logging detail behind the architecture.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.