> For the complete documentation index, see [llms.txt](https://docs.parallels.com/landing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.parallels.com/landing/pd-ag/parallels-desktop-enterprise-quick-start-guide/end-to-end-implementation-stages-technical-workflow/stage-3-management-portal-and-remote-policy-setup.md).

# Stage 3: Management Portal & Remote Policy Setup

### What this stage accomplishes

Creates the Golden Image and Policy that actually govern what Stage 1's group receives and what they're allowed to do.

<figure><img src="https://728856974-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXQdk3Hlnt9SnyTi3UXIq%2Fuploads%2FIlteQxNRsW90VBUH8zoz%2FPDA-2035_Step-3.png?alt=media&amp;token=72ff934c-ee48-4743-a4a9-a301f897d715" alt=""><figcaption></figcaption></figure>

### Prerequisites

Stage 1 (group/sublicense) and Stage 2 (image, source choice, and/or provisioning package) done.

### Steps

1. **Create the Golden Image.** In the Management Portal's **Golden Images** page, click **Create Golden Image** and set **Deployment method**:
   * **Declarative** — choose **Windows Enterprise** or **Custom ISO**, set **Installation options**, and attach the provisioning package from Stage 2 if you built one.
   * **VM image** — enable the architecture(s) you need, provide the **Download URL** (Azure Storage picker or direct link) and the **SHA-256 checksum** from Stage 2.
2. **Create the Policy.** In **Policies**, click **Add** and work through: **General Information** (name it, and under **Policy applies to**, select your group), **Golden Image** (assign the one you just created), then **Security Controls** and **VM Settings**. The table below shows what each scenario recommends for these last two:

**Security Controls** and **VM Settings** — pick from the available options. The table below shows what each scenario recommends:

{% tabs %}
{% tab title="A: Engineers" %}
Security controls:

* Do not allow removing provisioned VMs

VM settings:

* Clipboard/Drag-and-drop: Bidirectional
* VM startup: Ready in background
* Show Developer Tools: enabled
  {% endtab %}

{% tab title="B: Enterprise" %}
Security controls:

* Limit users to provisioned VMs only
* Do not allow removing provisioned VMs
* Do not allow editing Parallels Desktop preferences

VM settings:

* Clipboard/Drag-and-drop: Bidirectional
* VM startup: Ready in background
* Do not allow external devices
  {% endtab %}

{% tab title="C: BYOD" %}
Security controls:

* Encrypt VMs and lock them to the company's license
* Limit users to provisioned VMs only
* Do not allow removing provisioned VMs

VM settings:

* Clipboard/Drag-and-drop: Disconnect (mandatory)
* Other VM isolation settings: optional, evaluate case-by-case
  {% endtab %}

{% tab title="D: App Delivery" %}
Not applicable (See [Scenario D](/landing/pd-ag/parallels-desktop-enterprise-quick-start-guide/scenario-based-quick-start-blueprints/scenario-d-app-delivery-app-centric-hidden-windows.md) for its Autodeploy Package configuration instead)
{% endtab %}

{% tab title="E: DevOps" %}
Security controls:

* Do not allow upgrading to the next major Parallels Desktop version
* Do not allow removing provisioned VMs

VM settings:

* Clipboard/Drag-and-drop: Disconnect
* Disable sharing Mac folders with VM
* Disable sharing VM apps with Mac
* VM startup: Ready in background
  {% endtab %}
  {% endtabs %}

Toggle **VM Settings** for the current Golden Image and, optionally, for **VMs from other sources**.

{% @arcade/embed url="<https://app.arcade.software/share/rYXxzcZErFufsHAcm6PH>" flowId="rYXxzcZErFufsHAcm6PH" %}

{% hint style="info" %}
**Note**: VM Settings configured here require client Parallels Desktop for Mac installations on 26.1 or newer.
{% endhint %}

### Verification

The Golden Image card shows the deployment method and source you expect. The policy doesn't show as `not applied`, and its **Policy applies to** list contains the intended group.

### Common issues

A group can only have one policy at a time — if it already has one, you'll need to edit that policy rather than create a second. The Golden Image's deployment method and installation source can't be changed once saved, so double-check before clicking **Add**.

### Handoff to next stage

With the policy live, move to Stage 4 to get Parallels Desktop onto end-user Macs so the policy actually takes effect.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.parallels.com/landing/pd-ag/parallels-desktop-enterprise-quick-start-guide/end-to-end-implementation-stages-technical-workflow/stage-3-management-portal-and-remote-policy-setup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.