Track and revoke install tokens
Check which enrollment secrets remain usable, follow their consumption and expiry, and stop further enrollment without disconnecting existing agents.
Before you start
- An administrator account with MFA verified.
- The organization that issued the token selected in the console.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Identify the correct enrollment token
From Admin → Agent Fleet, choose Install agent, then Manage install tokens. Match Name, visible Prefix, Tags, and OU to your deployment wave. The list shows only a prefix, not the full secret. Compare Created and Last used when similarly named deployments exist. Choose New token to return to Install Agent if you need another secret.
Read consumption and status together
Check Installs as used/max, then Expires and Status. Active means the token is neither revoked, expired, nor exhausted. Used means its maximum enrollments have been consumed. Expired means its time limit passed. Revoked means an administrator disabled it. A token can stop enrolling devices even though the devices it already enrolled continue to report.
Revoke the precise token
Choose Revoke on the matching row. In Revoke this token?, confirm the consequence and choose Revoke. Do this for a lost token or completed rollout. The operation prevents new registrations with that token; it does not revoke credentials on already-enrolled agents.
What you should see: The row changes to Revoked after a confirmed response.
Create a replacement when enrollment must continue
Choose New token, then configure the smallest practical device count and validity period on Install Agent. Copy the new link/secret while it is displayed and update the intended deployment assignment. Do not treat a token replacement as agent credential recovery; use Recovery token in Agent fleet for an already-enrolled endpoint.
If something doesn’t work
The full token cannot be found in the list.
Only its prefix is retained for display. Issue a replacement and update the deployment assignment; the original secret cannot be retrieved from this page.
Revocation was not confirmed.
Check the connection and refresh the token list before retrying. Confirm the target row’s status so an uncertain response is not mistaken for an active token.