> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/understand/workspace-types.md).

# Compare workspace types

Compare Devolutions CLI on Devolutions Cloud, Devolutions Server, and local profiles: sign-in, secret reads and writes, references, and admin commands.

Devolutions CLI uses the same commands for all three workspace types: Devolutions Cloud, Devolutions Server, and a local Devolutions Remote Desktop Manager profile. Most of what you do, like finding a reference or running a command with its secrets, works the same everywhere. The differences are in how you sign in, which fields you can write, and a few administration commands that exist for one type only.

When a workspace can't do something, the command tells you which workspace type it needs instead of failing silently. See [A command says the workspace doesn't support it](/cli/help/troubleshooting/not-supported.md).

## At a glance

<table><thead><tr><th width="190"></th><th>DEVOLUTIONS CLOUD</th><th>DEVOLUTIONS SERVER</th><th>LOCAL PROFILE</th></tr></thead><tbody><tr><td><strong>Sign in with</strong></td><td>Browser (OAuth), or an application key and its secret</td><td>Browser (OAuth), an API key, a username and password, or Windows authentication (Windows only)</td><td>Nothing: the context points at a profile folder on your computer</td></tr><tr><td><strong>Read a secret</strong></td><td>Fields <code>username</code>, <code>password</code>, <code>domain</code>, <code>host</code>, <code>port</code>, <code>url</code>, <code>privatekey</code></td><td>Any data property of an entry, such as <code>password</code>, <code>username</code>, <code>domain</code>, or <code>host</code>, except privileged access (PAM) entries. Sections aren't supported.</td><td>Fields <code>username</code>, <code>password</code>, <code>domain</code>, <code>host</code>, <code>port</code>, <code>otp</code>, <code>privatekey</code></td></tr><tr><td><strong>Write a secret</strong> with <code>devo secret set</code></td><td>The <code>password</code> of an existing entry, except privileged access (PAM) entries</td><td>Any data property of an entry, except privileged access (PAM) entries</td><td>The <code>password</code> field only</td></tr><tr><td><strong>References</strong></td><td>Named (<code>devo://&#x3C;workspace>/&#x3C;vault>/&#x3C;entry>/&#x3C;field></code>) or canonical (IDs)</td><td>Canonical, as listed by <code>devo entry references</code>. A named reference you write yourself also works.</td><td>Named or canonical</td></tr><tr><td><strong>Network</strong></td><td>Your Devolutions Cloud address, and Devolutions Account for browser sign-in</td><td>Your Devolutions Server address</td><td>No address of its own</td></tr></tbody></table>

To see this from the command line, run `devo secret capabilities`. It describes what each workspace type can read and write, and works without signing in.

```bash
devo secret capabilities --output json
```

## What this means for you

**On Devolutions Cloud, sign in with the browser or an application key.** A sign-in with `--use-device-code` doesn't receive the key that opens your vault data, so you can only check its status and sign out. See [Sign in to Devolutions Cloud](/cli/guides/connect/devolutions-cloud.md).

**On Devolutions Server, copy canonical references.** `devo entry references` lists only canonical references for its entries. See [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md).

**A canonical reference always goes to its own workspace.** A canonical reference to a Devolutions Cloud or Devolutions Server entry is resolved with the login that owns it, whatever context is current. A named reference, and `devo secret get`, use the selected workspace. See [Switch between workspaces](/cli/guides/connect/switch-workspaces.md).

**Every write asks for confirmation.** `devo secret set` refuses to change anything without `--yes`, on every workspace type. See [Update a secret from a script](/cli/guides/secrets/update-a-secret.md).

**Protected local profiles work, within limits.** For a local profile, a protected password is read or written with the workspace passphrase, from a file or an environment variable. See [Use a local Devolutions Remote Desktop Manager profile](/cli/guides/connect/local-profile.md).

## Administration commands for one workspace type

Many `devo admin` commands work with one workspace type only. Here are some examples:

<table><thead><tr><th width="230">WORKSPACE TYPE</th><th>COMMANDS</th></tr></thead><tbody><tr><td><strong>Devolutions Cloud only</strong></td><td><ul><li><code>devo admin invitation</code>: user invitations</li><li><code>devo admin owner</code>: the organization owner</li><li><code>devo admin access system</code> and <code>devo admin access system-vault</code>: system permissions and system vault roles</li><li><code>devo admin settings get</code> and <code>devo admin settings update</code>: system settings</li><li><code>devo admin gateway list</code>, <code>get</code>, <code>delete</code>, and <code>devo admin gateway settings</code></li><li><code>devo admin logs siem</code> and <code>devo admin logs archived</code></li></ul></td></tr><tr><td><strong>Devolutions Server only</strong></td><td><ul><li><code>devo admin pam</code>: privileged access accounts and providers</li><li><code>devo admin domain</code>: Active Directory domains and their users</li><li><code>devo admin cache reset</code></li><li><code>devo admin settings auth-modes</code> and <code>devo admin settings two-factor</code></li><li><code>devo admin user 2fa</code>: a user's two-factor method</li><li><code>devo admin license users list</code> and <code>devo admin license trial start</code></li><li><code>devo admin gateway revocation-list publish</code></li></ul></td></tr></tbody></table>

This list isn't complete. For every command, the workspace types it supports and its options, see [Commands](/cli/reference/commands.md). Outside `devo admin`, `devo info` shows instance information for Devolutions Cloud and Devolutions Server only.

## Next

* [Connect to your workspaces](/cli/guides/connect.md)
* [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/understand/workspace-types.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.