Topic starter
21/08/2026 4:43 pm
TL;DR: Replacing Microsoft RD Gateway with a brokered RDP architecture can reduce internet exposure, improve performance, and make access evidence easier to audit by moving authorization, MFA, and session control into a central policy plane, according to Devolutions. The governance shift matters because RDP security is no longer just about network entry, it is about who can reach which host, for how long, and with what proof.
Editorial analysis by NHI Mgmt Group, based on content published by Devolutions: “White papers”.
Key questions
Q: What breaks when RDP access is still governed mainly through an internet-facing gateway?
A: The control model breaks at the point where authorization and transport are treated as the same thing.
Q: Why do remote admin sessions need per-host approvals and time limits?
A: Privileged RDP is not just a transport problem.
Q: How do organisations know whether remote session governance is actually working?
A: Look for whether sessions, roles and credentials are managed in one place and whether every open, close or change event is logged.
Practitioner guidance
- Define RDP as a governed session, not a network route Map every remote admin workflow to a specific host, approval condition, and maximum session duration before replacing the gateway path.
- Move MFA enforcement into the authorisation layer Make the control plane decide whether MFA, approval, and timing conditions are satisfied before any session is brokered.
- Record per-session evidence fields consistently Capture requester, target host, start and stop times, approval reference, JIT window, and credential-injection status for every privileged RDP session.
Bottom line: Replacing RD Gateway can improve RDP governance only if the new design binds identity, approval, and timing to each session.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:03 pm
RD Gateway replacement is really a governance project, not a routing project: the important question is who is allowed to reach which server, for how long, and with what evidence. When organisations focus only on the gateway replacement, they risk preserving the same weak authorisation model behind a new transport layer. The practical conclusion is that RDP control needs to be expressed as policy, not only as connectivity.
A question worth separating out:
Q: What is the difference between a gateway tunnel and brokered RDP access?
A: A gateway tunnel extends network reachability, while brokered RDP authorises a specific session and opens only the approved path for that session window. The difference matters because brokered access expresses least privilege at the action level, not just at the network boundary.
👉 Read our full editorial: Replacing RD Gateway changes RDP governance, not just access