The agent starts enrollment by connecting to the Red Hat Edge Manager service at the enrollment endpoint defined in the configuration file.

On devices that use first-boot onboarding, onsite personnel can configure hostname, labels, and network settings in the Cockpit onboarding wizard before the agent enrolls. See Device onboarding at first boot in the Additional resources section.

After establishing a secure, mutual TLS (mTLS)-protected network connection with the service, the agent submits an enrollment request to the service.

The request includes a description of the device hardware and operating system, an X.509 certificate signing request, the cryptographic identity of the device, and agent-proposed labels.

An authorized user must approve the enrollment request in the Red Hat Edge Manager web console or by using the Flight Control CLI. You can also configure enrollment approval policies that auto-approve requests matching specific conditions, such as device labels or region. After approval, the Red Hat Edge Manager service trusts and manages the device.