SkieWhat is the per-device key and what is it used for?
Each managed device has its own key and identity, tied to its IMEI, serial and enrolment ID. The device uses its key to sign what it reports, so the dashboard can trust that a status came from that device. It is separate from the signed policies that go the other way.
Signed policy bundles protect the direction from dashboard to device. The per-device key protects the other direction, from device to dashboard. Without it, a report that says 'all protections on' could in principle be made up.
When a device is provisioned, it is given its own identity and key. The one-time enrolment token binds one device to one student and group. From then on the device signs what it sends, including compliance results and presence. The server checks the signature against that device's key.
Identity is recorded by IMEI, serial and enrolment ID, which is why a device that has been reset and set up again is recognised and does not take a second seat. One student has one device, and one device uses one seat.
For admins, the practical effect is trust in the numbers. A compliance score reflects what that device actually read back from Android. A last seen time is a presence report from that device. The breach centre lists what each device sent, and a missing check-in counts as a breach in its own right.
Practical tip: when a tablet is replaced, use the Replace a device action, which keeps the student, group and history and frees the old seat. The new device gets its own key, and the old one stops being trusted.