Devolutions expands PAM with device enrollment in December 2026

By Grace Kim

Devolutions expects to make device enrollment and centralized software management generally available in December 2026, while its existing privileged access management (PAM) package costs $650 per named user per year, billed annually. The company announced the endpoint features on November 9 as the first phase of its endpoint privilege management roadmap.

Devolutions said the new tools let administrators approve, install and update software without granting employees local administrator rights. The December capabilities will bring enrolled devices into the same workspace used for privileged access management, keeping connections, credentials and privileged workflows together.

“PAM has historically been built for large security teams with big budgets and months to spare, but that’s not how IT teams work,” said Devolutions CEO David Hervieux, in the announcement.

The company positions the platform for system administrators and smaller IT teams handling routine work.

What will administrators control after enrollment?

Devolutions plans to enroll devices from existing mobile device management systems. It specifically named Microsoft Intune as a system the functionality should complement, not replace. Organizations can keep their current device-management investments while adding enrollment and software approvals to the PAM workspace.

Devolutions says removing local administrator rights can reduce unnecessary access, but IT teams still need a practical way to install and update the software employees use. Under the company’s proposed workflow, an approved installation should not require permanent local administrator rights or leave an employee with broad authority to make unrelated changes afterward.

Devolutions also expects the centralized process to reduce the need for administrators to move between separate tools for access and routine endpoint maintenance.

Devolutions expects the December capabilities to extend the platform from controlling access to powerful accounts and sessions toward managing software on enrolled machines. The practical result is one shared workspace for connections, credentials, privileged workflows and approved software operations.

December extends PAM into routine software work without granting users standing local administrator rights.

How does UniGetUI fit into the enterprise release?

Devolutions built the software-management component on UniGetUI, its open-source interface for package managers. The current application handles software discovery, installation, updating and removal across:

• WinGet
• Chocolatey
• Scoop
• Pip
• Npm
• PowerShell Gallery

UniGetUI also supports bulk operations and exporting package lists for use on another machine. According to Devolutions, the common interface lets administrators manage software distributed through different package ecosystems.

Devolutions said the existing open-source product and the coming enterprise workflow are not the same thing. Its current features provide technical context; they do not establish that every package source, option or deployment pattern will be supported in the first centralized release.

The company also has not specified the complete supported device matrix or all enterprise package managers.

Buyers will need the December support matrix to judge how much of the current UniGetUI toolset reaches enterprises.

How do scoped roles reduce administrative reach?

Devolutions’ recent PAM enhancements separate platform administration from secret access. A Workspace administrator can manage users and platform settings without automatically seeing vault contents. A dedicated Auditor lets security and compliance staff inspect activity logs and session metadata without retrieving privileged credentials.

Devolutions said the split suits managed service providers working across customer environments and organizations that assign administration, credential use and compliance review to different people. A broad administrative title need not imply authority over every secret in the system.

The company also stores connection entries and PAM credentials in one vault. Its design keeps a privileged credential associated with the connection that uses it and applies one permissions structure across the workflow.

Administrators can run the platform and auditors can review activity without exposing every credential.

How do temporary checkouts work?

Devolutions integrates PAM workflows with Remote Desktop Manager and either a self-hosted or cloud workspace. Its website lists account discovery, step-up authentication, just-in-time elevation and session oversight as core parts of the approach.

Devolutions says users can request time-limited credential checkouts, with multi-factor authentication available. Reviewers can approve, deny or modify requests through the web interface, mobile application or Remote Desktop Manager. When a checkout ends, Devolutions rotates the password automatically and removes the just-in-time permissions.

Approved extensions allow work that outlasts the original access window. Reusable just-in-time accounts preserve the identity associated with mailboxes, licenses and history, while time limits and approval controls govern use.

Session recording, activity logs and predefined reports create evidence for later review. Devolutions said the controls cover approval before access, limits during use and credential or permission changes afterward. Their effectiveness depends on the policies an organization configures and the systems it puts in scope.

Each checkout follows a defined path from approval to timed use and cleanup.

What will buyers pay, and when can they see the features?

Devolutions plans to demonstrate device enrollment and centralized software management at Microsoft Ignite on November 17–20, ahead of the expected December 2026 general availability. The existing PAM module remains available now with a 14-day trial.

According to Devolutions, the PAM package costs $650 per named user per year, billed annually, with standard support included. Existing customers can add the module to their current workspace. For new customers, the package includes the workspace it runs in. Devolutions has not set a separate price for the forthcoming endpoint capabilities.

For buyers, the December release will test whether enrollment, software approvals and least-privilege controls can operate across their existing management systems. Devolutions still hasn’t disclosed endpoint pricing or the final device and package-manager matrix.