Frequently Asked Questions

Do I need to install anything on the VM instance before I can connect?

IAP Desktop does not require any special configuration on VM instances other than that Remote Desktop is enabled. All VM instances created using the Google public images have Remote Desktop enabled by default.

Which roles do I need to use IAP Desktop?

To use IAP Desktop, you need the Project Owner role or a combination of the following roles:

• Compute Instance Admin or Compute Admin to list and access VM instances
• IAP-secured Tunnel User to use IAP TCP forwarding

To generate Windows credentials, you also need:

• Service Account User

Roles can be grated on a per-project or per-VM instance level.

Why am I missing some instances in Project Explorer?

Project Explorer only shows instances that are known to run Windows. Filtering is performed based on license and guest OS features metadata of the VM instance's disks.

Can I use IAP Desktop with Remote Desktop Gateway?

Currently not, but this feature might be added soon.

Can I use IAP Desktop to access machines outside Google Cloud?

IAP Desktop heavily relies on Google Cloud APIs. Therefore, it is not possible to use IAP Desktop to access machines that are deployed elsewhere.

Why do I need admin rights to install IAP Desktop on Windows Server?

On Windows Server, the default group policy is configured to disallow per-user installations of MSI packages.

To install IAP Desktop on Windows Server, open an elevated command prompt, enter the path to the MSI file, and hit Enter.