Enrollment Templates

Enterprise

An Enrollment Template is a reusable configuration that lets you onboard many Windows, Linux, Oracle Solaris, AIX or macOS Agents with a single installation command. Instead of creating one device at a time, you define the approval policy, optional IP match rules, device naming, datasets, profiles, and update policy once — every Agent that runs the template's installation command then enrolls into that template's Director.

Use Enrollment Templates when you are rolling out Agents to more than a handful of endpoints, when you need consistent device names and data collection across a fleet, or when you want approval gating before a new endpoint joins the platform.

Access

Navigate to Home > Fleet Management > Devices and open the Windows, Linux, Oracle Solaris, AIX or macOS device type. The device type page has two tabs:

• Devices — devices already enrolled and managed individually
• Templates — Enrollment Templates for that platform

Templates are managed per platform: a template enrolls Agents of its own system only, so a Windows template enrolls Windows Agents and an AIX template enrolls AIX Agents. The flow is otherwise the same on all five systems.

Templates List

The Templates tab displays all Enrollment Templates for the selected platform.

Table Columns

Column	Description
Template name	Identifier set when the template was created
Director	Director the template enrolls Agents into
Enrolled	Enrolled count over maximum (53/100) or n/Unlimited when no limit is set
Pending approval	Number of enrollment requests awaiting review
Time limit	Validity period; hover for "Expires in X" tooltip, Indefinite when no limit is set
Status	Enabled, Disabled, Expired, or Limit reached

A template whose stored enrollment settings or update management are not valid shows a red Invalid settings or Invalid update management tag beside its name. It cannot enroll new devices until the part named is saved again on its detail page; its Status still shows what was set. When both are not valid, the row shows the Invalid settings tag only.

Controls

The toolbar provides a Search templates field, a Status filter, and pagination controls. Clicking a template name opens its detail page. The Create new enrollment template button launches the creation wizard.

Status Values

• Enabled — Template is active and accepting enrollments
• Disabled — Template is paused; new Agents cannot enroll until re-enabled
• Expired — Template's time limit has elapsed; no new enrollments accepted
• Limit reached — Maximum enrollment limit has been hit; no new enrollments accepted

Expired and Limit reached are computed from the template's settings; you do not set them directly. To re-open enrollment, edit the time limit or maximum limit in General settings.

Creating a Template

The creation wizard has six steps. General settings, Enrollment settings, Data collection and Update management are configurable; Review and create lets you review and edit any earlier step; Complete setup is terminal and cannot be revisited.

General Settings

Define the basic identity of the template and the Director it enrolls Agents into.

Field	Required	Description
Template name	Y	Unique name, up to 128 characters
Set maximum enrollment limit	N	Toggle. When off, enrollments are unlimited. When on, expose a numeric input for the cap. Enrollment stops once this limit is reached.
Set template time limit	N	Toggle. When off, the template is valid until disabled or deleted. When on, choose Presets (8 hours, 24 hours, 1 week, 1 month) or Date & Time Range. Validity starts at template creation.
Director	Y	Director that enrolled Agents connect to
Access token	Y	Director access token that Agents present when enrolling

A Windows or Linux template needs a Director on version 1.10 or later. An Oracle Solaris, AIX or macOS template needs a Director on version 2.3.1 or later, the release that serves the Agent of those systems. If the selected Director is running an earlier version, an error alert appears below the field naming the version the template needs: "Enrollment templates are unavailable on directors below version 1.10" for Windows and Linux, "Enrollment templates are unavailable on directors below version 2.3.1" for the other three. The alert names the Director's current version and instructs you to upgrade the Director or select a different one. You cannot proceed to the next step until a Director on the required version or later is selected.

Enrollment Settings

Configure how devices are approved and named when they enroll.

Approval method:

• Auto approval — All Agents that run the installation command are approved automatically and become devices.
• Manual approval — An Admin or Owner must review each enrollment request and approve or reject it before the device is created.

Match rules (optional):

Toggle Only enroll devices that match the rule(s) to restrict enrollment to specific source IPs. Add one or more rules of the following types:

• Single IP/IP block
• IP range
• CIDR

Multiple rules are evaluated as OR; an Agent matching any rule passes the filter.

Fallback behavior (Auto approval + match rules only):

When the approval method is Auto and match rules are enabled, choose what happens to Agents that do not match any rule:

• Require manual approval — request is queued for an Admin or Owner to review
• Reject automatically — request is denied without further review

This field is hidden when approval method is Manual or when no match rules are defined.

Device naming structure:

• Use host name — the Agent's host name becomes the device name
• Use template — provide a naming template using the variables host.domain, host.name, host.fqdn, host.ipaddress, unique.id (for example {host.domain}.{host.name} produces virtualmetric.device01)

When the same template name resolves to a duplicate, a sequential number is appended (vm-device-1, vm-device-2).

Data Collection

Select the datasets and profiles that the enrolled Agents will collect. The selection works the same way as in the standard device creation wizard. For details on datasets and profiles, see Datasets and Profiles.

Update Management

Configure the auto-update policy that enrolled Agents will use. The fields and behavior match the Agent auto-update configuration: pick a mode (Manual or Auto), method (Immediate or Scheduled), and either a cron expression or a polling interval.

Review and Create

The review step lists each prior step with the values you entered and a Change button to jump back to that step. Use this step to verify the template before submission. Click Create template to create the template.

Complete Setup

The final step shows the installation command that enrolls Agents into this template. Copy and run the command on each endpoint that should be enrolled — PowerShell on Windows, a shell command on Linux, Oracle Solaris, AIX and macOS. It is the same kind of command a single device of that system gets: on Oracle Solaris and AIX it runs the installer the Director serves and must be run as root. The command is also available later from the template's Enrollment settings tab.

This step has no Back button; once you reach it, the template is created and the earlier steps are read-only.

Template Detail

Clicking a template name from the list opens the detail page. The page has five tabs.

General Settings Tab

Read-only summary plus inline edit. Fields shown:

• Template name, Maximum enrollment limit, Template time limit
• Director (read-only — cannot be changed after creation)
• Status, Enrolled devices (used / max), Created, Last updated

A banner at the top of the page surfaces the current state:

Condition	Banner	Action
Stored enrollment settings are not valid	Warning — "Enrollment settings could not be read"	Manage enrollment settings opens the Enrollment settings tab in edit mode; saving replaces the stored settings
Stored update management is not valid	Warning — "Update management could not be read"	Manage update management opens the Update management tab in edit mode; saving replaces it
Pending enrollment requests exist	Info — "Pending enrollment requests" with count	Review requests opens the Enrollment requests tab
Status = Limit reached	Warning — explains the cap was hit	Edit max limit in General settings to continue
Status = Expired	Warning — shows the expiration date	Extend the time limit in General settings

The two "could not be read" banners come before the other three: while either shows, no device can enroll through the template. Their action button is shown to a user who may edit the template.

Enrollment Settings Tab

Shows the installation command, approval method, match rules, fallback behavior, and device naming structure. Use the Manage enrollment settings button to enter edit mode.

Data Collection Tab

Manages dataset and profile selection. Use the Manage data collection button to enter edit mode.

Update Management Tab

Shows the auto-update policy applied to Agents enrolled through this template. Use the Manage update management button to enter edit mode.

Enrollment Requests Tab

Lists all enrollment requests received by this template. See Enrollment Requests for details.

Enrollment Requests

When an Agent runs the template's installation command, it sends an enrollment request to the Director. The request's outcome depends on the template's approval method and match rules:

Approval method	Match rules	Outcome
Auto	None	Approved automatically — device is created.
Auto	Defined	Matching devices are approved automatically; non-matching devices follow the configured fallback behavior (manual approval queue or automatic rejection).
Manual	Any	All requests queue for review. An Admin or Owner approves or rejects each one.

Rejected requests do not create a device. A request the system rejects, because the template is disabled, expired or at its enrollment limit, or because no match rule fits and the fallback is automatic rejection, is decided again the next time the Agent tries to enroll, and its row then shows the new decision. A request a user rejects stays rejected. Pending requests can be approved or rejected from the Enrollment requests tab.

Requests Table

Column	Description
Device name	Name resolved from the device naming structure
IP address	Source IP address of the enrolling Agent
Enrollment requested	Timestamp when the request was received
Action time	Timestamp when the request was approved or rejected
Status	Pending, Approved, or Rejected
Action taken by	User who approved or rejected the request

The table supports search and pagination. Bulk approve and bulk reject actions are available when multiple pending requests are selected.

Request Drawer

Clicking a device name opens a side drawer, titled with the device's name, with the request's overview:

Request details: Device name, Enrollment requested, Action time, Status, Action taken by, and, for a request the system rejected, Rejection reason

Device details: Host name, Host FQDN, IP address, MAC address, Operating system, OS version

The fields are grouped under a Request overview heading. The Rejection reason is one of:

• The template was disabled.
• The template had expired.
• The template had reached its enrollment limit.
• The device's IP address matched no auto-approval rule.

Under the reason the drawer notes that the system decides the request again the next time the device asks to enroll. The reason shows only for a request the system rejected; a request a user rejected shows that user under Action taken by, and no reason.

For pending requests, the drawer provides Approve and Reject buttons. For approved requests, a Manage device button opens the resulting device's detail page.

Template Actions

Each row in the templates list and the template detail page expose an actions menu (⋮):

• Manage template — open the detail page
• Clone template — create a copy named Copy of <name> with all settings preserved
• Disable template — pause new enrollments without deleting the template
• Enable template — resume a previously disabled template
• Delete template — permanently remove the template

Disable

While a template is disabled, the system rejects an Agent's enrollment request through it and no device is created. The request still appears in the Enrollment requests tab as Rejected, with the reason that the template was disabled. Once the template is re-enabled, that request is decided again the next time the Agent tries to enroll. Existing devices that were already enrolled through the template are not affected. A confirmation modal explains the consequence; you can re-enable the template at any time.

Delete

Deleting a template is permanent.

warning

Deleting a template removes the template and all of its pending enrollment requests. Existing devices that were previously enrolled through the template remain on the platform and continue to operate. New Agents can no longer enroll using the deleted template's installation command.

A confirmation modal requires you to confirm before the template is removed.