Enrollment tokens

Cerberus Enterprise uses enrollment tokens to start the Android device enrollment (provisioning) process. The token you select defines the initial policy applied to enrolled devices and influences which provisioning modes are allowed.

The Android enrollment tokens tab is available only after completing Android Management setup.

Where to find enrollment tokens

In the dashboard, open Enrollment tokens. Depending on your account configuration, the page can show multiple tabs (Android tokens, Google sign-in enrollment, Apple manual enrollment, and Apple Automated Device Enrollment).

If your Android enterprise is backed by a managed Google domain (Google Workspace), the dashboard can also show an Authenticate Using Google Enrollment tab. For details on enabling and using it, see Authenticate Using Google enrollment.

Enrollment tokens list (Android)

The Android tokens tab shows a table of all tokens. Clicking a row opens the token details page.

Columns

• Id: internal token identifier.
• Status: Available, Used (one-time token already used), or Expired.
• Expiration: expiration date/time, or Never.
• Policy: the policy assigned to the token (the UI tooltip also shows the policy id).
• Personal usage: Allowed / Disallowed / Dedicated device.
• Allowed usages: Multiple or One time only.
• User: optional user pre-assigned to devices enrolled with the token.

Actions

• Each row has a delete action (Delete enrollment token). Deletion is disabled when the license is expired.
• The table supports multi-row selection: you can enable selection mode, select multiple tokens, and delete them with Delete selected tokens.
• Use the refresh action to reload the list. The table is paginated (10/25/50 items per page).

Create a new enrollment token

On the Android tokens tab, click New enrollment token to open the token creation page. If your license is expired, the create button is disabled.

Token options

1. Policy

Required. The policy automatically applied to all devices enrolled using this token. Select one of your Android policies. If you don't have any policy yet, create one first.

2. User

Optional. If set, newly enrolled devices are automatically associated with this user.

3. Personal usage

Controls whether personal usage is allowed on a device provisioned with this enrollment token:

• Allowed: suitable for personally-owned devices (work profile) and company-owned devices for work and personal use.
• Disallowed: suitable for company-owned devices for work use only (fully managed).
• Dedicated device: suitable for kiosk/dedicated devices (device is not associated with a single user).

4. Allowed usages

Select whether the token can be used multiple times (Multiple) or only once (One time only).

5. Expiration

Select the expiration unit (Minutes, Hours, Days, or Never). When not set to Never, enter the expiration value. The allowed range depends on the selected unit and can go up to 10,000 days.

Provisioning options (QR code only)

These additional options are embedded into the QR code and are applied during provisioning of fully managed devices enrolled by scanning the QR code. They do not apply to work profiles or devices enrolled using the Enrollment URL or Token.

Wi‑Fi configuration

Use this to let a device automatically connect to Wi‑Fi during provisioning, so it can download and initialize the management app. Available fields include SSID, Hidden SSID, Security, and (when needed) Passphrase.

You can also configure an HTTP proxy (Proxy) and, depending on the mode, set Host/Port, PAC URI, and Proxy bypass host.

Other options

Additional options include Locale, Time zone, and Skip encryption.

Enrollment token details

When you open a token, the details page shows the token configuration and usage information:

• Status, Expiration, Usage, Personal usage, and Allowed usages.
• Token: the raw enrollment token value (copyable).
• Enrollment URL: a Google Android Enterprise enrollment URL (copyable and sendable by email).
• QR code: shown on the right side of the page, used to enroll fully managed devices.

For step-by-step provisioning procedures, follow the Android enrollment guides: Personally-owned devices, Company-owned devices for work and personal use, Company-owned devices for work use only, and Zero-touch.