# Machines

> See, approve, rename, share and remove the devices in your network, and control how long they stay signed in.

The dashboard's **Machines** page lists every device in your workspace with its address, name, operating system, owner and status. Search by name, address, OS or tag, filter by status (Connected, Offline, Needs approval, Signed out, Key expired), last seen, OS, tag or ephemeral, and **Export CSV**.

Open a machine for its details: address, full name, hostname, OS, app version, WireGuard public key, owner, type (ephemeral or persistent), when it was added and last seen, its connections, endpoints and tags.

## Rename a machine

Use **Edit machine name…** in the row menu, or **Rename** on the machine's page. The name is also its [easy name](/features/easy-names): lowercase letters, numbers and dashes, unique in the workspace. Other characters are converted.

## Remove a machine

**Remove…** takes it out of your network right away. To add it back, it has to join again.

## Device approval

With **Device approval** on (in **Settings**), new machines joining with an [auth key](/manage/auth-keys) wait for an owner or admin before they can reach anything. They show as **Needs approval**; approve them from the row menu or the machine's page.

- Keys created as **pre-approved** skip it.
- Machines added by someone signing in through the browser are approved by that person when they connect them.

## Key expiry

Machines sign in again after a while, so a lost or retired device stops working on its own.

- The workspace default is **180 days**. Change it in **Settings** to 1 to 365 days, or turn expiry off.
- A new length applies at each machine's next sign-in. Turning expiry off or on applies to every machine at once.
- On a machine's page, owners and admins can **Disable expiry**, **Enable expiry**, or **Expire now**.
- [Tagged](/manage/auth-keys#tags) machines never expire.
- Machines within 14 days of expiring are flagged in the list.

An expired machine keeps its name and address. Run `underpass up` on it to sign in again.

## Owner

A machine is owned by the person who added it. Owners and admins can **Change owner** on untagged machines, or set it to nobody. [Access rules](/features/access-controls) using `user:` and `group:` match machines by owner.

## Tags

Tags come from the auth key a machine joined with, like `tag:prod`. A tagged machine belongs to the workspace rather than a person, and never expires. To change a machine's tags, add it again with a different key.

## Labels

Machines on Linux inside Windows show **WSL**, and machines in Docker or Podman show **Container**.

## Share a machine

Owners and admins can **Share…** a machine with someone outside the workspace, by email or with a link. Each invite works once, within 7 days, up to 50 per machine. The person can connect to the shared machine; it can't reach their devices.

Machines shared with you appear under **Shared with you**.

## Who can do what

| Action | Who |
|---|---|
| Rename, remove | Any member |
| Approve, change owner, key expiry, share | Owners and admins |

## Network health

The **Health** page shows how many machines are online, how many connections are direct, the median latency, and anything that needs attention.