Key rotation

Your organisation has one Cloud Proxy key. On the MDM path it is embedded in the .mobileconfig profile you deploy to managed devices. This runbook covers replacing it.

Self-install devices are not affected by this runbook. They hold their own per-device credentials from the sign-in flow, not the org token.

When to rotate

• Suspected leak. The token was committed to a repo, posted in chat, or otherwise exposed.
• Personnel change. Someone who handled the token has left, and your policy treats that as exposure.
• Periodic policy. Your compliance posture calls for rotation on a schedule.
• Expiry. The token embedded in a profile has a validity window. Generate and redeploy a fresh profile before it lapses.

What rotating does

Generating a new MDM profile from Settings → AI → Cloud Proxy embeds a token with a fresh validity window. While your organisation's current credential remains active, previously deployed profiles keep working: the new profile carries the same underlying credential, so you can redeploy at your own pace.

That also means regenerating a profile does not, by itself, invalidate a leaked token. The leaked token stays valid until it expires or the credential is revoked. Revocation is immediate and fleet-wide: every device still carrying the revoked credential stops authenticating. Revocation is not self-serve in Settings; contact Flowstate support.

Routine rotation (expiry or periodic policy)

1. Open Settings → AI → Cloud Proxy.
2. Click Generate MDM profile. The new .mobileconfig downloads with the token embedded, and the token is revealed once next to the download. Copy it only if any devices are configured by hand.
3. Redeploy the new profile through your MDM, replacing the old one.
4. Confirm agents report. Open Insights → Agent insights → Agent sessions (/plan/main/insights/agents/sessions) and check that sessions from redeployed devices keep arriving.
5. Retire the old profile from your MDM once the fleet has the new one.

Emergency rotation (suspected leak)

1. Contact Flowstate support to revoke the compromised credential. Expect a reporting gap: managed devices stop authenticating from the moment of revocation until they receive the new profile.
2. Once the old credential is revoked, generate a new MDM profile from Settings → AI → Cloud Proxy. It embeds a fresh credential.
3. Redeploy the new profile through your MDM promptly.
4. Confirm agents report again in Insights → Agent insights → Agent sessions, then retire the old profile from your MDM.

Confirm success

Sessions keep flowing in Insights → Agent insights → Agent sessions for the devices you redeployed. A device that stops reporting after rotation is usually still carrying the old profile; check that your MDM delivered the new one to that cohort.