Skip to main content

Give people Edge access: enrollment, users and network groups

Updated

Edge controls access in three places:

  • Device Enrollment gets a device onto a tenant.
  • Users is your org's roster of who has Edge VPN access.
  • Network Groups controls what enrolled devices can reach, and when.

Enrol devices

Devices join a tenant with an enrollment token. Go to Tenants, click the tenant, then open Device Enrollment (/edge/tenants/<id>/enrollment). Create a token there and give it to the user for The One Edge client app. See Set up your first Edge tenant for the full steps, including Max Uses, expiry, and the one-time token display.

Tips:

  • Create one token per team or batch, and give it a clear label so you can track uses.
  • Delete a token as soon as it's no longer needed.
  • Check the tenant's Peers page for WireGuard keys that have expired or expire within 14 days. An expired key is the most common reason a device quietly stops connecting.

Manage who has Edge access

  1. Go to Edge → Users (/edge/users). The page is titled Users & Access.
  2. Click Add user.
  3. Enter a User ID or email (required). You can also add an Email address and a Display name, then complete the remaining fields.
  4. Click Add user.

The roster shows each user's assigned IP, mode, region, and Last VPN:

  • Active: connected in the last 5 minutes
  • Never: has not connected yet

To take someone's access away, click the remove icon on their row (Remove Edge access).

Control what devices can reach: Network Groups

  1. Go to Edge → Network Groups (/edge/groups). Use the tenant filter to see one client's groups.
  2. Click New group. Pick the Tenant, then enter a Group name and, if you like, a description and colour. Choose whether the group has Internet access, then click Create group.
  3. Open the group. It has three tabs:
    • Members: add enrolled devices (peers) from the tenant.
    • Access Policy: decide whether members can reach the public internet through the tunnel. You can also list Allowed CIDRs (destinations members may reach) and Blocked CIDRs (destinations that are always blocked).
    • Schedule: limit access to certain days and hours, in a timezone you choose.
  4. Save each tab (for example, Save policy). Unsaved changes are flagged.

The group list shows each group's tenant, member count and policy. A group without internet access shows No internet.

Allowed and Blocked CIDRs only control which networks a group can reach inside Edge. They don't change how outside services see your traffic, and Edge makes no claim about third-party services.

Related