Admin sign-in, tenants, and enrollment keys

For MSP admins: how sign-in and tenants work, and how fleet and one-off enrollment keys behave.

Sign in

SnitchOS is Microsoft 365 (Entra ID) or Google SSO only, no local passwords. Sign in at app.snitchos.com/login with the Microsoft 365 or Google account whose email exactly matches your seat. Gmail and Google Workspace accounts work; personal Outlook, Hotmail, Yahoo and iCloud addresses are not supported. Admins provision first, and a matching account links itself the first time you sign in.

Two seat types: admins see every tenant, managers only granted ones. Every login logs sign-in metadata (name, ID, IP, user agent).

Create a tenant

  1. Sign in → top nav → Tenants.
  2. Fill in name + slug, click Create tenant.

Every row, object-store key, and API call is tenant-scoped, isolation enforced at database and storage layers.

Enrollment keys

Presented at install, two workflows:

Fleet keys for RMM deployment

  • The first RMM-installer download creates a reusable fleet key in the wrapper.
  • Normal downloads reuse the current key; RMM jobs keep working.
  • Use Rotate & download, or revoke, to invalidate the wrapper.

One-off keys (bench machines, demos, manual installs)

  • Tenant overview → Enrollment keys → label it (e.g. bench-machine), set max uses = 1, a short expiry, click Mint key.
  • Plaintext shown once. Treat it like a password, never paste into tickets, chat, or committed scripts.

Revoking

Revoke a key any time; enrolled agents keep their own device token, unaffected. Rotate or revoke the fleet key after exposure or an admin departure.

Admin offboarding

Deactivate the account when someone leaves, blocks sign-ins immediately; the audit log records who and when.