Troubleshooting
Most agent issues fall into three buckets: enrollment failures, heartbeat/posture gaps, and revocation surprises. Work through the matching section below.
A device won't enroll
| Symptom | Likely cause | Fix |
|---|---|---|
| Enrollment rejected | Token revoked or expired | Generate a fresh token; check the token isn't part of a revoked lineage |
| Enrollment rejected at scale | Enrollment cap reached | Raise the cap or issue a new token |
| Token not found by installer | Managed config key wrong | The key must be exactly enrollmentToken in the plist/JSON |
| No prompt on manual install | Token not supplied | Re-run first-run setup and paste the token |
Check the token's status and remaining cap on the Agents screen. A token that shows as revoked or expired will block all new enrollments.
A device enrolled but shows no heartbeat / stale posture
- Recently deployed — allow a heartbeat interval for the first report to arrive.
- Network — the agent needs outbound HTTPS to the ConcertoGRC API. Confirm no proxy or firewall is blocking it.
- Agent stopped — verify the background service/daemon is running (Windows service, macOS background item, Linux systemd unit).
- Elevated enrollment velocity — if many devices enrolled in a short window, the Agents screen may flag elevated velocity; this is informational and does not block reporting.
A device kept reporting after I revoked a token
This is expected. Revoking a token only stops new enrollments. Already-enrolled devices hold their own rotating credential and keep reporting.
To stop an enrolled device, revoke the enrollment from the enrollment table. See Revoke Semantics.
I revoked a lineage but new devices still enroll elsewhere
A lineage revoke blocks the token and all its descendants. If devices still enroll, they are using a different token outside that lineage. Identify and revoke that token separately.
Signed installer isn't available yet
Until signed .pkg / .msi / Linux packages are published on the Agents screen, deploy through your MDM using a deployment token. See Deployment.
Still stuck?
Gather the device name, platform, agent version, and the token name involved, then contact ConcertoGRC support or your operator. The Security & Privacy Data Sheet answers "what is this agent doing on my device" questions from employees.