Clarification on dm token flow

[Phoebe Gong]

Hi,

We are working on integrating the Chrome OS reporting system with our custom backend. Wanted to clarify our understanding of how the DM tokens are set.

Specifically, is it true that the DM token is set upon device enrollment, and it's impossible to change it without resetting TPM / unenrolling the device and triggering another enrollment flow? In our use cases, we need to configure the report queue to use a different token than the DM token stored during enrollment. In this case, is it correct for us to modify DMTokenRetrieverProvider::GetDMTokenRetrieverForEventType to return our custom retriever (which in turn returns our custom token)? If not, what would you recommend that we do?

Thanks in advance!

Phoebe