You must first enroll a Symantec Endpoint Protection Manager domain before you can view or manage it in the cloud console. You enroll these domains through the Symantec Endpoint Protection Manager Home page. If you have an existing Symantec cloud account, you also use information from the cloud console, through Endpoint > Integration > Enrollment.
Enrollment with the cloud console installs the Symantec Endpoint Protection Manager Bridge service using an .MSI file. Before you begin enrollment, put Application and Device Control into Test (log only) mode and System Lockdown into log-only mode. This situation applies only if such policies apply to the server on which Symantec Endpoint Protection Manager runs, and the policies block .MSI installation.
In Symantec Endpoint Protection Manager, paste the enrollment token into the specified area in the Cloud page.
You get a confirmation message.
You can press Launch in the Symantec Endpoint Protection Manager Home page banner to log on to the cloud console.
After you complete the enrollment
After enrollment, all of your devices appear in the cloud console. Devices are the client computers that your clients run on. By default, the Symantec Endpoint Protection Manager manages the topology. To manage groups and devices from the cloud console, turn on Manage Devices from the Cloud only for the logged-on domain. To manage cloud-based policies, turn on Manage Policies from the Cloud. You enable these options in the cloud console in Endpoint > Integration > Enrollment.
You should keep Manage Devices from the Cloud disabled if you use Active Directory or third-party APIs to manage your devices.
Whenever you make a change to the device group structure, there is a 10-minute delay before the change appears in Symantec Endpoint Protection Manager. The reverse is also true. The behavior is similar to how Symantec Endpoint Protection Manager replication functions. During the delay, you should not try to make additional topology changes. The changes might not take effect.