Fleet is the list of every machine that has ever enrolled, and Groups is how the same behaviour reaches many of them at once. Most changes to a machine are declarative — set a policy or a credential and the agent converges on its next poll — but a handful of actions need to happen right now, and those move through a queued, audited command channel instead.
How it works
Every agent belongs to exactly one group. The group carries default behaviour policies, a kiosk schedule, a rotation schedule and a poll interval; an individual agent can override any of those on its own Config page, and where it does not, it simply inherits the group’s value. Saving a group’s policy bumps the configuration version of every member agent, so a group-level change bulk-applies the next time each one polls, without visiting machines one at a time.
The Fleet table
Each row shows a machine’s hostname, its group, when it last checked in, whether it is enrolled and allow-listed, whether its held configuration matches the server’s current one — flagged as a pending push when it does not — certificate expiry, its assigned credential username, and its licence seat status. A workgroup badge marks an agent whose hostname is self-asserted rather than verified against Active Directory, and a duplicate-name warning appears when more than one active agent shares a hostname, so the two can be told apart before a credential is assigned to either — see agent identity and mutual TLS for what that badge actually means. Every table in the console, Fleet included, supports a per-column filter row and paging.
Agent details
Clicking a hostname opens that machine’s own page: its record (hostname, group, enrolment state, last-seen time, certificate thumbprint and expiry), its effective policy with each row marked override or inherited, its credential metadata, and its command history. Two admin-only actions live here as well — resetting or revealing the credential — each writing to the credential audit trail covered on credential storage and rotation. A Forget agent action under Danger zone hard-deletes the agent’s row along with its configuration, credential, command history and diagnostic logs, and removes it from the allow-list immediately; the credential audit trail is deliberately kept even after the agent itself is gone.
Groups
A group lists its members and carries the policy defaults described above. Creating or editing one changes those defaults, and every member without its own override picks up the change on its next poll — a schedule or rotation cadence set at group level therefore reaches the whole group in one edit rather than one machine at a time.
Commands
Most of what an admin does is declarative, but seven actions are genuinely imperative and move through a queue instead: rotating the auto-logon credential, applying a server-generated local password, forcing a logoff, forcing a logon right now, making the agent re-fetch its configuration immediately, re-enrolling the agent for a fresh certificate, and prompting the agent to update itself. Each command moves from queued to acknowledged as the agent picks it up and reports whether it succeeded, and the Commands page is a fleet-wide record of what was commanded, by whom, when, and with what outcome.
Limits
A pending push means an agent has not polled since the last change, not that anything is broken. Confirm the agent service is running and reaching the server before assuming a stuck configuration is a fault rather than an agent that simply has not checked in yet.
Forgetting an agent is immediate and cannot be undone from the console. Its allow-list entry, configuration, credential and logs are gone at once; only the credential audit trail survives, kept specifically so a later question about “who had access to this credential” can still be answered after the machine itself is removed.
A duplicate-hostname warning is informational, not a block. Autologon Manager will not silently merge or overwrite either machine — the warning exists so an admin notices and chooses which row is which before assigning a credential to the wrong one.