--- title: "How to Access the VDI App" slug: "vdi-daas-authentication-methods" updated: 2026-06-01T15:00:00Z published: 2026-06-01T15:00:00Z canonical: "support.controlup.com/vdi-daas-authentication-methods" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.controlup.com/llms.txt > Use this file to discover all available pages before exploring further. # How to Access the VDI App Note for versions lower than 9.0 The login methods described in this article are relevant only for Real-Time DX version 9.0 or higher. If you are using a lower version, [read this article](/tim-reorg/docs/access-vdi-daas-web-ui-for-versions-lower-than-90) to learn how a user can sign in to the VDI App web interface. After you sign in to the DEX platform web application ([app.controlup.com](http://app.controlup.com)), click the **VDI** icon to access the VDI App. ![VDI app dashboard](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/VDIAppDash.png) If your ControlUp organization meets the [prerequisites](/v1/docs/vdi-daas-authentication-methods#prerequisites), and your ControlUp account has the [required permissions](/v1/docs/vdi-daas-authentication-methods#required-user-permissions), then you are automatically signed in to your VDI & DaaS environment. For MSPs or multi-tenant organizations, use the Tenant Manager to configure your account and enable access to the VDI App. See steps [here](/v1/docs/set-up-and-access-tenant-manager#vdi-web-login). Optionally, you can enable LDAP to sign in with an Active Directory user. [Read below for details](/v1/docs/vdi-daas-authentication-methods#optional-enable-ldap-and-sign-in-with-an-active-directory-user). ## Prerequisites - Real-Time DX Console 9.0 and higher. - ControlUp Monitors must be running. - Port 443 must be available from the ControlUp Monitors to communicate with the VDI App. - TCP ports required for connecting to the ControlUp Monitors: - RPC/WMI - for monitor deployment via the console. - 40706 - for monitor management. - If you use one of the following proxy authentication methods, these are supported: **Negotiate** proxy or **Basic** proxy. **NTLM**-based proxy authentication is **not** supported. ## Required user permissions The permissions granted to you in the Real-Time DX Console Security Policy are automatically applied to your account in the VDI App. ### Permissions in the DEX web interface Your ControlUp account must have at least one permission in the **Access VDI & DaaS** permission category: - **Access Overview page** lets a user view the **Overview** tab of the VDI App to view dashboards. - **Access Details page** lets a user view the **Details** tab of the VDI App to drill down into machines, sessions, folders, etc. ![DEX permissions](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/image-1777286105734.png) If you don't have at least one of the above permissions, then the **VDI** icon is grayed-out and unclickable. #### Security limitation with VDI App permissions While you can use permissions to block a user's access to either the Overview page or the Details page, these restrictions apply only to the UI. If a user has at least one of these permissions, then that user can access our backend API to view the raw data for both pages if they have the right technical knowledge. ### Permissions in the Real-Time Console Security Policy Your ControlUp account or your AD user (depending on whether you have [enabled LDAP authorization](/v1/docs/vdi-daas-authentication-methods#optional-enable-ldap-and-sign-in-with-an-active-directory-user)) must have one of the following permissions assigned in the Real-Time Console Security Policy: - **Use Web Application** to access the VDI App. - **Manage Web Application** access the VDI App and perform administrative actions. To grant these permissions: 1. In the Real-Time DX Console, click **Security Policy** on the bottom tab and identify a role with the relevant permission assigned. If none of your roles has the permission assigned, you can click **Not Set** and set the status to **Allow**. ![Use Web Application](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Use%20Web%20Application%281%29.png) 2. Click **Manage Roles**. ![Manage Roles button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Manage%20roles.png) 3. Select the role that has the relevant permission and click **Edit > Add Users/Groups**. ![Select the role and click Edit > Add users / groups](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AddRoleCUAdmin.png) 4. To add ControlUp accounts to the role: 1. Set **Provider** to **ControlUp**. ![Set provider to ControlUp](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Set%20provider%20to%20ControlUp.png) 2. Set **Search options** to **Users** to search for individual ControlUp accounts, or set **Search options** to **Groups** to search for SAML SSO groups. [Learn more about assigning roles with SSO groups](/v1/docs/assign-user-roles-with-idp-groups). 3. Select users or groups to add to the role and click **OK**. 5. To add Active Directory users to the role: 1. Set **Provider** to **Local AD** and search for either users or security groups.![Set provider to local ad] ![Set provider to local AD](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/VDI%20USER%20MANAGEMENT%20-%20HOW%20TO%20ACCESS%20-Set%20provider%20to%20local%20ad.png) 2. Select users or groups to add to the role and click **OK**. ## Optional: enable LDAP and sign in with an Active Directory user To sign in to VDI using LDAP, go to **Settings > User Settings > Login Methods** and enable **Sign-in to VDI with LDAP**. ![Enable VDI & DaaS LDAP permission](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/EnableVDILDAPperm.png) Tip You can set the VDI login method per-user by [overriding the default login methods](/tim-reorg/docs/login-methods-overview). For example, you might want your daily ControlUp users to use LDAP, but allow some special users to access your VDI environment without requiring an AD user. The sign-in procedure depends on whether you are using SAML: - If you sign in to DEX with OAuth or a username and password, then you must enter a UPN and password to access your VDI environment. If ControlUp detects multiple AD users connected to your UPN, you can select which user to use. Your selection is remembered the next time you sign in. - If you sign in to DEX with SAML, then the user attributes sent by your IdP (email address, UPN, sAMAccountName, distinguishedName) are used to identify an AD user for authorization against the Real-Time Console Security Policy. If either your ControlUp account or your AD user **has** the permission **Use Web Application** in your Real-Time DX Console Security Policy, then you are **allowed** access to your VDI environment. If either of those accounts is explicitly **denied** the permission **Use Web Application**, you are **not allowed** access to your VDI environment. After you have signed in, both accounts (your ControlUp account and your AD user) are used to determine if you are allowed to perform a particular action: - If either account has permission to perform the action, then you are allowed to perform the action. - If either account is explicitly **denied** permission to perform the action, then you are now allowed to perform the action.