Ctrlk
linkedinx-twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Available RealmJoin Policies

Reference of available RealmJoin Client settings and policies configurable per user or group.

The following article shows you a list of possible RealmJoin Client settings/policies. These can be configured and assigned per user or group.

Each setting consists of a key and a value:

  • The key is a dot-separated path (for example Integration.Notification). RealmJoin merges the value into the client configuration at that path, on top of the tenant-wide defaults.

  • The value must be valid JSON — including plain values such as true or "release" (quoted, without brackets).

A value of undefined removes the key from the effective configuration. Use this to drop a value that a broader scope (tenant-wide client config or "RealmJoin - All Users") has set, instead of overwriting it with a different value.

The keys Allow.*, Restrict.* and SoftwarePackageOverrides.* are evaluated by the RealmJoin backend and are stripped from the configuration before it is sent to a device — they never reach the client.

Allow users to access RealmJoin LAPS for their devices

Users may access different LAPS types for devices owned by visiting the RealmJoin portal.

Key

Allow.SelfLAPS

Value

true | false

or per account type

{
  "EmergencyAccount": true,
  "SupportAccount": true,
  "PrivilegedAccount": true
}

See Local Admin Password Solution (LAPS) for the full self-service description.

Allow.* settings do not follow the usual "narrower scope wins" precedence. All values assigned to the user and to their groups are combined, and an explicit false always wins over any true.

Allow.* and Restrict.* are resolved against the user's Entra ID group memberships. Assigning them to the built-in "RealmJoin - All Users" group has no effect — use a real Entra ID group or assign them directly to the user.

Allow users to access Intune LAPS for their devices

Users may access and rotate the LAPS password for their devices.

Key

Allow.SelfLAPSIntune

Value

or specifically:

Starting with Portal v2026.29, access can be scoped per platform (Windows/macOS). A platform-specific property overrides the generic CanReadPassword/CanRotatePassword for the matching device platform:

A plain string value acts like true for the matching platform only:

Access is only granted to the device's primary user or registered owner. As with Allow.SelfLAPS, all assigned values are combined and an explicit false wins over any true.

Configure BranchCache for RJ packages

This setting changes BranchCache mode for new clients.

Key BranchCache.Mode

Value

Configure DomainConnect for Legacy Domains

The following settings configure DomainConnect for legacy domains.

Key DomainConnect.CredentialName

Value

Key DomainConnect.Domain

Value

Key DomainConnect.NetBIOS

Value

Configure RealmJoin release channel

This setting changes the user's / user group's channel with the next update of the RealmJoin Client.

Key Environment.Channel

Value

This setting is ignored on shared VDI clients — they always stay on the channel of their image.

Configure RealmJoin ESP

Change if the default reboot after initial RealmJoin agent installation.

Key

FirstRun.AfterSuccessAction

Value

Change if the RJ ESP is displayed.

If the deployment screen needs to be disabled for secondary users, the system variable $env:RjDisableSecondaryInitialDeployment = 1 has to be set before the first SU login.

Key

FirstRun.DisableDeploymentScreen

Value

Show deployment screen on restricted or secure desktop.

Key

FirstRun.EnableSecureDesktop

Value

Allow downgrade of packages

Allows downgrade of already installed applications via auto upgrade, if the version number is changed. Applies to all packages assigned to users receiving the policy via group or user settings.

Key

SoftwarePackaging.AutoUpgradeCanDowngrade

Value

Global override of software package behavior

These settings are primarily intended for Deployment/DEM users on shared devices. They are applied to all software packages assigned to the receiving user.

Forces the background installation flag on every package.

Key

SoftwarePackageOverrides.AllowBackgroundInstall

Value

Ignores the phase part of the main app / user part restrictions (Logon, Manual, Initial, Normal) of every package.

Key

SoftwarePackageOverrides.IgnorePhaseRestrictions

Value

Ignores the primary/secondary user part of those restrictions of every package.

Key

SoftwarePackageOverrides.IgnoreUserRestrictions

Value

IgnorePhaseRestrictions and IgnoreUserRestrictions only take effect when set to true; false is the same as not setting them at all. Restrictions can only be lifted this way, never added.

When the device's primary user is a deployment (DEM) user, these overrides also apply to the packages that secondary users inherit from that deployment user.

AnyDesk Feature

This setting enables or disables the AnyDesk feature.

Key Integration.AnyDesk

Value

  • Enabled: Turns the AnyDesk integration on or off.

  • BootstrapperUrl: Download location of the AnyDesk client used by the integration.

  • CustomClientSuffix: Suffix of your custom AnyDesk client. It is used to build the anydesk: link the RealmJoin Portal opens when starting a session. Leave it out when using the generic client.

  • Ui.TrayMenuTextEnglish: Caption of the entry in the RealmJoin tray menu. Defaults to "Start remote session".

ExecutionMonitor Feature

This setting enables or disables the ExecutionMonitor Feature.

Key Integration.ExecutionMonitor

Value

Notifier Feature

This setting enables or disables the Notifier feature and it also activates or deactivates the editor UI.

Key Integration.Notification

Value

  • Enabled: Turns the Notifier on or off.

  • SourceUrl: Location of the notification definitions. This value is created by RealmJoin when the feature is enabled for your tenant — do not change it.

  • FallbackCulture: Language used when a notification has no content for the user's language. Defaults to "en".

  • CheckInterval: How often the client checks for new notifications (HH:mm). Defaults to "00:01".

LocalAdminManagement Features

This section shows you all necessary settings for the LocalAdminManagement features. For more details about this feature read the Local Admin Password Solution article.

Key LocalAdminManagement.Inactive

Value

Key LocalAdminManagement.CheckInterval

Value

Key LocalAdminManagement.EmergencyAccount

Value

Key LocalAdminManagement.SupportAccount

Value

Key LocalAdminManagement.PrivilegedAccount

Value

All three account types share the same common properties (NamePattern, DisplayName, PasswordCharSet, PasswordLength, PasswordPreset, MaxStaleness). OnDemand and Expiration are specific to the support account, Expiration and PasswordRenewals to the privileged account. An account type that is not configured at all stays inactive. The LAPS article describes every property, the defaults and the password presets in detail.

AppCatalog Feature

This setting controls native, one-click access to the App Catalog from the RealmJoin tray menu and Windows Start Menu.

Key AppCatalog

Value

  • Enabled: Adds an App Catalog entry to the RealmJoin tray menu that opens the device's App Catalog page in Microsoft Edge app mode.

  • HidePackages: Hides the individual software packages from the classic tray "Install"/"Update" submenu, useful once users are directed to the App Catalog instead.

  • CreateStartMenuShortcut: Requires Enabled: true. Creates a per-user Start Menu shortcut ("App Catalog") that opens the same page, so it can be found via Start search or pinned to the taskbar.

  • Ui.DisplayName: Caption of the App Catalog entry in the RealmJoin tray menu. The same text is also used for the Start Menu shortcut created by CreateStartMenuShortcut. Defaults to "App Catalog".

Weblinks for RealmJoin Tray

The following setting generates a weblink in the tray.

Key WebLinks

Value

Access Restrictions

Currently only RealmJoin LAPS is supported. Access to Intune-managed Windows LAPS is controlled by the custom role permissions CanSeeDeviceIntuneManagedLapsStatus and CanRotateIntuneManagedDeviceLocalCredentials and is not affected by this setting.

Assign this setting to the groups of the device owners you want to protect. It then restricts which administrators may use LAPS on the devices of those users.

The setting can also be assigned to device groups. This needs the tenant feature Apply Restrict.LAPS from device groups. The feature is enabled for all tenants onboarded from Portal version 2026.40. For existing tenants, contact RealmJoin support to enable it. When enabled, the rules from the groups of the device owner and the groups of the device itself are merged.

Before enabling the feature for an existing tenant, check your device groups for existing Restrict.LAPS settings. Until now these settings had no effect. As soon as the feature is enabled, they apply and may remove LAPS access for some administrators.

Key Restrict.LAPS

Value

Each property holds the object IDs of Entra ID groups. One list exists per RealmJoin role:

The lists are inclusive: as soon as at least one list is filled, only administrators who hold the matching RealmJoin role and are a member of one of the groups listed for that role may use LAPS on these devices. Everyone else is denied.

Membership in a group listed under Deny always denies access, regardless of the other lists. Global admins are never restricted.

Each role is checked against its own list. An administrator only gets the LAPS access of the roles whose list contains one of their groups. For example, an administrator who is both Admin and Supporter, but is only a member of a group listed under Supporter, gets Supporter access on these devices, not Admin access.

Before Portal version 2026.40, being listed for any one role was enough to get the access of the administrator's highest role.

Custom roles with one of the LAPS permissions (CanUseDeviceLapsAsAdvancedSupporter, CanSeeDeviceLapsAsAuditor, CanUseDeviceLapsAsSupporter) are checked against the list of the matching role: AdvancedSupporter, Auditor or Supporter. See Who can access LAPS accounts.

Various Toggles

This section shows you four policies for RealmJoin.

Key Policies.DisableNetworkLocationWizard

Value

Key Policies.RequireSecurityFeatures.BitlockerEnabled

Value

Key Policies.SetCurrentUserAdministrator

Value

Key Policies.SetTimeserver

Value

Last updated

Was this helpful?