> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/troubleshooting-articles/device-sign-in-confirmation-when-signing-in-to-devolutions-server.md). # Device sign-in confirmation when signing in to Devolutions Server Explains the "Yes, it's me" confirmation page shown when signing in to Devolutions Server, and how to stop it from appearing at every startup. When signing in to a Devolutions Server workspace from Remote Desktop Manager, the Devolutions Server sign-in page can display a confirmation step before the sign-in completes. The page is titled ***Are you signing in to 'Remote Desktop Manager'?*** and displays the following message: ``` A new device is waiting to be signed in to your account. ``` The page also shows the account being signed in and a warning: "If you didn’t start this, select Cancel. Someone else may be trying to access your account." * ***Yes, it’s me***: Completes the sign-in on the device. * ***Cancel***: Refuses the sign-in. The application that started it does not get access to the account, and the browser returns to the Devolutions Server sign-in page. * ***Change***: Displayed next to the account name. Closes the current session and returns to the sign-in page to sign in with a different account. The same confirmation applies to the other Devolutions applications that sign in to Devolutions Server through the browser, such as Devolutions Launcher, Devolutions Password Manager, and the Devolutions.PowerShell module. The title then names that application, or reads ***Are you signing in on a new device?*** when the application is not identified. ## Why this confirmation is displayed Devolutions Server asks for this confirmation to protect accounts against the phishing attack described in the [DEVO-2026-0035 security advisory](https://devolutions.net/security/advisories/DEVO-2026-0035/). Without the confirmation, an attacker can send a device sign-in link to a user who is already signed in to Devolutions Server in their browser. If the user opens the link, the attacker's device is signed in to the user's account without any action from the user. The confirmation step cannot be turned off, and Devolutions Server has no option to remember a device. Remembering a device would make the attack possible again. ## When the confirmation is displayed Devolutions Server displays the confirmation page when the sign-in would otherwise complete without any action from the user: * The user is signed in with Windows authentication (domain single sign-on) and no multifactor authentication is requested. * The user signs in with an external identity provider, such as Microsoft Entra ID. The confirmation is displayed even when the identity provider asks for a password or for multifactor authentication. * The browser already has a Devolutions Server session from an earlier sign-in. The confirmation page is not displayed when the user enters a password, an emergency code, or a multifactor authentication code on the Devolutions Server sign-in page for this sign-in. This includes a domain single sign-on followed by multifactor authentication. {% hint style="info" %} If Remote Desktop Manager displays a Windows credentials prompt instead of signing in silently with domain single sign-on, see [Credentials prompt instead of domain single sign-on](/server/knowledge-base/troubleshooting-articles/credentials-prompt-instead-of-domain-single-sign-on.md). {% endhint %} The sign-in itself only happens when Remote Desktop Manager has to authenticate again with Devolutions Server. When Remote Desktop Manager starts, it first tries to restore the session with the refresh token saved on the device. A new sign-in, and the confirmation page, is required when: * The user signs in for the first time on the device. * The refresh token has expired. The duration is set by the ***Refresh token lifetime*** option in the [advanced server settings](/server/web-interface/administration/configuration/server-settings/general/advanced.md). * No refresh token is saved on the device, or Devolutions Server refuses it. ## Solution The confirmation is expected once per sign-in. If it is displayed every time Remote Desktop Manager starts, apply the following checks in order. Stop when the confirmation is no longer displayed at startup. ### Clear "Always ask for username" on the workspace When the ***Always ask for username*** option is enabled on the Devolutions Server workspace, Remote Desktop Manager does not save the refresh token. Every startup then requires a new sign-in and a new confirmation. 1. In Remote Desktop Manager, go to ***File*** – ***Workspaces***. 2. Select the Devolutions Server workspace, then select ***Edit workspace***. 3. In the ***General*** tab, clear the ***Always ask for username*** checkbox. 4. Enter the username in the ***Username*** field. 5. Select ***OK***. 6. Sign in to the workspace once, then restart Remote Desktop Manager. The ***Always ask for username*** checkbox is not available when ***Use domain single sign-on (SSO)*** is selected, because the workspace then uses the Windows account. ### Check the refresh token lifetime A short ***Refresh token lifetime*** value makes the refresh token expire sooner, which requires a new sign-in and a new confirmation. Check the value in ***Administration*** – ***Server settings*** – ***Advanced*** in the Devolutions Server web interface. ### Collect a debug log If the confirmation is still displayed at every startup, collect a debug log to find out why the session is not restored. 1. In Remote Desktop Manager, go to ***File*** – ***Settings*** – ***Advanced***. 2. Next to ***Debug level***, select the browse button. 3. Select ***Debug*** and ***API***. 4. Select ***Save***. 5. Restart Remote Desktop Manager. 6. Sign in to the Devolutions Server workspace. 7. Close Remote Desktop Manager, then open it again within a few minutes. In the log, look at the lines written right after the restart: * ***Refresh Token provided. Try to restore session.*** followed by ***Session can't be restored. (Error=…)***: Remote Desktop Manager had a saved refresh token, but Devolutions Server refused it. * ***No refresh token provided or provided one is invalid.*** without a ***Try to restore session*** line before it: Remote Desktop Manager did not have a saved refresh token. * ***Session restored.***: Remote Desktop Manager restored the session without a new sign-in. Send the log to [Devolutions support](https://devolutions.net/support/) with the error text. Clear the ***Debug*** and ***API*** debug levels afterwards. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/server/knowledge-base/troubleshooting-articles/device-sign-in-confirmation-when-signing-in-to-devolutions-server.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.