Enrollment tokens

Create, copy, and revoke the token that lets laptops join your organization without a sign-in.

console.superalign.ai/downloads

An enrollment token is a long secret code, starting with sae_, that lets a laptop join your organization on its own. You create it once, give it to your MDM, and every new laptop uses it. Each laptop then gets its own permanent credential, so revoking the token later does not affect laptops that already joined.

Before you begin

• You have the Owner or Admin role. The tokens section is hidden from other roles.
• You know which MDM will carry the token, so you can pick a sensible name and expiry.

Create a token

Then follow MDM deployment to hand it to your MDM.

Check it is being used

Last used on the token card shows when a laptop last enrolled with it. If it says “Never used” after your rollout, the token did not reach the laptops. See Troubleshooting.

Revoke a token

Click the trash icon and confirm. New laptops can no longer enroll with it. Laptops that already joined are unaffected. Create a new token first if the rollout is still running, and update your MDM before revoking the old one.

Token creation and revocation are written to the audit log.

What happens next

Paste the token into your MDM and deploy the package. Laptops appear on Endpoints within one scan interval, and Last used on the token card updates the first time one enrolls.

Next steps

• MDM deployment for the per-platform keys
• Troubleshooting if laptops do not appear