Bundles are per organization
Every organization has its own installer bundle. The bundle carries an enrolment token scoped to that organization, so an agent installed from it can only ever enrol there. Providers therefore hand each customer their own bundle and never share one across tenants.
Bundles are generated in Settings › Agents. Regenerating a bundle rotates its enrolment token; agents already enrolled are unaffected because they hold their own credential.
Enrolment
At first connect the agent presents the enrolment token once. XenXDR verifies it, issues the agent its own credential and a server-generated fleet identifier, and records the enrolment in the audit trail. The token is never used again by that agent.
If a token leaks, regenerate the bundle. Agents that enrolled with the old token keep working; new enrolments with the old token are refused.
Fleet groups and policy
Settings › Fleet lets you define fleet groups per organization and assign hosts to them. A fleet policy sets:
- which telemetry the host collects;
- the required security tools checklist used by Security Tool Availability;
- whether an uninstall token is required;
- the update channel.
Policy changes are pushed to agents at their next check-in.
Uninstall tokens
When the policy requires it, uninstall.ps1 and uninstall.sh refuse to run without a token minted in the console for that host. Removing the agent then always goes through the console. The token is single-use and recorded in the audit trail.