...
The system currently requires the re-validation once per year. Users which were not re-validated within the last 47 weeks are shown in yellow; users which were not re-validated within the last 50 weeks are displayed in red.
End-User Enrollment
Upon visiting the invitation link, there is only a single download button along with basic instructions. The operating system is auto-detected. When redeeming the invitation token that you sent your users they will see:
The installation program is a CAT installer like usual, with the addition of a client certificate which is protected by the import password that is displayed on the screen. The addition of the import password provides a basic safeguard against credential sharing. Other safeguards (which could replace this UI-intensive step) such as maximum amount of MAC addresses are under consideration. Please report how well the import password method works for your users.
Installer visibility on the user download page
...