A device that registers itself with a profile’s provisioning key, on a profile whose strategy is Allow creating new devices, is created Quarantined. It can log in, but Hermetry drops its data until an administrator activates it. Quarantine keeps a leaked provisioning key from filling your organisation with devices whose data you trust.
What lands in quarantine
| Device | Quarantined? |
|---|---|
| Created by self-provisioning with Allow creating new devices | Yes, unless the profile is set to activate such devices automatically. |
| Created by self-provisioning with Only pre-provisioned devices | No: you created it beforehand. |
| Added with New device, by import, by claim, by a gateway or as a LoRaWAN device | No. |
The automatic activation flag is a provisioning setting of the profile (autoActivate, off by default), set through the profile’s provisioning API. Keep it off unless the provisioning key cannot leak.
LoRaWAN sensors added by pairing mode have their own approval step. See Approving devices added by pairing.
What a quarantined device can do
| Quarantined | |
|---|---|
| Log in | Yes. |
| Telemetry and attributes | Acknowledged and dropped (counted, not stored). |
| Shown in Devices | Yes, with the Quarantined badge: “Waiting for activation: data is not stored. Counts toward your device limit.” |
| Counts toward your device limit | Yes. Activation does not check the limit again. |
| Board cards that read its attributes | Treat it as absent. |
Approve devices
You need the permission Activate quarantined devices (administrators by default).
- Open Devices. When devices are waiting, the header shows Awaiting approval (n).
- Select it. The Quarantine drawer lists the devices waiting (“Devices that provisioned themselves with a profile key wait here until you activate them; their data is dropped until then.”) with their Device name and when they were Created. Use Search devices… to find one.
- Select Activate on one row, or tick several and select Activate selected (n). Up to 100 at a time.
The page says “n device(s) activated.” If some could not be activated (“ok activated, failed not (they may have changed meanwhile).”), refresh and try again.
An activated device’s session ends once, and it reconnects as an active device; its data is stored from then on. Data it sent while quarantined is not kept. Activation is written to the audit log and the device’s Log tab (Device activated).
You can also activate a single device with Activate on its page, or filter the list with Status: Quarantined.
Refuse a device
There is no separate “refuse” action. If you do not recognise a device:
- Delete it (Delete device on its page). Its credential is revoked at once.
- If you think the provisioning key leaked, revoke the key on the profile’s Provisioning tab and create a new one. See Adding and claiming devices.
The nightly report
Nothing is activated or deleted automatically. Instead, each night your administrators are told about devices that have waited longer than a set number of days: “count device(s) provisioned with a profile key have been waiting in quarantine for more than days days. Activate the ones you know; nothing is deleted automatically.”
Set the age in Quarantine settings (address /admin/iot/quarantine/settings, also reached from the quarantine list):
| Setting | Default | Range |
|---|---|---|
| Report quarantined devices after (days) | 7 | 1 to 30 |
Good practice
- Prefer Only pre-provisioned devices for devices sold in volume: a key in firmware can be extracted.
- Give each kind of device its own profile and key, so revoking one key does not touch the others.
- Check Awaiting approval after each installation round, and delete devices you do not recognise.
- Watch your device limit: quarantined devices count.