Enrolment Key Management¶
Enrolment keys control access to a customer's Enclave tenant. They should be treated as secrets and managed with the same discipline as credentials or API keys.
This procedure covers creating, rotating, and retiring enrolment keys.
Default posture¶
Where possible, run each customer's tenant with no enrolment keys enabled. Enable a key when you need to enrol systems, then disable it again once enrolment is complete. This limits the window during which a key can be used if it is inadvertently shared.
The exception is infrastructure where re-enrolment is part of normal operations — containers, autoscaling groups, or other ephemeral systems that enrol and de-enrol as part of their lifecycle. These scenarios need a permanently enabled key, typically an Ephemeral Enrolment Key.
Enrolment key state (enable, disable, create, delete) can be managed through the Enclave APIs, so if you have existing automation or orchestration pipelines, key lifecycle can be incorporated into those workflows.
Key creation best practices¶
When creating a new Enrolment Key, follow these guidelines:
One key per purpose¶
Create separate keys for each category of device rather than a single key for all enrolments. This allows you to:
- Apply different Auto Tags per device role
- Set appropriate Use Limits per group
- Rotate or disable a key without affecting other device categories
| Key name | Auto Tags | Use Limit | Approval Mode |
|---|---|---|---|
Staff Laptops |
staff, users |
Number of staff | Automatic (with trust requirement) |
Servers |
servers |
Number of servers | Gated |
Developer Workstations |
developers, users |
Number of developers | Automatic (with trust requirement) |
Contractor Devices |
contractors |
Number of contractors | Gated |
Any tags attached to an enrolment key are automatically applied to each system as it enrols using that key, but the tag attachments are not permanent — tags on any enrolled system can be added, changed, or removed at any time in the portal. The enrolment key is a convenience for getting the right tags onto systems from the start, not a constraint.
Use limits¶
Set a use limit matching the expected number of enrolments. This prevents a key from being circulated beyond its intended audience. The limit can be increased later if needed.
Auto expiry¶
For time-bound deployments (PoC trials, contractor engagements, one-off demonstrations), set an Auto Expiry date so the key disables or deletes itself automatically.
Ephemeral keys¶
Use Ephemeral Enrolment Keys for containers, Kubernetes pods, and other short-lived systems. Systems enrolled with ephemeral keys are automatically removed when they disconnect (after a configurable grace period).
Key rotation¶
Enrolment keys do not have a built-in rotation mechanism. Rotate keys manually when:
- A key has been exposed or shared beyond its intended audience
- A team member who had access to the key leaves the organisation
- As part of a scheduled security hygiene review (see Periodic Review)
Rotation procedure¶
- Open the Enrolment Keys page in the customer's tenant.
- Select the key to rotate and choose Duplicate. This creates a new key with the same Auto Tags and configuration.
- Rename the new key to indicate it is the current version (e.g. append the month:
Staff Laptops - Jul 2026). - Distribute the new key through your RMM tool or deployment scripts, replacing references to the old key.
- Disable the old key. Disabling prevents new enrolments but does not affect systems already enrolled with the key.
- After confirming no further enrolments are expected on the old key, Delete it. Deleted keys can never be reused.
Warning
Disabling or deleting an enrolment key does not affect systems that have already enrolled using that key. Enrolled systems retain their certificates and connectivity regardless of the key's state.
Key audit¶
Periodically review all enrolment keys in each customer tenant:
- Unused keys. Enabled keys with zero enrolments that have been active for an extended period. Disable or delete them.
- Unlimited keys. Keys without a use limit. Consider adding a limit or setting an auto expiry.
- Old keys. Keys created more than 6 months ago that are still enabled. Rotate them.
- Expired keys. Keys that auto-expired into a disabled state. Delete them if no longer needed.
Last updated July 22, 2026