mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-10-21 20:19:11 +02:00
56 lines
2.5 KiB
Plaintext
56 lines
2.5 KiB
Plaintext
---
|
|
title: "Device Approvals"
|
|
description: "Only allow trusted devices to connect to an organization"
|
|
---
|
|
<Note>
|
|
Only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) and [Enterprise Edition](/self-host/enterprise-edition).
|
|
</Note>
|
|
|
|
By default, any client configured with valid credentials can connect to an organization. To enhance security, you can enable device approvals, which require each new device to be manually approved by an administrator before it can connect.
|
|
|
|
When device approvals are enabled, the first time a user connects a new device to the organization, the device will be marked as "Pending Approval." An administrator must then review and approve the device in the management console before it can access organization resources.
|
|
|
|
<Frame>
|
|
<img src="/images/device_waiting_approval.png" alt="Device marked pending approval in the Pangolin dashboard" />
|
|
</Frame>
|
|
|
|
All approvals can also be managed from a central page as they stream in to allow admins to approve or deny devices quickly.
|
|
|
|
<Frame>
|
|
<img src="/images/approvals_page.png" alt="Approvals page listing pending devices in the Pangolin dashboard" />
|
|
</Frame>
|
|
|
|
## Benefits
|
|
|
|
- Stolen or phished credentials aren't enough to connect from an unknown device.
|
|
- Admins see every new device before it can reach resources.
|
|
- Approvals are set per role, so you can require them for some groups and not others.
|
|
|
|
## Use Cases
|
|
|
|
- Only allow company-issued laptops to connect, not personal devices.
|
|
- Require approval for contractor roles while employees connect freely.
|
|
- Catch an unexpected new device on a user's account before it reaches sensitive resources.
|
|
|
|
## How Device Approvals Work
|
|
|
|
1. A user in a role that requires approval connects a device for the first time.
|
|
2. The device shows as Pending Approval and can't reach any organization resources.
|
|
3. An admin approves or denies it from the device or the approvals page.
|
|
4. Once approved, the device connects normally. Devices that were already approved aren't asked again.
|
|
|
|
## Enabling Device Approvals
|
|
|
|
Device approvals are enabled on a per-role basis. To enable device approvals for a role, follow these steps:
|
|
|
|
1. Click on the **Roles** tab.
|
|
2. Select the role you want to enable device approvals for.
|
|
3. Toggle the **Require Device Approval** option to enable it.
|
|
4. Save your changes.
|
|
|
|
Once enabled, any new user connecting with that role will require approval from an administrator before it can access organization resources.
|
|
|
|
<Tip>
|
|
You cannot enable device approvals for the "Admin" role.
|
|
</Tip>
|