Device Enrollment Guide

In this guide, we'll talk about different approaches you can take as you build your device inventory in Smallstep.

It's worth restating the overall goal of this process: To build a high-assurance device inventory, so that only your organization's devices can access protected resources.

While many organizations have device inventories in various locations (IT Asset Management systems, device management platforms, etc), these are not usually high-assurance inventories. Smallstep uses hardware identifiers and device attestation to help you develop a high-assurance inventory that can be the foundation for device authentication.

Here's a few ways to bring high-assurance device identifiers into your Smallstep inventory:

You can manually invite users to join your Smallstep team, and they will be able to self-enroll devices using the Smallstep Desktop App or the Smallstep Agent for Linux.

By default, administrators must approve a new device before it can access any of your resources. You can change this in Team Settings.

This option requires IdP self-enrollment in Team Settings to be enabled. It is disabled by default.

With IdP self-enrollment enabled, when you connect Smallstep to your identity provider, your users will be able to self-enroll via single sign-on, using the Smallstep Desktop App or the Smallstep Agent.

By default, administrators must approve newly-enrolled devices before they can access any of your resources. You can change this in Team Settings.

You can sync your existing MDM inventories into Smallstep. Once an MDM is synced, you can deploy the Smallstep Agent to your endpoints to enable high-assurance protections.

Devices synced from an MDM inventory are not automatically approved, and they will not be marked as high-assurance until Smallstep receives an attestation from the device.

For a concrete example, see Connect Jamf Pro to Smallstep

You can import devices from any source into Smallstep using our API.

Devices added via API are automatically approved. but they will not be marked as high-assurance until Smallstep receives an attestation from the device.

For each device, use the Add Device endpoint to create a device.

Devices are automatically approved when added via API.

Once added, you'll see devices in the Smallstep console, under Devices.