Product documentation
Unicon eLux Scout
UniconOS Management 2609, UniconOS 2609 UniconOS 2603 LTSR CU2 UniconOS Management 2508 LTSR CU 1.1, UniconOS 2607.2, ELIAS 18.2603.2 UniconOS Management 2607, UniconOS 2607 UniconOS Management 2605, UniconOS 2605, SCG 1 2605 UniconOS Management 2508 LTSR CU1 eLux 7 2603 LTSR CU1 Scout 15 2603, Scout 15 2508.5 LTSR, eLux 7 2603 LTSR
View PDF

Enrollment settings

October 13, 2026
Contributed by: 
C

Enrollment settings is where you manage device-enrollment tokens and certificates for enrolling remote UniconOS devices in UniconOS Management Cloud.

Note:

This is available in UniconOS Management Cloud only. On-premises installations don’t show this page and continue using Scout Cloud Gateway.

Go to Preferences > Advanced options > Enrollment settings. The page has two sections: Certificates and Token management.

Administrators need the Enrollment settings administrator right to see this page and its related certificate columns and revoke actions elsewhere in Scout Board. This right isn’t restricted by OU: an administrator with the right can run Revoke all certificates on every enrolled device in the tenant, including devices in OUs they otherwise can’t see.

To grant the right, go to Security & permissions > Manage administrators, select the administrator, and click Edit. Then select Enrollment settings under Menu rights > Menu : Options > Menu : Options -> Advanced options, and click Apply.

A new administrator created with Minimum access doesn’t get this right. After an upgrade, an existing administrator keeps it until you remove it — except an administrator created in the Scout Console with minimum access whose rights were never edited there.

Certificates

Set how long a device’s certificate is valid, and, if your tenant has automatic certificate renewal on, how soon before expiry a device renews it:

Setting Description
Certificate validity The certificate’s lifetime in days, from 1 to 90.
Renewal threshold How many days before expiry a device renews its certificate. At least 1 day, less than the validity, and at most 60 days. Appears only when automatic certificate renewal is on for your tenant.

Click Apply settings after changing a value. Scout Board rejects values outside these ranges.

Note:

Automatic certificate renewal itself can’t be turned on or off in Scout Board. While it’s off for your tenant, device certificates are not renewed, and a device can no longer connect once its certificate expires.

Revoke all certificates revokes the certificate of every enrolled device in the tenant, after you confirm. Affected devices can’t connect again until they’re enrolled once more.

Token management

A device enrolls using a token that you create here. Enrollment accepts tokens only — other authentication methods, such as Active Directory or an identity provider, aren’t available for enrollment.

Tokens are listed under two tabs:

Tab Columns Row menu
Active Token (with its description), Organizational unit, Validity (“Expires” date), Token type (Persistent or One-time) Edit, Deactivate
Deactivated Token, Organizational unit, Deactivated on, Deactivation reason (Used (one-time), Expired, Deactivated) Delete icon removes the record permanently

Search tokens filters by the token or its description.

Adding a token

  1. Click Add token.

  2. Fill in the new token’s details:

    Field Description
    Token The value a device uses to enroll. See the token rules below. Cannot be changed later.
    Description Optional, up to 255 characters. Letters A-Z and a-z only (no umlauts or accented letters), numbers, spaces, and hyphens.
    Organizational unit Required.
    Validity How long the token stays valid: 1 hour, 24 hours (default), 7 days, 30 days, 90 days, or 365 days.
    One-time token Off creates a persistent token, reusable until it expires or you deactivate it. On deactivates the token automatically after its first use.

  3. Save the token.

A token must follow these rules:

  • It has 12 to 50 characters.
  • It contains only letters (A-Z and a-z), numbers, and these symbols: @ # . _ -.
  • It has at least 5 different characters.
  • It is unique in the tenant.

A tenant can have up to 350 active tokens. When the limit is reached, Add token is disabled. Expired, used, and deactivated tokens don’t count, so deactivate tokens that you no longer need.

Editing or deactivating a token

Use the row menu of an active token to Edit its description, organizational unit, or validity (Keep current by default), or to Deactivate it. You can’t change a one-time token to a persistent token.

A deactivated token can no longer enroll a device. Tokens also move to Deactivated automatically once they expire, or once a one-time token is used.

Device list

Enrolled devices show three extra columns in Devices > OU structure (not in All devices):

Column Shows
Certificate expires at The device’s certificate expiry date.
Certificate status Active, or Not active if the certificate is revoked or expired.
eLux version The eLux version the device had when it last enrolled or re-enrolled. Doesn’t update with later firmware updates.

These columns are empty for devices that aren’t enrolled, and can’t be sorted or filtered.

Enrollment > Revoke certificate, in a device’s context menu, appears only while its certificate is active. For several selected devices, use Selection > Revoke certificates — it revokes the active certificates in the selection, skips devices without one, and reports the result as “Revoked N; skipped K without a certificate.”

A device whose certificate is revoked can no longer connect to Scout.

Enrolled devices elsewhere in Scout Board

For an enrolled device, Scout Board hides the Peer IP address, Connected via SCG, and SCG address fields that still show for devices connected through Scout Cloud Gateway.

Scout Board also locks seven /setup/terminal.ini keys that the enrollment process writes on the device ([Network] ScoutWebSocketServiceUrl, ScoutCloudEnabled, DesUrl, DeviceCertificatePath, DeviceKeyPath, DeviceCertificateValidUntil, and [Global] ClientIdentifier). You can’t add or change these keys, in an advanced device configuration, for an enrolled device or for an OU or base configuration that contains one. You can delete an existing entry for one of these keys — if the same entry also exists on a parent OU or the base configuration, delete it there too, or the inherited value keeps applying.

Request diagnostic files works for enrolled devices. Diagnostic files that a user sends from the device itself aren’t accepted.

Known limitations

  • Revoke all certificates can fail for a tenant with more than 100 enrolled devices — the request is sent in a single batch with a 100-device limit.
  • Token management lists only the 25 most recently created tokens, with no paging. An older active token outside that list can’t be seen or deactivated here.
  • Scout Board doesn’t check a description against the rules above before sending it. A description with other characters is rejected by the service with the generic error “Request failed with status code 400.”
Enrollment settings
October 13, 2026
Contributed by: 
C
October 13, 2026
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.