StandalonePer computer
Configured on the computer in the Mideye Configuration window, or with a configuration file rolled out by your own tools. Good for a pilot, a handful of servers, or a site that will never see a manager.
Mideye Fleet · Early access
MFA for every Windows sign-in, managed from one place.
One installer puts Mideye on the Windows sign-in screen, at the console and over Remote Desktop. Mideye Fleet keeps every computer on the right policy over a mutually authenticated, outbound-only connection. Fleet never reaches in.
- Console and RDP
- Mideye Cloud or your own Mideye Server
- Standalone or Fleet-managed
The front door
A stolen password should not be enough.
Attackers often do not break in. They sign in with a stolen password, then hop from server to server over Remote Desktop, often from inside the network. A gateway only sees what passes through it. Mideye sits on the computer itself, so console and Remote Desktop sign-ins meet a second factor, including the ones that start next door. The user types the password as usual, answers Mideye, and is in.
Stops the password-only RDP hop
Remote Desktop between servers, admin sessions from inside and sign-ins at the keyboard all meet the same Mideye step. Network sign-ins, such as file shares, are not covered.
Same Mideye you already run
Uses your Mideye Authentication Service: Mideye Cloud or your Mideye Server. No AD schema changes.
No internet needed
With your own Mideye Server the computers need no internet access. Touch works when the server can reach Mideye Cloud; a fully isolated site signs in with token or authenticator codes the server checks itself.
One installer
One signed MSI on every computer. Standalone or Fleet.
Everything comes in one Windows installer: the Mideye tile on the sign-in screen and the services behind it. Roll it out the way you roll out everything else, then choose how each computer is run.
Fleet-managedCentral
The computer joins Mideye Fleet once. From then on its settings come from the policy of its group, and the local window shows them read-only. Change a policy, and every computer in the group follows.
1
Interactive
Run the MSI on a pilot computer and follow the wizard.
2
Silent
Unattended install for SCCM, Intune and scripted rollouts.
3
Group Policy
A startup script by GPO, with one shared configuration file for AD-joined computers.
Mideye Fleet
The computers ask. Fleet never knocks.
Mideye Fleet is where you look after all of it: your computers, your Mideye Servers and the rules between them. Each computer checks in on its own, picks up any change to its policy and tells Fleet how it is doing. Fleet never has to reach a computer, so nothing needs to be opened towards your computers.
Policies for groups
Sign-in methods, break-glass, schedules and approvers set once for a group of computers instead of on each one.
Status and events
See which computers are healthy, which need attention, and what happened at their sign-in screens.
Runs where you want it
Fleet runs in Docker on your own server, with a built-in SQLite database or your existing MariaDB, MySQL or SQL Server.
Who sees what
The password knows where it is allowed to go.
With Mideye Cloud, Windows checks the password on the computer and the password never leaves it. For a Touch the cloud gets the phone number and the text shown on the phone, which names the user and the computer. With your own Mideye Server, the password goes over HTTPS to that server inside your network, which checks the user against its directory before it asks for the second factor. Flip the switch and watch what travels.
Everyday sign-in
A tap on the phone, most days.
You choose the methods. By default Touch starts at once; a one-time code is there when the phone is not.
Touch and magic linkCloud + on-prem
The Mideye+ app rings and one tap approves the sign-in, or the user opens the link in an SMS. No code to phish.
Hardware tokensCloud + on-prem
One-time codes from Mideye hardware tokens and YubiKeys. Type the code from the display, or press the YubiKey and it types the code. With a Mideye Server the code is checked in your own network.
Authenticator appMideye Server
When you allow it, users enrol an authenticator app right at the sign-in screen. You decide what must approve it first, such as a Touch.
Assisted LoginCloud + on-prem
Four-eyes approval: the user asks, a colleague approves on their own phone, or, with a Mideye Server, reads out their code after the user has entered their own. See Assisted Login.
When the network is gone
The policy stays. The sign-in still works.
A Fleet-managed computer keeps the last policy it was given, protected on the computer. If Fleet goes quiet, nobody at the sign-in screen notices. And if the Mideye Server is out of reach too, the user can sign in with an offline code from the authenticator app. Offline codes work only on the computer the user enrolled on, and only if the feature is turned on.
Offline codes are off by default and need a Mideye Server. Touch and the magic link need the network.
Safe defaults
Fails closed, with a way back in.
Built to keep secrets away from non-admin eyes, mask personal data in the logs, and leave an administrator a way back in.
Recoverable
Mideye will not switch on without a break-glass account, and a documented recovery path gets an administrator back in if something goes wrong.
Secrets locked down
On the computer, API credentials are readable only by SYSTEM and Administrators. Exports mask them.
Personal data masked
Phone numbers and token serials are masked in the Windows event log. Break-glass sign-ins are recorded there too.
Documentation
Where to read next.
How it fits together
The endpoint, Fleet, Mideye Server and Mideye Cloud, and what each one talks to.
Read the overviewEndpoint requirements
Supported Windows versions and sign-in scenarios, and what the network and the directory must provide.
See the requirementsFleet requirements
The server, database and ports Mideye Fleet needs.
See the requirementsFAQ
Frequently asked questions.
How do I add MFA to Windows Remote Desktop (RDP)?
Install the Mideye endpoint MSI on every Windows computer where Remote Desktop sessions land, connect it to Mideye Cloud or to your Mideye Server, add a break-glass account and switch it on. Do it per computer, or once for a whole group with a Mideye Fleet policy. Console and Remote Desktop sign-ins are both protected by default, and Mideye will not switch on until a break-glass account is in place.
Do I need Mideye Fleet to use the Mideye endpoint?
No. The same MSI runs standalone, configured on the computer itself, or joined to Mideye Fleet. Fleet is for the day you have more computers than you want to configure by hand: you set policies for groups of computers, connect your Mideye Servers and watch sign-ins and status in one web interface.
Does Mideye Fleet connect to my computers?
No. Fleet only answers. Every conversation with a computer starts at the computer, so your Windows computers need no open inbound port for Fleet.
Does it work without internet?
Yes, with a Mideye Server. The computers need no internet of their own: they talk to your Mideye Server, your domain controllers and, if you use it, Mideye Fleet. Touch works when the server can reach Mideye Cloud; a site with no internet at all signs in with hardware-token or authenticator-app codes that the server checks itself. If the server is out of reach too, the computer keeps its last policy, and a user who enrolled an authenticator app on that computer can sign in with an offline code, if the feature is turned on.
What Windows versions are supported?
Windows 11 and Windows Server 2019, 2022 and 2025, x64 only. Windows 10 and Windows Server 2016 are not tested: verify on your own image before you roll out. Windows on ARM and 32-bit Windows are not supported. The tile works with Active Directory domain accounts and with local accounts.
Is Mideye Fleet generally available?
Mideye Fleet and the Mideye endpoint are in early access, published as preview releases ahead of the 1.0 release. Features can still change between versions. Contact us to join the early-access programme and we will plan the rollout with you.
Read the documentation.
Installation, certificates and ports, the policy reference, offline behaviour, diagnostics and the helpdesk handbook.