RMM Admin

Login

Email Password

Two-factor authentication

Enter the 6-digit code from your authenticator app or a recovery code.

Code

Operations

Platform

Admin

Operational dashboard

Account settings

Profile

Change password

Current password New password (min 12) Confirm new

Multi-factor authentication (MFA)

—

Scan this QR with your authenticator app:

Manual secret:

Save recovery codes now — shown once:

Confirm TOTP code

Sessions

Active sessions for your account. Revoke any session you do not recognize.

Users

Create user

Email Name Password Role Tenant

Edit user

Email Name Role Tenant Active Force password change on next login

Tenants

Create tenant

Name Slug Plan Max agents

Edit tenant

Name Slug Plan Max agents Enabled

Enrollment tokens

Create a token, then use the Linux or Windows PowerShell install block. Same token and backend enroll API for both platforms.

Name Tenant Max uses Expires (hours)

Devices

Status

Type

Health

Agent

Security score

Tenant

Show retired

Page size

Create job

Device Type

Jobs

Status Type Device Search Page size

Alerts

Status Severity

Incidents

Create incident

Title Description Severity Source Device (optional)

Status Severity Source Search Page size

Maintenance runs

Windows maintenance history persisted from agent job results. Execution is agent-side only (allowlisted scripts).

Status Script Device Search Page size

Backup sites

Destinos primarios de backup (UrBackup en VM/NAS/MSP). El tenant elige un site por defecto; cada dispositivo puede override. Restore de fichero/carpeta = motor del site (UrBackup). IPFS queda reservado como archive cifrado por zona.

Default site for this tenant

Site

Create tenant site

Name Slug Kind Zone Residency Reachability Server host Port Server UI URL Server identity Internet auth key Windows package URL Linux package URL Notes

Device backup policies

Agent Restic backup policies per device/fleet — not the RMM stack backup (scripts/backup.sh for PostgreSQL/config). Restic execution not active yet.

Create policy

Name Repository ref (logical, no secrets) Type Schedule cron Include paths (one per line) Exclude paths (one per line)

Dry run (contract validation)

Creates a backup_run_dry or backup_preflight job. Agent may reject until backup execution is implemented.

Device Policy

Fleet action

Type Target scope Device group Target roles (comma) Batch size Lines IP Reboot after upgrade + autoremove Dry run

Fleet actions

Create policy

Name Template Trigger Cooldown (s) Conditions JSON Actions JSON

Policies

Suppressions

Name Category

Maintenance

Name Hours

Approvals

Scheduled jobs

Name Type Cron

Approvals

Pending actions requiring human approval. MFA required when enabled.

Release rollouts

Channel Target version

Software management

Device groups

Manual static groups and optional dynamic filter rules. Used by fleet policy assignments.

Name Description Type Initial devices Filter rules JSON (dynamic only)

Fleet policies

Unified operational policies. Priority: device > group > tenant. Scheduler uses frequency_hours (opt-in via RMM_FLEET_SCHEDULER_ENABLED).

Effective policies (debug)

Device

Maintenance policies

Name Job type Script Pack Frequency (hours)

Policy assignments (maintenance / compliance)

Kind Policy ID Target type Target ID

Backup policy assignments

Backup policy ID Target type Target ID

Remediation rules

Fixed conditions/actions only. Rules created disabled. Enable globally with RMM_AUTO_REMEDIATION_ENABLED=true.

Name Condition Action Action config JSON

Compliance profiles (seeded)

Compliance

PASS / WARNING / FAIL from inventory — Security, Monitoring, Health (temps), Backup, Software. Optional notify-only findings (e.g. lm-sensors) do not fail the device.

Account MFA is configured under Settings.

API Tokens

Tokens for external integrations. Not used for agent enrollment.

API tokens are different from Enrollment Tokens (see Enrollment tab).

Name

Scopes

Threat indicators

SIEM export

Policy executions

Monitoring profiles

RMM governs exporters and log agents — it does not replace Prometheus or Loki.

Assign profile to devices

Profile ID Device IDs (comma-separated)

Device compliance

Update monitor collector IP (fleet)

Adds new IPs alongside old ones first. Remove old IPs after validating Prometheus scrape.

Profile ID Old IPs New IPs Device IDs (optional)

Create webhook

URL Secret

Event types

Login

Two-factor authentication

Operational dashboard

Account settings

Profile

Change password

Multi-factor authentication (MFA)

Sessions

Users Refresh

Create user

Edit user

Tenants Refresh

Create tenant

Edit tenant

Enrollment tokens

Devices

Create job

Jobs

Alerts Refresh

Incidents

Create incident

Maintenance runs

Backup sites

Default site for this tenant

Create tenant site

Device backup policies

Create policy

Dry run (contract validation)

Fleet action

Fleet actions Refresh

Create policy

Policies Refresh Export alerts

Suppressions

Maintenance

Approvals Refresh

Scheduled jobs

Approvals

Release rollouts

Software management

Device groups

Fleet policies

Effective policies (debug)

Maintenance policies

Policy assignments (maintenance / compliance)

Backup policy assignments

Remediation rules

Compliance profiles (seeded)

Compliance

API Tokens

Threat indicators Refresh

SIEM export

Policy executions Refresh

Create webhook

Webhooks Refresh

Users

Tenants

Alerts

Fleet actions

Policies

Approvals

Threat indicators

Policy executions

Webhooks