# Manage Access devices

Access devices are listed under **Access** in the console. This page covers looking after them once they are enrolled. To enroll new devices, see [Create an enrollment key](/install/enrollment-keys/) and [Install the Access agent on Windows](/install/access-agent-windows/).

## The device list

The cards at the top count **Devices**, **Online**, **Offline** and **Updates available**. If you can see the license (the **View license** permission), the **Devices** card also shows how many Access devices your plan allows, for example `12 of 25 in your plan`. When they are all in use, **Enroll a device** is greyed out with the tooltip **All Access devices in your plan are in use: new enrollments are refused. Remove a device, or add devices to your plan.** Devices already enrolled keep working. See [Access devices](/configure/plans-and-limits/#access-devices).

The list shows each device's name, OS, agent version, groups and connection, and you can sort by name, OS, agent version or last seen.

Badges call out devices that need attention:

| Badge | Meaning |
| --- | --- |
| **update** | A newer agent version is available. |
| **revoked** | The device was revoked and cannot connect. |
| **blocked by IP rule** | The organization's agent IP rule refused the device's address. Hover for the address, country and when. It clears when the device next connects from an allowed address. |
| **IP rule** | The device is online, but one of its connections (an Access session or a terminal) was recently refused by the agent IP rule. Hover for details. |
| **Safe Mode** / **Safe Mode next boot** | See [Reboot and Safe Mode](/use/reboot-and-safe-mode/). |
| **possible clone** | Two computers keep connecting as this device. Its identity was probably copied with a disk image. Revoke it and enroll each computer on its own. |

A blocked device counts as offline: the **Offline** card shows how many of them are blocked, and the status filter has **Blocked by IP rule** to list them. The rule itself is on the **Organizations** page; see [Restrict access by IP address and country](/configure/ip-and-country-rules/).

Select a device to open its details: status, host name, OS, agent version, last seen, boot mode, last reboot, BitLocker status, pending restarts, enrollment date, groups, tags, open terminals, session history and the device's **Chats** (see [The chat transcript](/use/session-history/#the-chat-transcript)). To chat with the device's signed-in user, select **Chat**; see [Chat with the customer](/use/chat/#chat-before-you-connect). If your plan does not include **Session history**, the details show **Not included in your plan: Session history** in its place. A device the agent IP rule refused also shows an **IP rule** row with the last refusal.

### If your plan does not include Unattended Access

The **Access** page stays, so you can clean up the devices you have, and shows **Not included in your plan: Unattended Access** with the note **Enrolled devices stay listed so you can rename, revoke or delete them. Connecting and enrolling are not available.** **Enrollment** disappears from the console.

## Rename, tag and move a device

You need **Edit devices**.

1. Open the device and select **Edit name, tags and groups**.
2. Change the **Name**.
3. Add **Tags**: type a tag and press Enter or a comma. Tags are searchable in the device list.
4. Tick or clear **Groups** to move the device in or out of groups.
5. Select **Save**.

You can only move a device into or out of a group where you have **Edit devices**. In the **Overview**, change a device's groups from inside its own organization.

## Device groups

Groups decide which devices someone with group-only access can reach. Open **Groups** in the console.

- **New group**: name a group and select **Create group**. Devices join a group through an enrollment key for that group, or when you move them in.
- **Rename** or **Delete** a group from its details. Deleting a group removes the roles given on it; its devices stay enrolled and just leave the group.
- A group's details list its devices and, under **Group roles**, the members who have a role on that group only.

Giving people roles on groups is covered in [Limit access with groups](/configure/groups/).

## Update the agent

When a newer agent release is available, the device shows **update** and its details show the version. Select **Update** in the device's details to push it now. The details then show the result under **Last update**. This needs **Edit devices**.

## Revoke a device

Revoke a device when it is lost, stolen or should no longer be reachable. You need **Remove devices**.

1. Open the device and, under **Danger zone**, select **Revoke**.
2. Confirm with **Revoke device**.

The device's credential stops working, its connection drops and its open sessions end. The record stays, marked **revoked**, so you can see what happened. No enrollment key brings it back; only **Un-revoke** does.

**Un-revoke** lets the device connect again with the key it was enrolled with. Only do this for a computer you trust: whoever has it gets unattended access back.

A revoked device does not count against the Access devices in your plan, so revoking one frees a device. Un-revoking makes it count again: it needs **Unattended Access** in your plan and is refused when all Access devices are in use.

## Delete a device

1. Open the device and, under **Danger zone**, select **Delete**.
2. Confirm with **Delete device**.

Deleting removes the device record entirely. The installed agent can no longer connect, and the device no longer counts against the Access devices in your plan. A device whose agent was uninstalled does not count either.

:::tip
Revoke when you want to keep a record of the device. Delete when you want it gone.
:::