A Splashtop account can open interactive sessions on every computer where its streamer is installed, so the accounts that sign in to it carry privileged access to your estate and need the same protection as any administrative remote access path. This guide covers the customer-side controls Splashtop documents for its Business, Remote Support and Enterprise offerings: SSO and SCIM, two-step verification and device authentication, the role model from Owner to Member, Granular Control over features such as file transfer and remote command, session timeouts, local and cloud session recording, and the Logs tab. It is written for IT administrators, service desk leads and security teams who own a Splashtop team. For the wider discipline of governing remote management tools, see the RMM Tool Security Guide; this page stays specific to Splashtop configuration.
This is an independent guide from NHI Mgmt Group, based on Splashtop's public documentation as of November 2026. It is not sponsored or reviewed by Splashtop. Product features change, so confirm settings against Splashtop's current documentation.
Key takeaways
- Require two-step verification for everyone. Owners can require authenticator-app verification for all admins, all members or both from Management > Settings.
- Use SSO and SCIM on Enterprise. SSO and a SCIM provisioning token tie Splashtop accounts to your identity provider; protect the Owner account separately, because it signs in outside SSO.
- Split the role model. There is one Owner; give day-to-day administration to Admins or Group Admins scoped to specific computer and user groups.
- Restrict risky features with Granular Control. File transfer, copy and paste, remote command and request permission to connect can be set per role, group and user.
- Record sessions and keep the evidence. Cloud Session Recording (Enterprise, off by default) keeps recordings for 90 days; export what you need before then and review the Logs tab.
How identity and access work in Splashtop
Splashtop users belong to a team managed in the web console at my.splashtop.com (or my.splashtop.eu). Technicians and staff sign in to the Splashtop Business app and connect to computers running the Splashtop Streamer, or to end users through SOS sessions. Access to each computer depends on the user's role, group membership and computer access permissions.
Authentication options
| Control | Where (Splashtop docs) | What it does | Recommended use (NHI Mgmt Group recommendation) |
|---|---|---|---|
| Two-step verification (2FA) | Management > Settings, Security | Six-digit code from an authenticator app such as Google Authenticator, Microsoft Authenticator or Duo Mobile; enforce for admins, members or both; 10 recovery codes at setup | Enforce for all users; store recovery codes in a vault |
| Device authentication | Team Settings, Security | Email approval for a new device or browser; sets who receives the requests; turns off automatically when 2FA is on | Interim control until 2FA is enforced |
| Single sign-on | Team Settings, Security, "Apply for new SSO method" (Enterprise) | Users sign in with identity provider credentials; one SSO method per account | Use for all users except the Owner |
| SCIM provisioning token | Team Settings, Security (Enterprise) | Provisions users and groups from the identity provider using a secret token | Use for joiners and leavers; vault the token |
| Browser and Application Timeout | Team Settings, Security | Signs users out of the web console after idle time: Never, 15 minutes, 1 hour, 8 hours or 24 hours; applies at next login | Our view: 15 minutes or 1 hour for admins |
SSO details to plan for
- Owner account: Splashtop documents that the team owner's account cannot sign in with SSO. Give it a long unique password in a vault, enforce 2FA, use it only for owner-only tasks, and alert on its use (our recommendation).
- Account changes: once linked to SSO, an account's email and password are managed by the identity provider rather than in Splashtop, and each account links to one SSO method.
- Client versions: SSO needs the Windows or Mac Splashtop Business app at version 3.3.8.0 or later, so update clients before enforcement.
- Trusted devices: users who tick "trust this device" skip the code on that device; review and remove trusted devices in Account Info when a device is lost or a user leaves.
Because every Splashtop account is a remote access identity, apply your identity provider's strongest policies to the Splashtop application, such as phishing-resistant MFA and device compliance. See the Remote Access Identity Guide and the Identity Provider and SSO Security Guide.
Admin roles and privileged access
| Role | Scope (Splashtop docs) | Least-privilege guidance (ours) |
|---|---|---|
| Owner | Everything, including inviting members, changing roles, resetting passwords, removing users, connection history, seats and payment; only one per team; only the Owner changes roles | A dedicated, vaulted account used rarely; not a person's daily login |
| Super Admin | Owner privileges for user management and team settings, except payments; can configure any member except the Owner | One or two named people |
| Admin | Owner permissions except payments, renaming the team and changing roles; no Team Settings tab | Service desk leads; sees all devices and session history |
| Group Admin | Admin rights limited to assigned user or computer groups | Preferred for regional or departmental IT |
| Member | Connects to assigned computers; sees own computers and history | Default for everyone else |
Owners and Admins can see all device information and session history, while Group Admins see only their groups and Members see only their own. Use computer groups to separate servers, finance systems and general desktops, and assign Group Admins per group so a single compromised technician account reaches fewer machines. Review role assignments and group membership every quarter (our cadence). See the Privileged Session Management Guide.
Granular Control
On Splashtop Enterprise, the Owner sets default feature permissions per role (Admin, Group Admin, Member); groups can override the role defaults and individual users can override their group. Feature Configuration toggles in Team Settings apply to the whole team, including owners and admins.
| Feature (Splashtop docs) | Risk it manages | Suggested default (ours) |
|---|---|---|
| File Transfer | Moving data or tools on and off endpoints | Off for Members; on for named support groups |
| Copy and Paste | Data leaving sensitive systems | Off for groups that reach regulated systems |
| Remote Printing | Printed copies of sensitive data | Off unless required |
| Remote Command | Running commands on endpoints | Admins and named engineers only |
| Request Permission to Connect | Sessions opened without the end user's knowledge | On for staff desktops; off only for unattended servers |
| Session Recording | Evidence of what happened in a session | On for all technician groups |
| Watermark Protection | Screen capture of sensitive content | On for groups that view regulated data |
| 2FA enforcement | Account takeover | On for every role |
Two other Team Settings help end users: the option to show the connected technician's username on the remote computer, and Session Security, which controls whether users can save the OS login or security code for a device. Turn on the username display, and allow saved OS credentials only for low-risk groups (our recommendations).
Integrations, API tokens and service accounts
Splashtop's non-human credentials are few but powerful, and each needs an owner and a storage location.
- SCIM provisioning token: a secret configured in your identity provider that creates and removes users and groups. Store it only in the identity provider and your vault, and rotate it when identity administrators change (our recommendation). See the SCIM Provisioning Guide.
- Third-party integration API keys: on Enterprise and SOS+, Team Settings holds API keys for service desk platforms such as ServiceNow, Zendesk, Freshservice, Freshdesk and Jira so technicians can start sessions from tickets. Use a dedicated integration account on the service desk side with only the permissions the integration needs, and record who created each key.
- Streamer deployment: deployment packages add computers to your team. Treat them as credentials: keep them in your software distribution tool, not on shared drives, and remove offline computers you no longer manage from the Computers tab.
- Saved security codes: computers protected with a security code or OS login prompt add a second check at connection time; keep codes unique and out of ticket notes.
See the Secrets Management Guide and the Remote access and PAM vendors as tier-zero suppliers guide for how to classify remote access platforms in your supplier risk model.
Logging and detection
The web console's Logs tab shows session history and account activity. Owners and Admins see all session history; Group Admins see their groups. Export logs regularly into your SIEM or records store according to your retention policy.
Session recording
| Option | How it works (Splashtop docs) | Choose it when |
|---|---|---|
| Local recording | Saved on the technician's computer; admins can set team recording policies per OS (storage path, size limit 0 to 40,000 MB, automatic recording) since app version 3.4.2.0; Windows recordings in .webm, Mac in .MP4; audio not saved on Windows or Mac | Plans without cloud recording; recordings kept under your own storage controls |
| Cloud Session Recording | Enterprise only, off by default; enabled under Management > Settings > Attended/Unattended Access; stored on Splashtop servers for 90 days; playback Owner only by default, or Admins and Owner, or all members; shared links rotate after 10 minutes; streamer and SOS 3.5.8.0 or later | You want recordings out of technicians' reach and centrally reviewable |
With local recording, point the storage path at a protected location technicians cannot edit, because files sit on their own machines. With cloud recording, keep playback at "Admins and Owner" and download recordings you need for investigations before the 90-day window ends (our recommendations). Also set Endpoint Security alert recipients so antivirus threat alerts from managed endpoints reach the security team.
| Signal | Why it matters |
|---|---|
| Owner account sign-in | The Owner signs in outside SSO and holds every permission |
| Role changes and new Super Admins or Admins | Privilege growth |
| 2FA enforcement, SSO or timeout settings changed | Changes the front door for all users |
| Sessions outside working hours or to unusual computer groups | Possible misuse of a technician account |
| File transfer in sessions to sensitive groups | Possible data movement |
| New computers joining the team | Unexpected streamer deployments |
Watch for Splashtop sessions you did not expect in your endpoint telemetry too; the Unauthorised Remote Monitoring and Management Tool Playbook covers how to respond.
Metrics that show it is working:
- Share of users with 2FA or SSO (target 100%).
- Number of Super Admins and Admins (trend down).
- Share of technician sessions recorded.
- Members with file transfer or remote command enabled (trend down).
- Days between a leaver's last day and Splashtop account disablement.
- Offline or unknown computers in the team, reviewed monthly.
Hardening baseline
A phased rollout. Most settings revert by changing the same toggle; announce changes such as 2FA enforcement first, because users are prompted at next login.
- Inventory: list users by role, groups, computers, integration API keys and current Team Settings.
- Protect the Owner: dedicated account, vaulted password, 2FA, recovery codes in a vault.
- Enforce 2FA for admins first, then members.
- Configure SSO and SCIM (Enterprise) after updating clients, with a pilot group.
- Split roles: reduce Super Admins and Admins; create computer groups and Group Admins.
- Set Granular Control: file transfer, copy and paste, remote command off by default; request permission on for desktops.
- Set timeouts: Browser and Application Timeout at 15 minutes or 1 hour (our view).
- Turn on recording: Cloud Session Recording with restricted playback, or a team local recording policy.
- Review integrations: owner and least privilege for each service desk API key; vault the SCIM token.
- Schedule reviews: quarterly roles and permissions, monthly computers and log export (our cadences).
| Organisation profile | Priority choices |
|---|---|
| Small IT team | 2FA for all, protected Owner, few Admins, local recording policy, short timeout |
| Service desk with remote support | Group Admins, request permission to connect, file transfer limited to named groups, service desk integration with least privilege |
| Enterprise | SSO plus SCIM, Granular Control, Cloud Session Recording, SIEM export, quarterly access reviews |
Common misconfigurations
- Owner used as a daily account: it sits outside SSO with every permission. Keep it dedicated and monitored.
- 2FA optional: enforce it for both admins and members.
- Everyone an Admin: Admins see every device and session. Use Group Admins.
- File transfer and remote command open to all: restrict with Granular Control.
- Recordings left on technician laptops: use cloud recording or a protected storage path.
- Timeout set to Never: pick a short idle timeout.
Keep Splashtop apps and streamers updated to the versions Splashtop supports and apply vendor security updates promptly.
Framework mapping
| Splashtop control | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK technique it helps address |
|---|---|---|---|
| 2FA, SSO, device authentication | IA-2, AC-17 | PR.AA-03 | T1078.004 Cloud Accounts |
| Roles, Group Admins, SCIM | AC-2, AC-6 | PR.AA-05 | T1098 Account Manipulation |
| Granular Control, request permission | AC-17, CM-7 | PR.AA-05 | T1219 Remote Access Tools |
| Idle timeout | AC-12 | PR.AA-03 | T1078.004 Cloud Accounts |
| Session recording and Logs tab | AU-6 | DE.CM-03, PR.PS-04 | T1219 Remote Access Tools |
Practitioner checklist
- Owner account dedicated, vaulted, protected by 2FA and monitored.
- 2FA enforced for admins and members; recovery codes stored safely.
- SSO and SCIM configured on Enterprise; clients at the required versions.
- Super Admin and Admin roles held by named people; Group Admins scoped to computer groups.
- Granular Control restricting file transfer, copy and paste, and remote command.
- Request permission to connect on for staff desktops.
- Browser and Application Timeout set short.
- Session recording on, with restricted playback and exports before the retention window ends.
- Service desk API keys and SCIM token owned and vaulted.
- Logs exported to the SIEM and reviewed for owner sign-ins and role changes.
Standards and references
- Splashtop: Splashtop Enterprise Team Settings
- Splashtop: How do I set up two-step verification (2FA)?
- Splashtop: Can I use SSO? Are there any limitations?
- Splashtop: Splashtop Enterprise User Role breakdown
- Splashtop: Granular Control
- Splashtop: Cloud Session Recording
- Splashtop: Session Recording
- Splashtop: What can I do in the Splashtop web console?
Related NHI Mgmt Group resources: RMM Tool Security Guide, Remote Access Identity Guide, MITRE ATT&CK T1219 Remote Access Tools, Privileged Session Management Guide.