Manage Access devices

Access devices are listed under Access in the console. This page covers looking after them once they are enrolled. To enroll new devices, see Create an enrollment key and Install the Access agent on Windows.

The device list

The cards at the top count Devices, Online, Offline and Updates available. If you can see the license (the View license permission), the Devices card also shows how many Access devices your plan allows, for example 12 of 25 in your plan. When they are all in use, Enroll a device is greyed out with the tooltip All Access devices in your plan are in use: new enrollments are refused. Remove a device, or add devices to your plan. Devices already enrolled keep working. See Access devices.

The list shows each device’s name, OS, agent version, groups and connection, and you can sort by name, OS, agent version or last seen.

Badges call out devices that need attention:

Badge	Meaning
update	A newer agent version is available.
revoked	The device was revoked and cannot connect.
blocked by IP rule	The organization’s agent IP rule refused the device’s address. Hover for the address, country and when. It clears when the device next connects from an allowed address.
IP rule	The device is online, but one of its connections (an Access session or a terminal) was recently refused by the agent IP rule. Hover for details.
Safe Mode / Safe Mode next boot	See Reboot and Safe Mode.
possible clone	Two computers keep connecting as this device. Its identity was probably copied with a disk image. Revoke it and enroll each computer on its own.

A blocked device counts as offline: the Offline card shows how many of them are blocked, and the status filter has Blocked by IP rule to list them. The rule itself is on the Organizations page; see Restrict access by IP address and country.

Select a device to open its details: status, host name, OS, agent version, last seen, boot mode, last reboot, BitLocker status, pending restarts, enrollment date, groups, tags, open terminals, session history and the device’s Chats (see The chat transcript). To chat with the device’s signed-in user, select Chat; see Chat with the customer. If your plan does not include Session history, the details show Not included in your plan: Session history in its place. A device the agent IP rule refused also shows an IP rule row with the last refusal.

If your plan does not include Unattended Access

The Access page stays, so you can clean up the devices you have, and shows Not included in your plan: Unattended Access with the note Enrolled devices stay listed so you can rename, revoke or delete them. Connecting and enrolling are not available. Enrollment disappears from the console.

Rename, tag and move a device

You need Edit devices.

1. Open the device and select Edit name, tags and groups.
2. Change the Name.
3. Add Tags: type a tag and press Enter or a comma. Tags are searchable in the device list.
4. Tick or clear Groups to move the device in or out of groups.
5. Select Save.

You can only move a device into or out of a group where you have Edit devices. In the Overview, change a device’s groups from inside its own organization.

Device groups

Groups decide which devices someone with group-only access can reach. Open Groups in the console.

• New group: name a group and select Create group. Devices join a group through an enrollment key for that group, or when you move them in.
• Rename or Delete a group from its details. Deleting a group removes the roles given on it; its devices stay enrolled and just leave the group.
• A group’s details list its devices and, under Group roles, the members who have a role on that group only.

Giving people roles on groups is covered in Limit access with groups.

Update the agent

When a newer agent release is available, the device shows update and its details show the version. Select Update in the device’s details to push it now. The details then show the result under Last update. This needs Edit devices.

Revoke a device

Revoke a device when it is lost, stolen or should no longer be reachable. You need Remove devices.

1. Open the device and, under Danger zone, select Revoke.
2. Confirm with Revoke device.

The device’s credential stops working, its connection drops and its open sessions end. The record stays, marked revoked, so you can see what happened. No enrollment key brings it back; only Un-revoke does.

Un-revoke lets the device connect again with the key it was enrolled with. Only do this for a computer you trust: whoever has it gets unattended access back.

A revoked device does not count against the Access devices in your plan, so revoking one frees a device. Un-revoking makes it count again: it needs Unattended Access in your plan and is refused when all Access devices are in use.

Delete a device

1. Open the device and, under Danger zone, select Delete.
2. Confirm with Delete device.

Deleting removes the device record entirely. The installed agent can no longer connect, and the device no longer counts against the Access devices in your plan. A device whose agent was uninstalled does not count either.

Tip

Revoke when you want to keep a record of the device. Delete when you want it gone.