Skip to main content

Enrollment tokens

 Cerberus Enterprise uses enrollment tokens to triggerstart the provisioningAndroid device enrollment (provisioning) process. The enrollmenttoken tokenyou select defines the initial policy applied to enrolled devices and influences which provisioning methodmodes youare useallowed. establishes a device's ownership (personally-owned or company-owned) and management mode (work profile or fully managed device).

To createThe a newAndroid enrollment token,tokens gotab is available only after completing Android Management setup.

Where to find enrollment tokens

 In the dashboard, open Enrollment tokens. sectionDepending inon your account configuration, the dashboard,page thencan clickshow multiple tabs (Android tokens, Google sign-in enrollment, Apple manual enrollment, and Apple Automated Device Enrollment).

 If your Android enterprise is backed by a managed Google domain (Google Workspace), the dashboard can also show an NewAuthenticate Using Google Enrollment tab. For details on enabling and using it, see Authenticate Using Google enrollment.

Enrollment tokens list (Android)

 The Android tokens tab shows a table of all tokens. Clicking a row opens the token details page.

Columns

  • Id: internal token identifier.
  • Status: Available, Used (one-time token already used), or Expired.
  • Expiration: expiration date/time, or Never.
  • Policy: the policy assigned to the token (the UI tooltip also shows the policy id).
  • Personal usage: Allowed / Disallowed / Dedicated device.
  • Allowed usages: Multiple or One time only.
  • User: optional user pre-assigned to devices enrolled with the token.

Actions

  •  Each row has a delete action (Delete enrollment toketokenn). button.

    Deletion

    1.is Options

    Whendisabled creatingwhen the license is expired.

  •  The table supports multi-row selection: you can enable selection mode, select multiple tokens, and delete them with Delete selected tokens.
  • Use the refresh action to reload the list. The table is paginated (10/25/50 items per page).

Create a new enrollment token

you can specify some parameters, that determines some aspects ofOn the provisioning,Android dependingtokens ontab, click New enrollment token to open the token creation page. If your needs.

license is expired, the create button is disabled.

1.

Token options

1. Policy

RequiredRequired. field. This is theThe policy that will be automatically applied onto all devices enrolled using thethis token. You can selectSelect one of theyour policyAndroid policies you created in your account.. If you don't have any policy in your account, you mustyet, create one first.

1.

2. User

The userOptional. thatIf willset, benewly enrolled devices are automatically associated towith devicesthis during provisioning.

user.

1.

3. Personal usage

Required field.

Controls whether personal usage is allowed on a device provisioned with this enrollment token.

Fortoken:

  • company-ownedAllowed: devices:suitable enabling personal usage allows the user to set up a work profile on the device. Disabling personal usage requires the user provision the device as a fully managed device.
For personally-owned devices: enabling personal usage allows the user to set up a work profile on the device. Disabling personal usage will prevent the device from provisioning.
Personal usage cannot be disabled onfor personally-owned device.

devices

1.4.(work Duration
Requiredprofile) field.and Thecompany-owned lengthdevices offor timework theand enrollmentpersonal tokenuse.
  • Disallowed: suitable for company-owned devices for work use only (fully managed).
  • Dedicated device: suitable for kiosk/dedicated devices (device is valid,not rangingassociated fromwith 1a minutesingle touser). 30 days.

    •  

    1.5.

    4. Allowed usages

    Required

    field.Select Whetherwhether the enrollment token can be used multiple times (Multiple) or oneonly once (One time only.

    only).

    2.5. Expiration

     Select the expiration unit (Minutes, Hours, Days, or Never). When not set to Never, enter the expiration value. The allowed range depends on the selected unit and can go up to 10,000 days.

    Provisioning options

     (QR code only)

     These additional options are embedded into the QR code and are applied during the provisioning of fully managed devices enrolled by scanning athe QR code. They do not apply to work profiles or devices enrolled using otherthe provisioningEnrollment methods.URL or Token.

    Wi‑Fi configuration

    If youUse setthis ato WiFi configuration,let a device can automatically connect to the specified network without user interactionWi‑Fi during deviceprovisioning, so it can download and initialize the management app. Available fields include SSID, Hidden SSID, Security, and (when needed) Passphrase.

     You can also configure an HTTP proxy (Proxy) and, depending on the mode, set Host/Port, PAC URI, and Proxy bypass host.

    Other options

     Additional options include Locale, Time zone, and Skip encryption.

    Enrollment token details

     When you open a token, the details page shows the token configuration and usage information:

    • Status, Expiration, Usage, Personal usage, and Allowed usages.
    • Token: the raw enrollment token value (copyable).
    • Enrollment URL: a Google Android Enterprise enrollment URL (copyable and sendable by email).
    • QR code: shown on the right side of the page, used to enroll fully managed devices.

     For step-by-step provisioning forprocedures, downloadingfollow the mobileAndroid deviceenrollment managementguides: application.

    Personally-owned devices, Company-owned devices for work and personal use, Company-owned devices for work use only, and Zero-touch.

    Back to top