Enrollment Tokens

Troubleshooting for Enrollment tokens
"Required account email must be provided when Management is PersonalUsageDisallowed"
Pick a Required Account Email, or use PersonalUsageDisallowedUserless.
Management and Required Account Email are crossed out
They require a Domain-Managed Enterprise. Upgrade on the Enterprise page; the selectable emails are the accounts of the bound domain.
The device shows "Wrong account" during setup
The token has a Required Account Email and someone signed in with a different account. Sign in with exactly the required address.
The token no longer enrolls devices
Check the card: an Expired badge means the duration has passed — create a new token. A One Time Only token stops working after its single use.
The device group I want is not in the dropdown, but an initial_ name is
That group has an initial setup group, and tokens for it are created through the 
initial_... entry. Enrolled devices move to the actual group automatically once setup finishes — see the Device Groups manual.