Create an enrollment key

An enrollment key lets the Access agent register a computer into one organization. You create keys in the console under Enrollment, inside the organization the computers belong to. You need the Enroll devices permission there, and your plan must include Unattended Access: without it, Enrollment does not appear in the console.

Note

You do not need a key when you install Access from a support session: Blink creates a one-time key for that install itself.

Create a key

1. In the console, switch to the organization the computers belong to and open Enrollment.
2. Select New key.
3. Fill in the form:
   • Label: a name you will recognise later, for example Acme HQ rollout, Oct.
   • Seed group: computers enrolled with this key join this device group. Choose No group to leave them ungrouped.
   • Max uses: how many computers may enroll with the key. 0 means unlimited.
   • Expires in days: from 1 to 365. The default is 90.
   • Allow re-enrollment (shown only if you have the Remove devices permission for that group): lets a computer that is already enrolled in this key’s group register a new device key with this key.
4. Select Create key.

The new key appears at the top of the page, marked New key · shown once.

5. Select Copy key, or download an installer straight away (see Install the Access agent on Windows).
6. Select Done when you are finished.

The key is shown only once

Blink keeps only a hash of the key, so it cannot show it again. If you lose it, create a new one. The signed installer for a key can also only be downloaded while the key is on screen.

Access devices in your plan

Each computer that enrolls takes one Access device in your plan. If you can see the license (the View license permission), the top of the Enrollment page shows how many are in use, for example 12 of 25 Access devices.

When every Access device is in use, the page warns: All Access devices in your plan are in use: new computers cannot enroll until a device is removed or devices are added to your plan. Devices already enrolled keep working. You can still create keys, because a key is not a device, but enrolling with it is refused until a device is free. To free one, revoke or delete a device you no longer manage (see Manage Access devices), or ask for more devices in your plan. See Access devices.

Keep keys under control

A key built into an installer can be recovered from that file. Treat installers like passwords:

• Use one key per rollout.
• Set a small Max uses and a short expiry.
• Revoke the key when the rollout is done.

Every key expires. The key table shows each key’s Label, Group, Uses, Expires and Status (active, used up, expired or revoked). Tick Show revoked and expired to see old keys too.

Change a key

Select Edit on a key that is not revoked to change its Label, Max uses, or set a New expiry in days from now (1 to 365). Leave the expiry empty to keep the current one.

Revoke a key

Select Revoke on the key and confirm with Revoke key. Installers carrying it stop enrolling immediately. Computers already enrolled with it are not affected. You need the Revoke enrollment keys permission.

Rules worth knowing

• A computer that is already enrolled cannot enroll again with a new device key unless the key allows re-enrollment, or you delete the device in the console first.
• A computer whose agent was uninstalled can be enrolled again with a key for its device group, or with a key that has no group. It then takes an Access device in your plan again, so this is refused at the device limit.
• A revoked device never comes back through an enrollment key. Only Un-revoke on the device brings it back.