> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/endpoint-privilege-manager/getting-started/licensing-and-activation.md). # Licensing & Activation Before you can deploy Keeper EPM agents to your endpoints, you need an active Keeper Enterprise license that includes Endpoint Privilege Manager, EPM activated in your Keeper Admin Console, an administrator role with the right permissions, and a registration token for your agents. This page covers each of those prerequisites in order. ## Keeper Enterprise License Keeper EPM is part of **Keeper Enterprise**. To use it, you need: * An active Keeper Enterprise subscription that includes Endpoint Privilege Manager. * Enough **endpoint seats** for the agents you plan to deploy. Activation and seat allocation are managed in the Keeper Admin Console. If you're not sure about your license or EPM entitlement, contact your Keeper account team. If you are not yet a Keeper customer, you can start a free trial from the Keeper website. The free trial includes full KeeperPAM capabilities, including EPM. ### Activate Endpoint Privilege Manager 1. **Log In** to the Keeper Admin Console for your region. 2. **Turn On** Endpoint Privilege Manager for your organization. The exact menu name may appear as "Endpoint Privilege Manager," "Privilege Manager," or similar, depending on your console version. 3. **Confirm Activation** by navigating to the Endpoint Privilege Manager section of the Admin Console. Once activated, you can begin defining approvers, collections, policies, and deployment packages. ### Configure Administrator Permissions Keeper EPM requires an administrator role with permissions that cover end-user privilege management. Without this role, you will not be able to manage collections, policies, deployments, or requests. To grant Privilege Manager permissions: 1. In the Keeper Admin Console, navigate to **Admin > Roles**. 2. Create a new role, or select an existing role to modify. 3. Open the **Administrative Permissions** tab and select **Add Managing Node**. 4. Activate the **Manage Privileged Access** permission. 5. Assign yourself — or a dedicated test administrator account — to this role. You'll need at least one user assigned to a role with Manage Privileged Access before you can proceed to deployment. ### Directory Integration Prerequisite Keeper EPM policies that target user or group collections depend on Active Directory or Microsoft Entra ID sync to function correctly. Specifically, the `epm scim` command — used to sync EPM user and group collections — requires an Active Directory integration to be configured in the Keeper Admin Console before use. If this integration is not configured: * User and group collections will be incomplete. * Policy enforcement targeting those collections will not apply as expected. If your deployment will use user- or group-based policy targeting, configure your AD or Entra ID integration in the Admin Console before defining collections. See the Keeper Admin Console documentation for directory integration setup. ### Get a Registration Token Each Keeper EPM agent registers with your Keeper tenant using a **registration token**. The token is generated as part of a deployment package and ties each registered agent back to a specific collection of endpoints. The token uses the format: ``` hostname:deployment-uid:private-key ``` Registration tokens are sensitive credentials. Treat them as secrets — store and transmit them securely, and rotate them if you suspect a token has been exposed. You'll obtain a registration token when you build your first deployment package. For details on deployment package creation and token retrieval, see *Your First Agent* and *How Deployment Packages, the Agent, & Requests Work Together*. ### Prerequisite Checklist Before moving on to *Your First Agent*, confirm: * Keeper Enterprise license is active and includes EPM seats. * Endpoint Privilege Manager is activated in the Keeper Admin Console. * At least one administrator account has the **Manage Privileged Access** permission. * Active Directory or Entra ID integration is configured (if you plan to use user- or group-based policy targeting). * You know where to retrieve a registration token from the Admin Console when you're ready to build a deployment package. With these prerequisites in place, you're ready to deploy your first agent. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/getting-started/licensing-and-activation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.