Enrollment tokens
Create, copy, and revoke the token that lets endpoints join your organization without a sign-in.
console.superalign.ai/downloads
An enrollment token is a long secret code, starting with sae_, that lets an endpoint join your organization on its own. You create it once on the Downloads page, under MDM / Enterprise, give it to your MDM, and every new endpoint uses it. Each endpoint then gets its own permanent credential, so revoking the token later does not affect endpoints that already joined.
The page holds one active token at a time. While it is active, the Enrollment tokens section shows its card and no New token button.
Before you begin
- You have the Admin role. The Enrollment tokens section is hidden from other roles.
- You know which MDM will carry the token, so you can pick a sensible name and expiry.
Create a token
Click New token
The button appears when there is no active token, next to “No active token — create one to enable enrollment.”
Name it
The name starts as “MDM deployment”. Change it if you like, for example “Jamf fleet”.
Choose an expiry
Never, 7 days, 30 days, 90 days, or 1 year. Then click Create Token.
Copy it
The token card shows the name, Active, the created date, the expiry, and the masked token. Click Copy full token. The token stays copyable from this page while it is active.
The configuration file and the installer for your MDM appear below the card, with the token already filled in. Then follow MDM deployment to hand it to your MDM.
If the card shows Rotate to reveal instead of Copy full token, the console cannot read this token back. The configuration file cannot be filled in either. Revoke the token and create a new one to get a value you can copy.
Check it is being used
The token card shows “Last used” with the date and time an endpoint last enrolled with it. If it says “Never used” after your rollout, the token did not reach the endpoints. See Troubleshooting.
Revoke a token
Click the trash icon on the token card, then click Revoke Token to confirm. New endpoints can no longer enroll with it. Endpoints that already joined are unaffected.
Rotate a token
You cannot create a new token while one is active, so rotating means revoking first:
Revoke the old token
Click the trash icon and confirm. The section shows New token again, and the configuration file and installer disappear until a token exists.
Create a new token
Click New token and follow Create a token.
Update your MDM
Copy the new token, or download the configuration file and installer again, and replace the old ones in your MDM.
From the moment you revoke until your MDM delivers the new token, no endpoint can enroll. Keep the gap short. Endpoints that tried the old token retry and join once the new one reaches them.
An expired token works the same way: it stops being active, and the section shows New token again.
Token creation and revocation are written to the Audit Log.
What happens next
Paste the token into your MDM and deploy the package. Endpoints appear on Endpoints within one scan interval, and the token card changes from “Never used” to “Last used” the first time one enrolls.
Next steps
- MDM deployment for the per-platform keys
- Troubleshooting if endpoints do not appear