Overview
Agent Approval Queue lets you review and approve new agents before they join your active fleet. Instead of every newly registered device becoming part of your account immediately, you can hold new agents in a staging queue and decide whether to approve or reject each one. This is especially useful for filtering out devices created by antivirus or EDR tools that scan your installer in a sandboxed environment. The feature is opt-in and off by default, available on RMM for MSP and IT department accounts.
What you can do
- Hold newly registered agents in a staging queue instead of adding them straight to your active fleet
- Review each pending device's name, IP address, site, and registration time before deciding
- Approve a device to add it to your active fleet, or reject it to uninstall it from the endpoint
- Get an in-app notification whenever a new device is waiting for review
- Approve or reject multiple devices at once
- Turn the queue off temporarily during planned bulk rollouts, then turn it back on
Before you begin
Important: An Admin role is required to enable the toggle, view the queue, or approve/reject devices. No specific agent version is required.
Getting started
- Go to Admin > My Account > Account Settings > Agents
- Find the Agent Approval Queue toggle (off by default) and turn it on
- From this point, any newly registered agent enters the approval queue instead of joining your active fleet automatically
- When a new device registers, you'll get an in-app notification with the device name and the customer/site it registered under
- Open the queue and review each device's name, IP address, site, and registration time. Approve or reject individually, or select multiple devices to act on them in bulk
What happens if you reject a device
| Device state | What happens if you reject | What happens next |
|---|---|---|
| Online | Uninstall command sent immediately | Device is removed from the queue and the endpoint |
| Offline, reconnects within 1 month | Uninstall command queued | If it reconnects while the queue is on, it re-enters the queue for review |
| Offline, never reconnects | Uninstall command queued but never runs | Device automatically drops out of the queue after 1 month |
What happens if you approve a device
Approved devices join your active fleet right away and are included in policies, reports, and automation profiles from that point on.
Why unfamiliar devices show up
A common cause of unrecognized devices is antivirus or EDR software (such as Microsoft Defender, CrowdStrike, or BitDefender) running your Atera installer inside a sandboxed virtual machine to scan it for threats. When this happens, the agent briefly registers and then the sandbox is destroyed. With the Agent Approval Queue turned on, these devices land in the queue instead of your active fleet, so they don't affect your policies, reports, or billing.
If this keeps happening, ask your security team to add an exception for the Atera agent installer in your antivirus or EDR tool. This stops the tool from scanning the installer in a sandbox in the first place. The exact steps depend on which security product you're using.
Audit trail
Every action taken through the Agent Approval Queue - enabling or disabling the toggle, approving a device, or rejecting a device - is logged with the admin's identity and a timestamp, so you have a full record of who approved or rejected what, and when.
Good to know
- Turning the queue on only affects agents that register afterward. Devices already in your active fleet are not affected.
- If you turn the queue off, agents that register during that time join your active fleet directly, just as before. They won't be retroactively queued if you turn the toggle back on later.
- Pending devices in the queue have no access to your account data - no policies, reports, automation profiles, monitoring, or credentials - until you approve them.
- Only admins can enable the toggle, view the queue, or approve/reject devices. Non-admin users aren't affected and don't see the queue.
- Auto-approve rules (for trusted sites or IP ranges) aren't available yet - every pending device currently requires manual review.
Warning: If devices are sitting in the queue when you turn the toggle off, they're automatically approved and join the fleet.
Warning: There's no "undo" for an approval. If you approve a device by mistake, you can delete it from the console, but you'll need to run an uninstall command separately if you also want the agent removed from the endpoint.
FAQ
Will my existing devices be affected when I turn the queue on?
No. The approval queue only applies to agents that register after the toggle is enabled. Devices already in your active fleet stay exactly as they are.
What if I need to onboard a large number of devices at once?
Turn the toggle off before your bulk deployment (like a GPO rollout or new site onboarding). Agents that register while it's off join your active fleet directly, as they always have. Once the rollout is done, turn the toggle back on.
What happens to a device I reject if it's offline?
The uninstall command is queued for up to 1 month. If the agent reconnects within that window and the queue is still on, it re-enters the queue for review. If it never reconnects, it clears from the queue automatically after 1 month.
I keep seeing random devices I don't recognize. Where are they coming from?
Most often from an antivirus or EDR tool in your stack running your installer in a sandboxed VM to scan it. The Agent Approval Queue keeps these out of your active fleet. To stop them from appearing in the queue at all, add an exception for the Atera agent installer in your security tool.
Can I set rules to auto-approve devices from trusted sites or IP ranges?
Not yet. Every pending device currently needs manual review. If this would be useful for your setup, let your account team know.
Can devices in the queue access any of my account data?
No. Pending devices are fully isolated. They have no access to policies, reports, automation profiles, monitoring, credentials, or any other account data until you approve them.
What if I accidentally approve a device I shouldn't have?
Delete the device from the console as you normally would. This doesn't automatically uninstall the agent from the endpoint - you'll need to run an uninstall command separately. There's no "undo approve" option currently.
If something doesn't look right
A device appeared in your active fleet even though the queue is on
Check when the agent registered against when you enabled the toggle - agents that registered before the toggle was turned on join the fleet directly and aren't retroactively queued.
You rejected a device but the agent is still installed on the endpoint
If the device was offline at the time of rejection, the uninstall command is queued and runs once it reconnects, within 1 month. If it was online and this is still happening after some time, contact support.
You approved a device but it's not showing in your active fleet
If the device was a temporary sandbox artifact, the agent may no longer be installed on the source system by the time you approved it, so it won't join your fleet. This is expected and can be safely ignored. If you're sure the agent is still installed and it's still not appearing, contact support.
Phantom devices keep reappearing in the queue
This is expected if an antivirus or EDR tool in your stack re-scans the installer periodically. Add an exception for the Atera installer in that tool to stop it from happening.
