Skip to main content

Revoke Semantics

Revocation is where the token-vs-enrollment distinction matters most. Revoking a token never touches devices that have already enrolled — those devices hold their own credentials and must be revoked individually. Choose the path that matches what you're trying to stop.

Revoke or expire a token​

Stops future enrollments that would use the token. Already-enrolled devices keep their own rotating credential and continue reporting.

  • Use it when a deployment token is no longer needed, or when you want to cap further growth.
  • Expiry is the softer form: it blocks new enrollments at a set time without an explicit revoke.

Rotate a token​

Mints a child token that supersedes the parent and revokes the parent. The child becomes the active distributed secret; enrolled devices are unaffected. Use rotation to refresh a distributed secret on a schedule or after limited exposure where you don't believe the wider lineage is compromised.

Revoke a token lineage​

Kills a token and every descendant at once, blocking all future enrollments across the family in a single action. Because this is a broad, irreversible action, the UI requires you to type a confirmation phrase.

Use it when any token in the lineage may be compromised — you can't be sure which descendant leaked, so you cut the whole family.

Lineage revoke does not detach devices

Revoking a lineage blocks future enrollments only. Devices already enrolled from any token in the lineage keep their own credential and must be revoked individually from the enrollment table.

Revoke an enrolled device​

Detaches a specific device from your tenant. The agent's credential is invalidated and the platform immediately reprojects that device's monitoring state.

  • Use it when a device is decommissioned, lost, or should no longer report.
  • This is the only action that stops an already-enrolled device from reporting.

Responding to a suspected compromise​

  1. A single device is lost/stolen → revoke that enrollment.
  2. A distributed token may have leaked → revoke the lineage (blocks all future enrollments across the family), then revoke any suspicious enrolled devices individually.
  3. Re-establish deployment → generate a fresh token and redistribute through MDM.

See Token & Enrollment Lifecycle for the underlying model and Troubleshooting if devices keep reporting after you expected them to stop.