Systems and methods for remote command access in a hybrid cloud to on-premises devices are described. An example method includes receiving, by a gateway service, a request for a connection between a remote support service agent and an on-premises device. The method further includes receiving, by the gateway service, consent from an authorized user associated with the on-premises device. The method further includes creating, by the gateway service, a first session with the on-premises device, where a scope of the consent is limited to the first session. The method further includes provisioning, by the gateway service, a device-specific hybrid connection endpoint for the first session. The method further includes forming, by the gateway service a secure session by binding the device-specific hybrid connection endpoint with a second session, the secure session allowing for transport of data and a set of commands based on a scope of the consent.