---
title: Enrollment tokens
description: Create, copy, and revoke the token that lets endpoints join your organization without a sign-in.
---

_[console.superalign.ai/downloads](https://console.superalign.ai/downloads)_

An **enrollment token** is a long secret code, starting with `sae_`, that lets an endpoint join your organization on its own. You create it once on the **Downloads** page, under **MDM / Enterprise**, give it to your MDM, and every new endpoint uses it. Each endpoint then gets its own permanent credential, so revoking the token later does not affect endpoints that already joined.

The page holds one active token at a time. While it is active, the **Enrollment tokens** section shows its card and no **New token** button.

## Before you begin

- You have the **Admin** role. The **Enrollment tokens** section is hidden from other roles.
- You know which MDM will carry the token, so you can pick a sensible name and expiry.

## Create a token

1. **Click New token**

    The button appears when there is no active token, next to "No active token — create one to enable enrollment."

2. **Name it**

    The name starts as "MDM deployment". Change it if you like, for example "Jamf fleet".

3. **Choose an expiry**

    Never, 7 days, 30 days, 90 days, or 1 year. Then click **Create Token**.

4. **Copy it**

    The token card shows the name, **Active**, the created date, the expiry, and the masked token. Click **Copy full token**. The token stays copyable from this page while it is active.

The configuration file and the installer for your MDM appear below the card, with the token already filled in. Then follow [MDM deployment](/surface/deploy/mdm/overview) to hand it to your MDM.

If the card shows **Rotate to reveal** instead of **Copy full token**, the console cannot read this token back. The configuration file cannot be filled in either. Revoke the token and create a new one to get a value you can copy.

## Check it is being used

The token card shows "Last used" with the date and time an endpoint last enrolled with it. If it says "Never used" after your rollout, the token did not reach the endpoints. See [Troubleshooting](/surface/scanner/troubleshooting).

## Revoke a token

Click the trash icon on the token card, then click **Revoke Token** to confirm. New endpoints can no longer enroll with it. Endpoints that already joined are unaffected.

## Rotate a token

You cannot create a new token while one is active, so rotating means revoking first:

1. **Revoke the old token**

    Click the trash icon and confirm. The section shows **New token** again, and the configuration file and installer disappear until a token exists.

2. **Create a new token**

    Click **New token** and follow [Create a token](#create-a-token).

3. **Update your MDM**

    Copy the new token, or download the configuration file and installer again, and replace the old ones in your MDM.

From the moment you revoke until your MDM delivers the new token, no endpoint can enroll. Keep the gap short. Endpoints that tried the old token retry and join once the new one reaches them.

An expired token works the same way: it stops being active, and the section shows **New token** again.

Token creation and revocation are written to the [Audit Log](/surface/activity/audit-log).

## What happens next

Paste the token into your MDM and deploy the package. Endpoints appear on **Endpoints** within one scan interval, and the token card changes from "Never used" to "Last used" the first time one enrolls.

## Next steps

- [MDM deployment](/surface/deploy/mdm/overview) for the per-platform keys
- [Troubleshooting](/surface/scanner/troubleshooting) if endpoints do not appear