18.7. Grant and Audit Remote Support Sessions on a Self-Hosted Appliance

For a self-hosted appliance, remote support is a trust decision before it is a technical connection. The MSP or security-conscious client needs to know that vendor access cannot begin without authorization and that the resulting evidence can be reviewed afterward.

Remote appliance support is fail-closed by design. Without explicit authorization, remote access does not happen. Authorized sessions are authenticated, session recordings are integrity-verified, and acknowledgements are durable.

Open the appliance console and select Manage > Support. Remote support is available only to connected Pro or Premium appliances that have an approved support-agent image and can reach the central service.

Understand the guarantees

The remote support design provides four specific guarantees. Use them when assessing a support request or explaining the control to a client.

These guarantees do not define every part of an MSP's approval process. Your organization still decides who may authorize support, what incident or maintenance request justifies it, and how the evidence is retained with internal records.

For the appliance architecture and ownership model, see 18.1. Self-Hosting AlgaPSA: The On-Premise Appliance.

Decide whether to authorize a session

The appliance owner controls whether explicit authorization is granted. A support request by itself is not authorization, and the fail-closed design means declining or withholding authorization leaves remote access unavailable.

Before granting a session, establish the business context outside the connection itself:

1. Confirm that there is an open support or maintenance need.
2. Verify the request through the MSP's approved support channel.
3. Identify the person within the MSP or client organization who is permitted to authorize vendor access.
4. Agree on the intended work and the systems or symptoms involved.
5. Decide how the authorization and recording will be associated with the incident or change record.
6. Grant authorization only after those checks are complete.

The appliance provides a defined support window of 1 hour, 4 hours, or 8 hours. Choose the shortest window that covers the approved work, and do not infer an unlisted scope selector, approval chain, or automatic revocation behavior.

Keep authorization accountable

The local approval action and the recording evidence serve different purposes. Confirm root access expresses the appliance owner's explicit decision to allow support, while durable recording acknowledgements ensure finalized recording metadata continues to be sent until the central service returns a matching signed receipt that is stored locally.

The signed recording receipt does not determine whether the authorizer had the correct business authority. Keep the appliance record aligned with the MSP's own access policy and change-control process.

Tenant roles and general security configuration are described in 10.17. Configure Roles, Permissions (RBAC), and API Keys for Your MSP. Apply the same principle of least privilege when deciding who may approve an appliance support session.

Grant access through the appliance controls

Use Manage > Support in the appliance console to provide explicit authorization for the support event. Make sure the person taking the action is the approved authorizer for the current request.

The expected control flow is:

1. Open the appliance management console from a trusted administrative workstation.
2. Select Manage > Support.
3. Match the request to the open support, incident, or maintenance record.
4. Under Support window, select 1 hour, 4 hours, or 8 hours.
5. Select Enable support mode, then complete Confirm root access.
6. Wait for central approval and for both the relay and recorder to become ready. If any of these checks fails, the session does not become ready.
7. Give the single-use share code only to the verified remote operator through the approved support channel.
8. Keep the operational record available for notes and post-session review.

The appliance console authenticates management requests with its session cookie. Write operations also require same-origin requests, and local support provisioning cannot proceed unless the central service approves it.

The setup console is separate from the main AlgaPSA application. For how the console is first reached and secured during provisioning, see 18.2. Install the AlgaPSA Appliance Operating System and 18.3. Configure the Appliance with the Setup Wizard.

Review the session recording

Remote support sessions are recorded, and recording integrity is verified with SHA-256 segment digests and centrally signed receipts. In Manage > Support, completed recordings appear under Closed recordings with Review recording, Download, and Delete actions.

After the session:

1. Open Manage > Support, then find the session under Closed recordings.
2. Associate it with the support case, incident, or maintenance record used for approval.
3. Verify its integrity before relying on it as review evidence.
4. Compare the recording with the requested work and the support outcome.
5. Record any follow-up action, including configuration review or credential rotation required by the incident.
6. Retain or dispose of the evidence according to the MSP's policy and client obligations.

Finalized checkpoint and final recording metadata are resent on every authenticated connection until the appliance receives and stores a matching receipt. Sending the metadata over a socket is not an acknowledgement by itself. An integrity-verified recording supports confidence that the captured record was not altered; it does not define retention duration, prove that every surrounding event was captured, or replace logs from the operating system and application.

Explain the control to a security-conscious client

When a client asks whether vendor support can enter its self-hosted PSA at will, the direct answer is no: the design fails closed, so explicit authorization must be present before remote access occurs.

Use the four guarantees without extending them beyond the release:

• The appliance owner makes an explicit authorization decision.
• The management console requires a valid session cookie, and writes require same-origin requests.
• Central approval, relay readiness, and recorder readiness are all required before the session becomes ready.
• The remote operator uses a single-use share code.
• The session recording uses SHA-256 segment digests and centrally signed receipts.
• Finalized recording metadata is resent until its matching receipt is received and stored.

Then describe the MSP's own process: who approves, how a request is verified, where the support case is recorded, and how the recording is reviewed. Keeping platform guarantees separate from organizational procedure makes a security questionnaire easier to answer accurately.

Include remote support in appliance governance

Remote support should sit alongside the other controls used to operate a self-hosted appliance.

The appliance license and registration workflow is documented in 18.6. The Licensing Portal: Upgrades, Seats, and Keys. Keep its registered administrative contacts current so licensing and appliance ownership records support the same governance model.

Explicit authorization is the boundary. When authorization, central approval, relay readiness, or recorder readiness is absent, access remains closed. When a session proceeds, authenticated controls, durable recording receipts, and an integrity-verified recording provide evidence for the review that follows.