diff --git a/cmd/fleetctl/get.go b/cmd/fleetctl/get.go
index 5e6d93a848..2e5f39ad4e 100644
--- a/cmd/fleetctl/get.go
+++ b/cmd/fleetctl/get.go
@@ -127,16 +127,6 @@ func printSecret(c *cli.Context, secret *kolide.EnrollSecretSpec) error {
 		Spec:    secret,
 	}
 
-	if name := c.Args().Get(0); name != "" {
-		for _, s := range secret.Secrets {
-			if s.Name == name {
-				fmt.Println(s.Secret)
-				return nil
-			}
-		}
-		return fmt.Errorf("Secret '%s' not found", name)
-	}
-
 	var err error
 
 	if c.Bool(jsonFlagName) {
diff --git a/cmd/fleetctl/preview.go b/cmd/fleetctl/preview.go
index 58be05c324..2423029a75 100644
--- a/cmd/fleetctl/preview.go
+++ b/cmd/fleetctl/preview.go
@@ -167,7 +167,7 @@ Use the stop and reset subcommands to manage the server and dependencies once st
 				return errors.Wrap(err, "Error retrieving enroll secret")
 			}
 
-			if len(secrets.Secrets) != 1 || !secrets.Secrets[0].Active {
+			if len(secrets.Secrets) != 1 {
 				return errors.New("Expected 1 active enroll secret")
 			}
 
diff --git a/docs/1-Using-Fleet/3-REST-API.md b/docs/1-Using-Fleet/3-REST-API.md
index caf071103b..ee3c8093cd 100644
--- a/docs/1-Using-Fleet/3-REST-API.md
+++ b/docs/1-Using-Fleet/3-REST-API.md
@@ -551,7 +551,6 @@ This is the callback endpoint that the identity provider will use to send securi
       "config_tls_refresh": 10,
       "logger_tls_period": 8,
       "additional": {},
-      "enroll_secret_name": "default",
       "status": "offline",
       "display_text": "2ceca32fe484"
     },
@@ -644,7 +643,6 @@ The endpoint returns the host's installed `software` if the software inventory f
         "config_tls_refresh": 10,
         "logger_tls_period": 10,
         "additional": {},
-        "enroll_secret_name": "bar",
         "status": "offline",
         "display_text": "259404d30eb6",
         "labels": [
@@ -752,7 +750,6 @@ Returns the information of the host specified using the `uuid`, `osquery_host_id
         "config_tls_refresh": 10,
         "logger_tls_period": 10,
         "additional": {},
-        "enroll_secret_name": "bar",
         "status": "offline",
         "display_text": "259404d30eb6"
     }
@@ -1203,7 +1200,6 @@ Returns a list of the hosts that belong to the specified label.
       "config_tls_refresh": 10,
       "logger_tls_period": 10,
       "additional": {},
-      "enroll_secret_name": "default",
       "status": "offline",
       "display_text": "e2e7f8d8983d"
     },
@@ -3904,7 +3900,6 @@ The returned lists are filtered based on the hosts the requesting user has acces
         "config_tls_refresh": 10,
         "logger_tls_period": 10,
         "additional": {},
-        "enroll_secret_name": "default",
         "status": "offline",
         "display_text": "7a2f41482833"
       },
@@ -3942,7 +3937,6 @@ The returned lists are filtered based on the hosts the requesting user has acces
         "config_tls_refresh": 10,
         "logger_tls_period": 10,
         "additional": {},
-        "enroll_secret_name": "default",
         "status": "offline",
         "display_text": "78c96e72746c"
       }
@@ -4190,9 +4184,9 @@ Modifies the Fleet's configuration with the supplied information.
 }
 ```
 
-### Get enroll secret(s)
+### Get global enroll secret(s)
 
-Returns all the enroll secrets used by the Fleet server.
+Returns the valid global enroll secrets.
 
 `GET /api/v1/fleet/spec/enroll_secret`
 
@@ -4213,23 +4207,13 @@ None.
   "specs": {
     "secrets": [
       {
-        "name": "bar",
         "secret": "fTp52/twaxBU6gIi0J6PHp8o5Sm1k1kn",
-        "active": true,
         "created_at": "2021-01-07T19:40:04Z"
       },
       {
-        "name": "default",
-        "secret": "fTp52/twaxBU6gIi0J6PHp8o5Sm1k1kn",
-        "active": true,
+        "secret": "bhD5kiX2J+KBgZSk118qO61ZIdX/v8On",
         "created_at": "2021-01-04T21:18:07Z"
       },
-      {
-        "name": "foo",
-        "secret": "fTp52/twaxBU6gIi0J6PHp8o5Sm1k1kn",
-        "active": true,
-        "created_at": "2021-01-07T19:40:04Z"
-      }
     ]
   }
 }
@@ -4237,17 +4221,15 @@ None.
 
 ### Modify enroll secret(s)
 
-Modifies and/or creates the specified enroll secret(s).
+Replaces the active global enroll secrets with the secrets specified.
 
 `POST /api/v1/fleet/spec/enroll_secret`
 
 #### Parameters
 
-| Name   | Type    | In   | Description                                                                                                  |
-| ------ | ------- | ---- | ------------------------------------------------------------------------------------------------------------ |
-| name   | string  | body | **Required.** The name of the enroll secret                                                                  |
-| secret | string  | body | **Required.** The plain text string used as the enroll secret.                                               |
-| active | boolean | body | Whether or not the enroll secret is active. Must be set to true for hosts to enroll using the enroll secret. |
+| Name   | Type   | In   | Description                                                    |
+| ------ | ------ | ---- | -------------------------------------------------------------- |
+| secret | string | body | **Required.** The plain text string used as the enroll secret. |
 
 #### Example
 
@@ -4258,7 +4240,6 @@ Modifies and/or creates the specified enroll secret(s).
   "spec": {
     "secrets": [
       {
-        "name": "bar",
         "secret": "fTp52/twaxBU6gIi0J6PHp8o5Sm1k1kn",
         "active": false,
       },
diff --git a/frontend/components/config/EnrollSecretTable/EnrollSecretTable.jsx b/frontend/components/config/EnrollSecretTable/EnrollSecretTable.jsx
index 36116d43d0..efd446c2b7 100644
--- a/frontend/components/config/EnrollSecretTable/EnrollSecretTable.jsx
+++ b/frontend/components/config/EnrollSecretTable/EnrollSecretTable.jsx
@@ -14,7 +14,6 @@ const baseClass = "enroll-secrets";
 
 class EnrollSecretRow extends Component {
   static propTypes = {
-    name: PropTypes.string.isRequired,
     secret: PropTypes.string.isRequired,
   };
 
@@ -61,13 +60,11 @@ class EnrollSecretRow extends Component {
   };
 
   renderLabel = () => {
-    const { name } = this.props;
     const { copyMessage } = this.state;
     const { onCopySecret, onToggleSecret } = this;
 
     return (
       <span className={`${baseClass}__name`}>
-        {name}
         <span className="buttons">
           {copyMessage && <span>{`${copyMessage} `}</span>}
           <Button
@@ -125,22 +122,21 @@ class EnrollSecretTable extends Component {
 
   render() {
     const { secrets } = this.props;
-    const activeSecrets = secrets.filter((s) => s.active);
 
     let enrollSecretsClass = baseClass;
-    if (activeSecrets.length === 0) {
+    if (secrets.length === 0) {
       return (
         <div className={baseClass}>
           <em>No active enroll secrets.</em>
         </div>
       );
-    } else if (activeSecrets.length > 1)
+    } else if (secrets.length > 1)
       enrollSecretsClass += ` ${baseClass}--multiple-secrets`;
 
     return (
       <div className={enrollSecretsClass}>
-        {activeSecrets.map(({ name, secret }) => (
-          <EnrollSecretRow key={name} name={name} secret={secret} />
+        {secrets.map(({ secret }) => (
+          <EnrollSecretRow key={secret} secret={secret} />
         ))}
       </div>
     );
diff --git a/frontend/components/config/EnrollSecretTable/EnrollSecretTable.tests.jsx b/frontend/components/config/EnrollSecretTable/EnrollSecretTable.tests.jsx
index e277a85a1f..9eea0cd2aa 100644
--- a/frontend/components/config/EnrollSecretTable/EnrollSecretTable.tests.jsx
+++ b/frontend/components/config/EnrollSecretTable/EnrollSecretTable.tests.jsx
@@ -9,15 +9,15 @@ import EnrollSecretTable, {
 describe("EnrollSecretTable", () => {
   const defaultProps = {
     secrets: [
-      { name: "foo", secret: "foo_secret", active: true },
-      { name: "bar", secret: "bar_secret", active: true },
-      { name: "inactive", secret: "inactive", active: false },
+      { secret: "foo_secret" },
+      { secret: "bar_secret" },
+      { secret: "baz_secret" },
     ],
   };
 
   it("renders properly filtered rows", () => {
     const table = shallow(<EnrollSecretTable {...defaultProps} />);
-    expect(table.find("EnrollSecretRow").length).toEqual(2);
+    expect(table.find("EnrollSecretRow").length).toEqual(3);
   });
 
   it("renders text when empty", () => {
diff --git a/frontend/components/forms/admin/AppConfigForm/AppConfigForm.tests.jsx b/frontend/components/forms/admin/AppConfigForm/AppConfigForm.tests.jsx
index e6e0c03ced..1812b6bd8a 100644
--- a/frontend/components/forms/admin/AppConfigForm/AppConfigForm.tests.jsx
+++ b/frontend/components/forms/admin/AppConfigForm/AppConfigForm.tests.jsx
@@ -11,9 +11,9 @@ describe("AppConfigForm - form", () => {
     handleSubmit: noop,
     smtpConfigured: false,
     enrollSecret: [
-      { name: "foo", secret: "foo_secret", active: true },
-      { name: "bar", secret: "bar_secret", active: true },
-      { name: "inactive", secret: "inactive", active: false },
+      { secret: "foo_secret" },
+      { secret: "bar_secret" },
+      { secret: "baz_secret" },
     ],
   };
   const form = mount(<AppConfigForm {...defaultProps} />);
diff --git a/server/datastore/datastore.go b/server/datastore/datastore.go
index a17a290a10..3b6f7059e7 100644
--- a/server/datastore/datastore.go
+++ b/server/datastore/datastore.go
@@ -15,6 +15,7 @@ var TestFunctions = [...]func(*testing.T, kolide.Datastore){
 	testEnrollSecrets,
 	testEnrollSecretsCaseSensitive,
 	testEnrollSecretRoundtrip,
+	testEnrollSecretUniqueness,
 	testCreateInvite,
 	testInviteByEmail,
 	testInviteByToken,
diff --git a/server/datastore/datastore_app.go b/server/datastore/datastore_app.go
index fe3fc8b484..21ba754362 100644
--- a/server/datastore/datastore_app.go
+++ b/server/datastore/datastore_app.go
@@ -78,55 +78,62 @@ func testAdditionalQueries(t *testing.T, ds kolide.Datastore) {
 }
 
 func testEnrollSecrets(t *testing.T, ds kolide.Datastore) {
-	name, err := ds.VerifyEnrollSecret("missing")
-	assert.Error(t, err)
-	assert.Empty(t, name)
+	team1, err := ds.NewTeam(&kolide.Team{Name: "team1"})
+	require.NoError(t, err)
 
-	err = ds.ApplyEnrollSecretSpec(
-		&kolide.EnrollSecretSpec{
-			Secrets: []kolide.EnrollSecret{
-				kolide.EnrollSecret{Name: "one", Secret: "one_secret", Active: true},
-				kolide.EnrollSecret{Name: "two", Secret: "two_secret", Active: false},
-			},
+	secret, err := ds.VerifyEnrollSecret("missing")
+	assert.Error(t, err)
+	assert.Nil(t, secret)
+
+	err = ds.ApplyEnrollSecrets(&team1.ID,
+		[]*kolide.EnrollSecret{
+			{Secret: "one_secret", TeamID: &team1.ID},
 		},
 	)
 	assert.NoError(t, err)
 
-	name, err = ds.VerifyEnrollSecret("one")
+	secret, err = ds.VerifyEnrollSecret("one")
 	assert.Error(t, err, "secret should not match")
-	assert.Empty(t, name, "secret name should be empty")
-	name, err = ds.VerifyEnrollSecret("one_secret")
+	assert.Nil(t, secret, "secret should be nil")
+	secret, err = ds.VerifyEnrollSecret("one_secret")
 	assert.NoError(t, err)
-	assert.Equal(t, "one", name)
-	name, err = ds.VerifyEnrollSecret("two_secret")
+	assert.Equal(t, &team1.ID, secret.TeamID)
+	secret, err = ds.VerifyEnrollSecret("two_secret")
 	assert.Error(t, err)
-	assert.Equal(t, "", name)
+	assert.Nil(t, secret)
 
-	err = ds.ApplyEnrollSecretSpec(
-		&kolide.EnrollSecretSpec{
-			Secrets: []kolide.EnrollSecret{
-				kolide.EnrollSecret{Name: "one", Secret: "one_secret", Active: false},
-				kolide.EnrollSecret{Name: "two", Secret: "two_secret", Active: true},
-			},
+	// Add global secret
+	err = ds.ApplyEnrollSecrets(
+		nil,
+		[]*kolide.EnrollSecret{
+			{Secret: "two_secret"},
 		},
 	)
 	assert.NoError(t, err)
 
-	name, err = ds.VerifyEnrollSecret("one_secret")
-	assert.Error(t, err)
-	assert.Equal(t, "", name)
-	name, err = ds.VerifyEnrollSecret("two_secret")
+	secret, err = ds.VerifyEnrollSecret("one_secret")
 	assert.NoError(t, err)
-	assert.Equal(t, "two", name)
+	assert.Equal(t, &team1.ID, secret.TeamID)
+	secret, err = ds.VerifyEnrollSecret("two_secret")
+	assert.NoError(t, err)
+	assert.Equal(t, (*uint)(nil), secret.TeamID)
+
+	// Remove team secret
+	err = ds.ApplyEnrollSecrets(&team1.ID, []*kolide.EnrollSecret{})
+	assert.NoError(t, err)
+	secret, err = ds.VerifyEnrollSecret("one_secret")
+	assert.Error(t, err)
+	assert.Nil(t, secret)
+	secret, err = ds.VerifyEnrollSecret("two_secret")
+	assert.NoError(t, err)
+	assert.Equal(t, (*uint)(nil), secret.TeamID)
 }
 
 func testEnrollSecretsCaseSensitive(t *testing.T, ds kolide.Datastore) {
-	err := ds.ApplyEnrollSecretSpec(
-		&kolide.EnrollSecretSpec{
-			Secrets: []kolide.EnrollSecret{
-				kolide.EnrollSecret{Name: "one", Secret: "one_secret", Active: true},
-				kolide.EnrollSecret{Name: "two", Secret: "two_secret", Active: false},
-			},
+	err := ds.ApplyEnrollSecrets(
+		nil,
+		[]*kolide.EnrollSecret{
+			{Secret: "one_secret"},
 		},
 	)
 	require.NoError(t, err)
@@ -138,30 +145,55 @@ func testEnrollSecretsCaseSensitive(t *testing.T, ds kolide.Datastore) {
 }
 
 func testEnrollSecretRoundtrip(t *testing.T, ds kolide.Datastore) {
-	spec, err := ds.GetEnrollSecretSpec()
+	team1, err := ds.NewTeam(&kolide.Team{Name: "team1"})
 	require.NoError(t, err)
-	assert.Len(t, spec.Secrets, 0)
 
-	expectedSpec := kolide.EnrollSecretSpec{
-		Secrets: []kolide.EnrollSecret{
-			kolide.EnrollSecret{Name: "one", Secret: "one_secret", Active: false},
-			kolide.EnrollSecret{Name: "two", Secret: "two_secret", Active: true},
-		},
+	secrets, err := ds.GetEnrollSecrets(nil)
+	require.NoError(t, err)
+	assert.Len(t, secrets, 0)
+
+	secrets, err = ds.GetEnrollSecrets(&team1.ID)
+	require.NoError(t, err)
+	assert.Len(t, secrets, 0)
+
+	expectedSecrets := []*kolide.EnrollSecret{
+		{Secret: "one_secret"},
+		{Secret: "two_secret"},
 	}
-	err = ds.ApplyEnrollSecretSpec(&expectedSpec)
+	err = ds.ApplyEnrollSecrets(&team1.ID, expectedSecrets)
 	require.NoError(t, err)
 
-	spec, err = ds.GetEnrollSecretSpec()
+	secrets, err = ds.GetEnrollSecrets(&team1.ID)
 	require.NoError(t, err)
-	require.Len(t, spec.Secrets, 2)
+	require.Len(t, secrets, 2)
 	// sort secrets before equality checks to ensure proper order
-	sort.Slice(spec.Secrets, func(i, j int) bool { return spec.Secrets[i].Name < spec.Secrets[j].Name })
+	sort.Slice(secrets, func(i, j int) bool { return secrets[i].Secret < secrets[j].Secret })
 
-	assert.Equal(t, "one", spec.Secrets[0].Name)
-	assert.Equal(t, "one_secret", spec.Secrets[0].Secret)
-	assert.Equal(t, false, spec.Secrets[0].Active)
+	assert.Equal(t, "one_secret", secrets[0].Secret)
+	assert.Equal(t, "two_secret", secrets[1].Secret)
+
+	expectedSecrets[0].Secret += "_global"
+	expectedSecrets[1].Secret += "_global"
+	err = ds.ApplyEnrollSecrets(nil, expectedSecrets)
+	require.NoError(t, err)
+
+	secrets, err = ds.GetEnrollSecrets(nil)
+	require.NoError(t, err)
+	require.Len(t, secrets, 2)
 
-	assert.Equal(t, "two", spec.Secrets[1].Name)
-	assert.Equal(t, "two_secret", spec.Secrets[1].Secret)
-	assert.Equal(t, true, spec.Secrets[1].Active)
+}
+
+func testEnrollSecretUniqueness(t *testing.T, ds kolide.Datastore) {
+	team1, err := ds.NewTeam(&kolide.Team{Name: "team1"})
+	require.NoError(t, err)
+
+	expectedSecrets := []*kolide.EnrollSecret{
+		{Secret: "one_secret"},
+	}
+	err = ds.ApplyEnrollSecrets(&team1.ID, expectedSecrets)
+	require.NoError(t, err)
+
+	// Same secret at global level should not be allowed
+	err = ds.ApplyEnrollSecrets(nil, expectedSecrets)
+	require.Error(t, err)
 }
diff --git a/server/datastore/datastore_hosts.go b/server/datastore/datastore_hosts.go
index 1e652e99fe..00328d5a84 100644
--- a/server/datastore/datastore_hosts.go
+++ b/server/datastore/datastore_hosts.go
@@ -413,21 +413,23 @@ func testListHostsQuery(t *testing.T, ds kolide.Datastore) {
 
 func testEnrollHost(t *testing.T, ds kolide.Datastore) {
 	test.AddAllHostsLabel(t, ds)
-	enrollSecretName := "default"
+
+	team, err := ds.NewTeam(&kolide.Team{Name: "team1"})
+	require.NoError(t, err)
+
 	for _, tt := range enrollTests {
-		h, err := ds.EnrollHost(tt.uuid, tt.nodeKey, enrollSecretName, 0)
+		h, err := ds.EnrollHost(tt.uuid, tt.nodeKey, &team.ID, 0)
 		require.Nil(t, err)
 
 		assert.Equal(t, tt.uuid, h.OsqueryHostID)
 		assert.Equal(t, tt.nodeKey, h.NodeKey)
-		assert.Equal(t, enrollSecretName, h.EnrollSecretName)
 
 		// This host should be allowed to re-enroll immediately if cooldown is disabled
-		_, err = ds.EnrollHost(tt.uuid, tt.nodeKey+"new", enrollSecretName+"new", 0)
+		_, err = ds.EnrollHost(tt.uuid, tt.nodeKey+"new", nil, 0)
 		require.NoError(t, err)
 
 		// This host should not be allowed to re-enroll immediately if cooldown is enabled
-		_, err = ds.EnrollHost(tt.uuid, tt.nodeKey+"new", enrollSecretName+"new", 10*time.Second)
+		_, err = ds.EnrollHost(tt.uuid, tt.nodeKey+"new", nil, 10*time.Second)
 		require.Error(t, err)
 	}
 }
@@ -435,25 +437,25 @@ func testEnrollHost(t *testing.T, ds kolide.Datastore) {
 func testAuthenticateHost(t *testing.T, ds kolide.Datastore) {
 	test.AddAllHostsLabel(t, ds)
 	for _, tt := range enrollTests {
-		h, err := ds.EnrollHost(tt.uuid, tt.nodeKey, "default", 0)
+		h, err := ds.EnrollHost(tt.uuid, tt.nodeKey, nil, 0)
 		require.Nil(t, err)
 
 		returned, err := ds.AuthenticateHost(h.NodeKey)
-		require.Nil(t, err)
+		require.NoError(t, err)
 		assert.Equal(t, h.NodeKey, returned.NodeKey)
 	}
 
 	_, err := ds.AuthenticateHost("7B1A9DC9-B042-489F-8D5A-EEC2412C95AA")
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 
 	_, err = ds.AuthenticateHost("")
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }
 
 func testAuthenticateHostCaseSensitive(t *testing.T, ds kolide.Datastore) {
 	test.AddAllHostsLabel(t, ds)
 	for _, tt := range enrollTests {
-		h, err := ds.EnrollHost(tt.uuid, tt.nodeKey, "default", 0)
+		h, err := ds.EnrollHost(tt.uuid, tt.nodeKey, nil, 0)
 		require.Nil(t, err)
 
 		_, err = ds.AuthenticateHost(strings.ToUpper(h.NodeKey))
diff --git a/server/datastore/datastore_labels.go b/server/datastore/datastore_labels.go
index 9b7776a0a8..43eead06c7 100644
--- a/server/datastore/datastore_labels.go
+++ b/server/datastore/datastore_labels.go
@@ -20,7 +20,7 @@ func testLabels(t *testing.T, db kolide.Datastore) {
 	var host *kolide.Host
 	var err error
 	for i := 0; i < 10; i++ {
-		host, err = db.EnrollHost(fmt.Sprint(i), fmt.Sprint(i), "default", 0)
+		host, err = db.EnrollHost(fmt.Sprint(i), fmt.Sprint(i), nil, 0)
 		require.Nil(t, err, "enrollment should succeed")
 		hosts = append(hosts, *host)
 	}
diff --git a/server/datastore/datastore_targets.go b/server/datastore/datastore_targets.go
index 33e590f6cb..19704eb9cb 100644
--- a/server/datastore/datastore_targets.go
+++ b/server/datastore/datastore_targets.go
@@ -168,7 +168,7 @@ func testHostStatus(t *testing.T, ds kolide.Datastore) {
 
 	mockClock := clock.NewMockClock()
 
-	h, err := ds.EnrollHost("1", "key1", "default", 0)
+	h, err := ds.EnrollHost("1", "key1", nil, 0)
 	require.Nil(t, err)
 
 	user := &kolide.User{GlobalRole: ptr.String(kolide.RoleAdmin)}
diff --git a/server/datastore/inmem/hosts.go b/server/datastore/inmem/hosts.go
index 528d86e45a..21783c3fb4 100644
--- a/server/datastore/inmem/hosts.go
+++ b/server/datastore/inmem/hosts.go
@@ -155,7 +155,7 @@ func (d *Datastore) GenerateHostStatusStatistics(now time.Time) (online, offline
 	return online, offline, mia, new, nil
 }
 
-func (d *Datastore) EnrollHost(osQueryHostID, nodeKey, secretName string, cooldown time.Duration) (*kolide.Host, error) {
+func (d *Datastore) EnrollHost(osQueryHostID, nodeKey string, teamID *uint, cooldown time.Duration) (*kolide.Host, error) {
 	d.mtx.Lock()
 	defer d.mtx.Unlock()
 
diff --git a/server/datastore/mysql/app_configs.go b/server/datastore/mysql/app_configs.go
index 3b64544898..35dbbb2a50 100644
--- a/server/datastore/mysql/app_configs.go
+++ b/server/datastore/mysql/app_configs.go
@@ -189,30 +189,36 @@ func (d *Datastore) SaveAppConfig(info *kolide.AppConfig) error {
 	return err
 }
 
-func (d *Datastore) VerifyEnrollSecret(secret string) (string, error) {
+func (d *Datastore) VerifyEnrollSecret(secret string) (*kolide.EnrollSecret, error) {
 	var s kolide.EnrollSecret
-	err := d.db.Get(&s, "SELECT name, active FROM enroll_secrets WHERE secret = ?", secret)
+	err := d.db.Get(&s, "SELECT team_id FROM enroll_secrets WHERE secret = ?", secret)
 	if err != nil {
-		return "", errors.New("no matching secret found")
-	}
-	if !s.Active {
-		return "", errors.New("secret is inactive")
+		return nil, errors.New("no matching secret found")
 	}
 
-	return s.Name, nil
+	return &s, nil
 }
 
-func (d *Datastore) ApplyEnrollSecretSpec(spec *kolide.EnrollSecretSpec) error {
+func (d *Datastore) ApplyEnrollSecrets(teamID *uint, secrets []*kolide.EnrollSecret) error {
 	err := d.withRetryTxx(func(tx *sqlx.Tx) error {
-		for _, secret := range spec.Secrets {
+		if teamID != nil {
+			sql := `DELETE FROM enroll_secrets WHERE team_id = ?`
+			if _, err := tx.Exec(sql, teamID); err != nil {
+				return errors.Wrap(err, "clear before insert")
+			}
+		} else {
+			sql := `DELETE FROM enroll_secrets WHERE team_id IS NULL`
+			if _, err := tx.Exec(sql); err != nil {
+				return errors.Wrap(err, "clear before insert")
+			}
+		}
+
+		for _, secret := range secrets {
 			sql := `
-				INSERT INTO enroll_secrets (name, secret, active)
-				VALUES (?, ?, ?)
-				ON DUPLICATE KEY UPDATE
-					secret = VALUES(secret),
-					active = VALUES(active)
+				INSERT INTO enroll_secrets (secret, team_id)
+				VALUES ( ?, ? )
 			`
-			if _, err := tx.Exec(sql, secret.Name, secret.Secret, secret.Active); err != nil {
+			if _, err := tx.Exec(sql, secret.Secret, teamID); err != nil {
 				return errors.Wrap(err, "upsert secret")
 			}
 		}
@@ -222,11 +228,19 @@ func (d *Datastore) ApplyEnrollSecretSpec(spec *kolide.EnrollSecretSpec) error {
 	return err
 }
 
-func (d *Datastore) GetEnrollSecretSpec() (*kolide.EnrollSecretSpec, error) {
-	var spec kolide.EnrollSecretSpec
-	sql := `SELECT * FROM enroll_secrets`
-	if err := d.db.Select(&spec.Secrets, sql); err != nil {
+func (d *Datastore) GetEnrollSecrets(teamID *uint) ([]*kolide.EnrollSecret, error) {
+	var args []interface{}
+	sql := "SELECT * FROM enroll_secrets WHERE "
+	// MySQL requires comparing NULL with IS. NULL = NULL evaluates to FALSE.
+	if teamID == nil {
+		sql += "team_id IS NULL"
+	} else {
+		sql += "team_id = ?"
+		args = append(args, teamID)
+	}
+	var secrets []*kolide.EnrollSecret
+	if err := d.db.Select(&secrets, sql, args...); err != nil {
 		return nil, errors.Wrap(err, "get secrets")
 	}
-	return &spec, nil
+	return secrets, nil
 }
diff --git a/server/datastore/mysql/hosts.go b/server/datastore/mysql/hosts.go
index 7b5b1ee7be..f35c6a5ca8 100644
--- a/server/datastore/mysql/hosts.go
+++ b/server/datastore/mysql/hosts.go
@@ -89,7 +89,7 @@ func (d *Datastore) SaveHost(host *kolide.Host) error {
 			config_tls_refresh = ?,
 			logger_tls_period = ?,
 			additional = COALESCE(?, additional),
-			enroll_secret_name = ?,
+			team_id = ?,
 			primary_ip = ?,
 			primary_mac = ?,
 			refetch_requested = ?
@@ -124,7 +124,7 @@ func (d *Datastore) SaveHost(host *kolide.Host) error {
 		host.ConfigTLSRefresh,
 		host.LoggerTLSPeriod,
 		host.Additional,
-		host.EnrollSecretName,
+		host.TeamID,
 		host.PrimaryIP,
 		host.PrimaryMac,
 		host.RefetchRequested,
@@ -319,7 +319,6 @@ func (d *Datastore) ListHosts(opt kolide.HostListOptions) ([]*kolide.Host, error
 		h.primary_ip,
 		h.primary_mac,
 		h.label_update_time,
-		h.enroll_secret_name,
 		h.team_id,
 		h.refetch_requested,
 		t.name AS team_name,
@@ -422,7 +421,7 @@ func (d *Datastore) GenerateHostStatusStatistics(now time.Time) (online, offline
 }
 
 // EnrollHost enrolls a host
-func (d *Datastore) EnrollHost(osqueryHostID, nodeKey, secretName string, cooldown time.Duration) (*kolide.Host, error) {
+func (d *Datastore) EnrollHost(osqueryHostID, nodeKey string, teamID *uint, cooldown time.Duration) (*kolide.Host, error) {
 	if osqueryHostID == "" {
 		return nil, fmt.Errorf("missing osquery host identifier")
 	}
@@ -446,10 +445,10 @@ func (d *Datastore) EnrollHost(osqueryHostID, nodeKey, secretName string, cooldo
 					osquery_host_id,
 					seen_time,
 					node_key,
-					enroll_secret_name
+					team_id
 				) VALUES (?, ?, ?, ?, ?, ?)
 			`
-			result, err := tx.Exec(sqlInsert, zeroTime, zeroTime, osqueryHostID, time.Now().UTC(), nodeKey, secretName)
+			result, err := tx.Exec(sqlInsert, zeroTime, zeroTime, osqueryHostID, time.Now().UTC(), nodeKey, teamID)
 
 			if err != nil {
 				return errors.Wrap(err, "insert host")
@@ -469,11 +468,11 @@ func (d *Datastore) EnrollHost(osqueryHostID, nodeKey, secretName string, cooldo
 			sqlUpdate := `
 				UPDATE hosts
 				SET node_key = ?,
-				enroll_secret_name = ?,
+				team_id = ?,
 				last_enroll_time = NOW()
 				WHERE osquery_host_id = ?
 			`
-			_, err := tx.Exec(sqlUpdate, nodeKey, secretName, osqueryHostID)
+			_, err := tx.Exec(sqlUpdate, nodeKey, teamID, osqueryHostID)
 
 			if err != nil {
 				return errors.Wrap(err, "update host")
@@ -540,8 +539,8 @@ func (d *Datastore) AuthenticateHost(nodeKey string) (*kolide.Host, error) {
 			config_tls_refresh,
 			primary_ip,
 			primary_mac,
-			enroll_secret_name,
-			refetch_requested
+			refetch_requested,
+			team_id
 		FROM hosts
 		WHERE node_key = ?
 		LIMIT 1
@@ -553,7 +552,7 @@ func (d *Datastore) AuthenticateHost(nodeKey string) (*kolide.Host, error) {
 		case sql.ErrNoRows:
 			return nil, notFound("Host")
 		default:
-			return nil, errors.New("finding host")
+			return nil, errors.New("find host")
 		}
 	}
 
diff --git a/server/datastore/mysql/migrations/tables/20210527151852_TeamsEnrollSecrets.go b/server/datastore/mysql/migrations/tables/20210527151852_TeamsEnrollSecrets.go
new file mode 100644
index 0000000000..bdd79de139
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20210527151852_TeamsEnrollSecrets.go
@@ -0,0 +1,56 @@
+package tables
+
+import (
+	"database/sql"
+
+	"github.com/pkg/errors"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20210527151852, Down_20210527151852)
+}
+
+func Up_20210527151852(tx *sql.Tx) error {
+	// Add team_id
+	sql := `
+		ALTER TABLE enroll_secrets
+		ADD COLUMN team_id INT UNSIGNED,
+		ADD FOREIGN KEY fk_team_id (team_id) REFERENCES teams (id) ON DELETE CASCADE ON UPDATE CASCADE
+	`
+	if _, err := tx.Exec(sql); err != nil {
+		return errors.Wrap(err, "add team_id to enroll_secrets")
+	}
+
+	// Remove "active" as a concept from enroll secrets
+	sql = `
+		DELETE FROM enroll_secrets
+		WHERE NOT active
+	`
+	if _, err := tx.Exec(sql); err != nil {
+		return errors.Wrap(err, "remove inactive secrets")
+	}
+
+	sql = `
+		ALTER TABLE enroll_secrets
+		DROP COLUMN active,
+		DROP COLUMN name,
+		ADD UNIQUE INDEX (secret)
+	`
+	if _, err := tx.Exec(sql); err != nil {
+		return errors.Wrap(err, "alter enroll_secrets")
+	}
+
+	sql = `
+		ALTER TABLE hosts
+		DROP COLUMN enroll_secret_name
+	`
+	if _, err := tx.Exec(sql); err != nil {
+		return errors.Wrap(err, "alter hosts")
+	}
+
+	return nil
+}
+
+func Down_20210527151852(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/teams.go b/server/datastore/mysql/teams.go
index 543f14e5a2..cc51c9ad63 100644
--- a/server/datastore/mysql/teams.go
+++ b/server/datastore/mysql/teams.go
@@ -31,6 +31,11 @@ func (d *Datastore) NewTeam(team *kolide.Team) (*kolide.Team, error) {
 
 	id, _ := result.LastInsertId()
 	team.ID = uint(id)
+
+	if err := d.saveTeamSecrets(team); err != nil {
+		return nil, err
+	}
+
 	return team, nil
 }
 
@@ -49,9 +54,21 @@ func (d *Datastore) Team(tid uint) (*kolide.Team, error) {
 		return nil, err
 	}
 
+	if err := d.saveTeamSecrets(team); err != nil {
+		return nil, err
+	}
+
 	return team, nil
 }
 
+func (d *Datastore) saveTeamSecrets(team *kolide.Team) error {
+	if team.Secrets == nil {
+		return nil
+	}
+
+	return d.ApplyEnrollSecrets(&team.ID, team.Secrets)
+}
+
 func (d *Datastore) DeleteTeam(tid uint) error {
 	if err := d.deleteEntity("teams", tid); err != nil {
 		return errors.Wrapf(err, "delete team id %d", tid)
@@ -187,3 +204,14 @@ func (d *Datastore) SearchTeams(filter kolide.TeamFilter, matchQuery string, omi
 	}
 	return teams, nil
 }
+func (d *Datastore) TeamEnrollSecrets(teamID uint) ([]*kolide.EnrollSecret, error) {
+	sql := `
+		SELECT * FROM enroll_secrets
+		WHERE team_id = ?
+	`
+	var secrets []*kolide.EnrollSecret
+	if err := d.db.Select(&secrets, sql, teamID); err != nil {
+		return nil, errors.Wrap(err, "get secrets")
+	}
+	return secrets, nil
+}
diff --git a/server/kolide/app.go b/server/kolide/app.go
index aed4d47a3c..c46effa2a1 100644
--- a/server/kolide/app.go
+++ b/server/kolide/app.go
@@ -16,14 +16,13 @@ type AppConfigStore interface {
 	SaveAppConfig(info *AppConfig) error
 
 	// VerifyEnrollSecret checks that the provided secret matches an active
-	// enroll secret. If it is successfully matched, the name of the secret is
-	// returned. Otherwise an error is returned.
-	VerifyEnrollSecret(secret string) (string, error)
-	// ApplyEnrollSecretSpec adds and updates the enroll secrets specified in
-	// the spec.
-	ApplyEnrollSecretSpec(spec *EnrollSecretSpec) error
-	// GetEnrollSecretSpec gets the spec for the current enroll secrets.
-	GetEnrollSecretSpec() (*EnrollSecretSpec, error)
+	// enroll secret. If it is successfully matched, that secret is returned.
+	// Otherwise an error is returned.
+	VerifyEnrollSecret(secret string) (*EnrollSecret, error)
+	// GetEnrollSecrets gets the enroll secrets for a team (or global if teamID is nil).
+	GetEnrollSecrets(teamID *uint) ([]*EnrollSecret, error)
+	// ApplyEnrollSecrets replaces the current enroll secrets for a team with the provided secrets.
+	ApplyEnrollSecrets(teamID *uint, secrets []*EnrollSecret) error
 }
 
 // AppConfigService provides methods for configuring
@@ -316,25 +315,24 @@ type ListOptions struct {
 // EnrollSecret contains information about an enroll secret, name, and active
 // status. Enroll secrets are used for osquery authentication.
 type EnrollSecret struct {
-	// Name is the name assigned to the secret
-	Name string `json:"name" db:"name"`
 	// Secret is the actual secret key.
 	Secret string `json:"secret" db:"secret"`
-	// Active determines whether the secret is currently allowed to be used for
-	// authentication.
-	Active bool `json:"active" db:"active"`
 	// CreatedAt is the time this enroll secret was first added.
 	CreatedAt time.Time `json:"created_at" db:"created_at"`
+	// TeamID is the ID for the associated team. If no ID is set, then this is a
+	// global enroll secret.
+	TeamID *uint `json:"team_id" db:"team_id"`
 }
 
 const (
-	EnrollSecretKind = "enroll_secret"
+	EnrollSecretKind          = "enroll_secret"
+	EnrollSecretDefaultLength = 24
 )
 
 // EnrollSecretSpec is the fleetctl spec type for enroll secrets.
 type EnrollSecretSpec struct {
 	// Secrets is the list of enroll secrets.
-	Secrets []EnrollSecret `json:"secrets"`
+	Secrets []*EnrollSecret `json:"secrets"`
 }
 
 // LicenseInfo contains information about the Fleet license.
diff --git a/server/kolide/hosts.go b/server/kolide/hosts.go
index 0cb2bfb5d9..86c3f05031 100644
--- a/server/kolide/hosts.go
+++ b/server/kolide/hosts.go
@@ -43,10 +43,10 @@ type HostStore interface {
 	DeleteHost(hid uint) error
 	Host(id uint) (*Host, error)
 	// EnrollHost will enroll a new host with the given identifier, setting the
-	// node key, and enroll secret used for the host. Implementations of this
-	// method should respect the provided host enrollment cooldown, by returning
-	// an error if the host has enrolled within the cooldown period.
-	EnrollHost(osqueryHostId, nodeKey, secretName string, cooldown time.Duration) (*Host, error)
+	// node key, and team. Implementations of this method should respect the
+	// provided host enrollment cooldown, by returning an error if the host has
+	// enrolled within the cooldown period.
+	EnrollHost(osqueryHostId, nodeKey string, teamID *uint, cooldown time.Duration) (*Host, error)
 	ListHosts(opt HostListOptions) ([]*Host, error)
 	// AuthenticateHost authenticates and returns host metadata by node key.
 	// This method should not return the host "additional" information as this
@@ -155,7 +155,6 @@ type Host struct {
 	ConfigTLSRefresh          uint                `json:"config_tls_refresh" db:"config_tls_refresh"`
 	LoggerTLSPeriod           uint                `json:"logger_tls_period" db:"logger_tls_period"`
 	Additional                *json.RawMessage    `json:"additional,omitempty" db:"additional"`
-	EnrollSecretName          string              `json:"enroll_secret_name" db:"enroll_secret_name"`
 
 	TeamID *uint `json:"team_id" db:"team_id"`
 	// TeamName is the name of the team, loaded by JOIN to the teams table.
diff --git a/server/kolide/teams.go b/server/kolide/teams.go
index fd5f0d0bd8..2b9f4f4060 100644
--- a/server/kolide/teams.go
+++ b/server/kolide/teams.go
@@ -29,6 +29,8 @@ type TeamStore interface {
 	// SearchTeams searches teams using the provided query and ommitting the
 	// provided existing selection.
 	SearchTeams(filter TeamFilter, matchQuery string, omit ...uint) ([]*Team, error)
+	// TeamEnrollSecrets lists the enroll secrets for the team.
+	TeamEnrollSecrets(teamID uint) ([]*EnrollSecret, error)
 }
 
 type TeamService interface {
@@ -49,11 +51,14 @@ type TeamService interface {
 	ListTeams(ctx context.Context, opt ListOptions) ([]*Team, error)
 	// ListTeams lists users on the team with the provided list options.
 	ListTeamUsers(ctx context.Context, teamID uint, opt ListOptions) ([]*User, error)
+	// TeamEnrollSecrets lists the enroll secrets for the team.
+	TeamEnrollSecrets(ctx context.Context, teamID uint) ([]*EnrollSecret, error)
 }
 
 type TeamPayload struct {
-	Name        *string `json:"name"`
-	Description *string `json:"description"`
+	Name        *string         `json:"name"`
+	Description *string         `json:"description"`
+	Secrets     []*EnrollSecret `json:"secrets"`
 	// Note AgentOptions must be set by a separate endpoint.
 }
 
@@ -83,6 +88,8 @@ type Team struct {
 	HostCount int `json:"host_count" db:"host_count"`
 	// Hosts are the hosts assigned to the team.
 	Hosts []Host `json:"hosts,omitempty"`
+	// Secrets is the enroll secrets valid for this team.
+	Secrets []*EnrollSecret `json:"secrets,omitempty"`
 }
 
 // TeamUser is a user mapped to a team with a role.
diff --git a/server/mock/datastore_appconfig.go b/server/mock/datastore_appconfig.go
index 65a8357291..867cef6b01 100644
--- a/server/mock/datastore_appconfig.go
+++ b/server/mock/datastore_appconfig.go
@@ -12,11 +12,11 @@ type AppConfigFunc func() (*kolide.AppConfig, error)
 
 type SaveAppConfigFunc func(info *kolide.AppConfig) error
 
-type VerifyEnrollSecretFunc func(secret string) (string, error)
+type VerifyEnrollSecretFunc func(secret string) (*kolide.EnrollSecret, error)
 
-type ApplyEnrollSecretSpecFunc func(spec *kolide.EnrollSecretSpec) error
+type ApplyEnrollSecretsFunc func(treamID *uint, secrets []*kolide.EnrollSecret) error
 
-type GetEnrollSecretSpecFunc func() (*kolide.EnrollSecretSpec, error)
+type GetEnrollSecretsFunc func(teamID *uint) ([]*kolide.EnrollSecret, error)
 
 type AppConfigStore struct {
 	NewAppConfigFunc        NewAppConfigFunc
@@ -31,11 +31,11 @@ type AppConfigStore struct {
 	VerifyEnrollSecretFunc        VerifyEnrollSecretFunc
 	VerifyEnrollSecretFuncInvoked bool
 
-	ApplyEnrollSecretSpecFunc        ApplyEnrollSecretSpecFunc
-	ApplyEnrollSecretSpecFuncInvoked bool
+	ApplyEnrollSecretsFunc        ApplyEnrollSecretsFunc
+	ApplyEnrollSecretsFuncInvoked bool
 
-	GetEnrollSecretSpecFunc        GetEnrollSecretSpecFunc
-	GetEnrollSecretSpecFuncInvoked bool
+	GetEnrollSecretsFunc        GetEnrollSecretsFunc
+	GetEnrollSecretsFuncInvoked bool
 }
 
 func (s *AppConfigStore) NewAppConfig(info *kolide.AppConfig) (*kolide.AppConfig, error) {
@@ -53,17 +53,17 @@ func (s *AppConfigStore) SaveAppConfig(info *kolide.AppConfig) error {
 	return s.SaveAppConfigFunc(info)
 }
 
-func (s *AppConfigStore) VerifyEnrollSecret(secret string) (string, error) {
+func (s *AppConfigStore) VerifyEnrollSecret(secret string) (*kolide.EnrollSecret, error) {
 	s.VerifyEnrollSecretFuncInvoked = true
 	return s.VerifyEnrollSecretFunc(secret)
 }
 
-func (s *AppConfigStore) ApplyEnrollSecretSpec(spec *kolide.EnrollSecretSpec) error {
-	s.ApplyEnrollSecretSpecFuncInvoked = true
-	return s.ApplyEnrollSecretSpecFunc(spec)
+func (s *AppConfigStore) ApplyEnrollSecrets(teamID *uint, secrets []*kolide.EnrollSecret) error {
+	s.ApplyEnrollSecretsFuncInvoked = true
+	return s.ApplyEnrollSecretsFunc(teamID, secrets)
 }
 
-func (s *AppConfigStore) GetEnrollSecretSpec() (*kolide.EnrollSecretSpec, error) {
-	s.GetEnrollSecretSpecFuncInvoked = true
-	return s.GetEnrollSecretSpecFunc()
+func (s *AppConfigStore) GetEnrollSecrets(teamID *uint) ([]*kolide.EnrollSecret, error) {
+	s.GetEnrollSecretsFuncInvoked = true
+	return s.GetEnrollSecretsFunc(teamID)
 }
diff --git a/server/mock/datastore_hosts.go b/server/mock/datastore_hosts.go
index c45bd223cf..ae20bf8b1c 100644
--- a/server/mock/datastore_hosts.go
+++ b/server/mock/datastore_hosts.go
@@ -22,7 +22,7 @@ type HostByIdentifierFunc func(identifier string) (*kolide.Host, error)
 
 type ListHostsFunc func(opt kolide.HostListOptions) ([]*kolide.Host, error)
 
-type EnrollHostFunc func(osqueryHostId, nodeKey, secretName string, cooldown time.Duration) (*kolide.Host, error)
+type EnrollHostFunc func(osqueryHostId, nodeKey string, teamID *uint, cooldown time.Duration) (*kolide.Host, error)
 
 type AuthenticateHostFunc func(nodeKey string) (*kolide.Host, error)
 
@@ -122,9 +122,9 @@ func (s *HostStore) ListHosts(opt kolide.HostListOptions) ([]*kolide.Host, error
 	return s.ListHostsFunc(opt)
 }
 
-func (s *HostStore) EnrollHost(osqueryHostId, nodeKey, secretName string, cooldown time.Duration) (*kolide.Host, error) {
+func (s *HostStore) EnrollHost(osqueryHostId, nodeKey string, teamID *uint, cooldown time.Duration) (*kolide.Host, error) {
 	s.EnrollHostFuncInvoked = true
-	return s.EnrollHostFunc(osqueryHostId, nodeKey, secretName, cooldown)
+	return s.EnrollHostFunc(osqueryHostId, nodeKey, teamID, cooldown)
 }
 
 func (s *HostStore) AuthenticateHost(nodeKey string) (*kolide.Host, error) {
diff --git a/server/mock/datastore_teams.go b/server/mock/datastore_teams.go
index f851b2d94c..22c32d65ea 100644
--- a/server/mock/datastore_teams.go
+++ b/server/mock/datastore_teams.go
@@ -22,6 +22,8 @@ type ListTeamsFunc func(filter kolide.TeamFilter, opt kolide.ListOptions) ([]*ko
 
 type SearchTeamsFunc func(filter kolide.TeamFilter, matchQuery string, omit ...uint) ([]*kolide.Team, error)
 
+type TeamEnrollSecretsFunc func(teamID uint) ([]*kolide.EnrollSecret, error)
+
 type TeamStore struct {
 	NewTeamFunc        NewTeamFunc
 	NewTeamFuncInvoked bool
@@ -43,6 +45,9 @@ type TeamStore struct {
 
 	SearchTeamsFunc        SearchTeamsFunc
 	SearchTeamsFuncInvoked bool
+
+	TeamEnrollSecretsFunc        TeamEnrollSecretsFunc
+	TeamEnrollSecretsFuncInvoked bool
 }
 
 func (s *TeamStore) NewTeam(team *kolide.Team) (*kolide.Team, error) {
@@ -79,3 +84,8 @@ func (s *TeamStore) SearchTeams(filter kolide.TeamFilter, matchQuery string, omi
 	s.SearchTeamsFuncInvoked = true
 	return s.SearchTeamsFunc(filter, matchQuery, omit...)
 }
+
+func (s *TeamStore) TeamEnrollSecrets(teamID uint) ([]*kolide.EnrollSecret, error) {
+	s.TeamEnrollSecretsFuncInvoked = true
+	return s.TeamEnrollSecretsFunc(teamID)
+}
diff --git a/server/service/endpoint_setup.go b/server/service/endpoint_setup.go
index b9241d0aa0..46cbef23c8 100644
--- a/server/service/endpoint_setup.go
+++ b/server/service/endpoint_setup.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/fleetdm/fleet/server/kolide"
+	"github.com/fleetdm/fleet/server/ptr"
 	"github.com/go-kit/kit/endpoint"
 	"github.com/pkg/errors"
 )
@@ -63,8 +64,7 @@ func makeSetupEndpoint(svc kolide.Service) endpoint.Endpoint {
 			return setupResponse{Err: err}, nil
 		}
 		// Make the user an admin
-		adminStr := "admin"
-		adminPayload.GlobalRole = &adminStr
+		adminPayload.GlobalRole = ptr.String(kolide.RoleAdmin)
 		admin, err = svc.CreateUser(ctx, adminPayload)
 		if err != nil {
 			return setupResponse{Err: err}, nil
diff --git a/server/service/endpoint_teams.go b/server/service/endpoint_teams.go
index ef1364ef7e..c0aae9a7c6 100644
--- a/server/service/endpoint_teams.go
+++ b/server/service/endpoint_teams.go
@@ -193,3 +193,30 @@ func makeDeleteTeamUsersEndpoint(svc kolide.Service) endpoint.Endpoint {
 		return teamResponse{Team: team}, err
 	}
 }
+
+////////////////////////////////////////////////////////////////////////////////
+// Get enroll secrets for team
+////////////////////////////////////////////////////////////////////////////////
+
+type teamEnrollSecretsRequest struct {
+	TeamID uint
+}
+
+type teamEnrollSecretsResponse struct {
+	Secrets []*kolide.EnrollSecret `json:"secrets"`
+	Err     error                  `json:"error,omitempty"`
+}
+
+func (r teamEnrollSecretsResponse) error() error { return r.Err }
+
+func makeTeamEnrollSecretsEndpoint(svc kolide.Service) endpoint.Endpoint {
+	return func(ctx context.Context, request interface{}) (interface{}, error) {
+		req := request.(teamEnrollSecretsRequest)
+		secrets, err := svc.TeamEnrollSecrets(ctx, req.TeamID)
+		if err != nil {
+			return teamEnrollSecretsResponse{Err: err}, nil
+		}
+
+		return teamEnrollSecretsResponse{Secrets: secrets}, err
+	}
+}
diff --git a/server/service/handler.go b/server/service/handler.go
index 458b52f02c..8d7c0c4db5 100644
--- a/server/service/handler.go
+++ b/server/service/handler.go
@@ -119,6 +119,7 @@ type KolideEndpoints struct {
 	ListTeamUsers                         endpoint.Endpoint
 	AddTeamUsers                          endpoint.Endpoint
 	DeleteTeamUsers                       endpoint.Endpoint
+	TeamEnrollSecrets                     endpoint.Endpoint
 }
 
 // MakeKolideServerEndpoints creates the Kolide API endpoints.
@@ -231,6 +232,7 @@ func MakeKolideServerEndpoints(svc kolide.Service, jwtKey, urlPrefix string, lim
 		ListTeamUsers:          authenticatedUser(jwtKey, svc, makeListTeamUsersEndpoint(svc)),
 		AddTeamUsers:           authenticatedUser(jwtKey, svc, makeAddTeamUsersEndpoint(svc)),
 		DeleteTeamUsers:        authenticatedUser(jwtKey, svc, makeDeleteTeamUsersEndpoint(svc)),
+		TeamEnrollSecrets:      authenticatedUser(jwtKey, svc, makeTeamEnrollSecretsEndpoint(svc)),
 
 		// Authenticated status endpoints
 		StatusResultStore: authenticatedUser(jwtKey, svc, makeStatusResultStoreEndpoint(svc)),
@@ -349,6 +351,7 @@ type kolideHandlers struct {
 	ListTeamUsers                         http.Handler
 	AddTeamUsers                          http.Handler
 	DeleteTeamUsers                       http.Handler
+	TeamEnrollSecrets                     http.Handler
 }
 
 func makeKolideKitHandlers(e KolideEndpoints, opts []kithttp.ServerOption) *kolideHandlers {
@@ -454,6 +457,7 @@ func makeKolideKitHandlers(e KolideEndpoints, opts []kithttp.ServerOption) *koli
 		ListTeamUsers:                         newServer(e.ListTeamUsers, decodeListTeamUsersRequest),
 		AddTeamUsers:                          newServer(e.AddTeamUsers, decodeModifyTeamUsersRequest),
 		DeleteTeamUsers:                       newServer(e.DeleteTeamUsers, decodeModifyTeamUsersRequest),
+		TeamEnrollSecrets:                     newServer(e.TeamEnrollSecrets, decodeTeamEnrollSecretsRequest),
 	}
 }
 
@@ -674,6 +678,7 @@ func attachKolideAPIRoutes(r *mux.Router, h *kolideHandlers) {
 	r.Handle("/api/v1/fleet/teams/{id}/users", h.ListTeamUsers).Methods("GET").Name("team_users")
 	r.Handle("/api/v1/fleet/teams/{id}/users", h.AddTeamUsers).Methods("PATCH").Name("add_team_users")
 	r.Handle("/api/v1/fleet/teams/{id}/users", h.DeleteTeamUsers).Methods("DELETE").Name("delete_team_users")
+	r.Handle("/api/v1/fleet/teams/{id}/secrets", h.TeamEnrollSecrets).Methods("GET").Name("get_team_enroll_secrets")
 
 	r.Handle("/api/v1/osquery/enroll", h.EnrollAgent).Methods("POST").Name("enroll_agent")
 	r.Handle("/api/v1/osquery/config", h.GetClientConfig).Methods("POST").Name("get_client_config")
diff --git a/server/service/service_appconfig.go b/server/service/service_appconfig.go
index bc2bb661f4..993e6372aa 100644
--- a/server/service/service_appconfig.go
+++ b/server/service/service_appconfig.go
@@ -44,20 +44,16 @@ func (svc service) NewAppConfig(ctx context.Context, p kolide.AppConfigPayload)
 	}
 
 	// Set up a default enroll secret
-	secret, err := kolide.RandomText(24)
+	secret, err := kolide.RandomText(kolide.EnrollSecretDefaultLength)
 	if err != nil {
 		return nil, errors.Wrap(err, "generate enroll secret string")
 	}
-	spec := &kolide.EnrollSecretSpec{
-		Secrets: []kolide.EnrollSecret{
-			kolide.EnrollSecret{
-				Name:   "default",
-				Secret: secret,
-				Active: true,
-			},
+	secrets := []*kolide.EnrollSecret{
+		{
+			Secret: secret,
 		},
 	}
-	err = svc.ds.ApplyEnrollSecretSpec(spec)
+	err = svc.ds.ApplyEnrollSecrets(nil, secrets)
 	if err != nil {
 		return nil, errors.Wrap(err, "save enroll secret")
 	}
@@ -246,19 +242,20 @@ func appConfigFromAppConfigPayload(p kolide.AppConfigPayload, config kolide.AppC
 
 func (svc service) ApplyEnrollSecretSpec(ctx context.Context, spec *kolide.EnrollSecretSpec) error {
 	for _, s := range spec.Secrets {
-		if s.Name == "" {
-			return errors.New("enroll secret name must not be empty")
-		}
 		if s.Secret == "" {
 			return errors.New("enroll secret must not be empty")
 		}
 	}
 
-	return svc.ds.ApplyEnrollSecretSpec(spec)
+	return svc.ds.ApplyEnrollSecrets(nil, spec.Secrets)
 }
 
 func (svc service) GetEnrollSecretSpec(ctx context.Context) (*kolide.EnrollSecretSpec, error) {
-	return svc.ds.GetEnrollSecretSpec()
+	secrets, err := svc.ds.GetEnrollSecrets(nil)
+	if err != nil {
+		return nil, err
+	}
+	return &kolide.EnrollSecretSpec{Secrets: secrets}, nil
 }
 
 func (svc service) Version(ctx context.Context) (*version.Info, error) {
diff --git a/server/service/service_appconfig_test.go b/server/service/service_appconfig_test.go
index 7cb54c0c33..b2149da70d 100644
--- a/server/service/service_appconfig_test.go
+++ b/server/service/service_appconfig_test.go
@@ -64,9 +64,9 @@ func TestCreateAppConfig(t *testing.T) {
 			return config, nil
 		}
 
-		var gotSecretSpec *kolide.EnrollSecretSpec
-		ds.ApplyEnrollSecretSpecFunc = func(spec *kolide.EnrollSecretSpec) error {
-			gotSecretSpec = spec
+		var gotSecrets []*kolide.EnrollSecret
+		ds.ApplyEnrollSecretsFunc = func(teamID *uint, secrets []*kolide.EnrollSecret) error {
+			gotSecrets = secrets
 			return nil
 		}
 
@@ -80,9 +80,9 @@ func TestCreateAppConfig(t *testing.T) {
 		assert.Equal(t, *payload.ServerSettings.LiveQueryDisabled, result.LiveQueryDisabled)
 
 		// Ensure enroll secret was set
-		require.NotNil(t, gotSecretSpec)
-		require.Len(t, gotSecretSpec.Secrets, 1)
-		assert.Len(t, gotSecretSpec.Secrets[0].Secret, 32)
+		require.NotNil(t, gotSecrets)
+		require.Len(t, gotSecrets, 1)
+		assert.Len(t, gotSecrets[0].Secret, 32)
 	}
 }
 
@@ -91,7 +91,7 @@ func TestEmptyEnrollSecret(t *testing.T) {
 	svc, err := newTestService(ds, nil, nil)
 	require.Nil(t, err)
 
-	ds.ApplyEnrollSecretSpecFunc = func(spec *kolide.EnrollSecretSpec) error {
+	ds.ApplyEnrollSecretsFunc = func(teamID *uint, secrets []*kolide.EnrollSecret) error {
 		return nil
 	}
 	ds.AppConfigFunc = func() (*kolide.AppConfig, error) {
@@ -101,27 +101,21 @@ func TestEmptyEnrollSecret(t *testing.T) {
 	err = svc.ApplyEnrollSecretSpec(
 		context.Background(),
 		&kolide.EnrollSecretSpec{
-			Secrets: []kolide.EnrollSecret{{}},
+			Secrets: []*kolide.EnrollSecret{{}},
 		},
 	)
 	require.Error(t, err)
 
 	err = svc.ApplyEnrollSecretSpec(
 		context.Background(),
-		&kolide.EnrollSecretSpec{Secrets: []kolide.EnrollSecret{{Name: "foo"}}},
+		&kolide.EnrollSecretSpec{Secrets: []*kolide.EnrollSecret{{Secret: ""}}},
 	)
-	require.Error(t, err)
-
-	err = svc.ApplyEnrollSecretSpec(
-		context.Background(),
-		&kolide.EnrollSecretSpec{Secrets: []kolide.EnrollSecret{{Secret: "foo"}}},
-	)
-	require.Error(t, err)
+	require.Error(t, err, "empty secret should be disallowed")
 
 	err = svc.ApplyEnrollSecretSpec(
 		context.Background(),
 		&kolide.EnrollSecretSpec{
-			Secrets: []kolide.EnrollSecret{{Name: "foo", Secret: "foo"}},
+			Secrets: []*kolide.EnrollSecret{{Secret: "foo"}},
 		},
 	)
 	require.NoError(t, err)
diff --git a/server/service/service_osquery.go b/server/service/service_osquery.go
index ae71ba86c0..a8f64bfa5a 100644
--- a/server/service/service_osquery.go
+++ b/server/service/service_osquery.go
@@ -78,7 +78,7 @@ func (svc service) AuthenticateHost(ctx context.Context, nodeKey string) (*kolid
 }
 
 func (svc service) EnrollAgent(ctx context.Context, enrollSecret, hostIdentifier string, hostDetails map[string](map[string]string)) (string, error) {
-	secretName, err := svc.ds.VerifyEnrollSecret(enrollSecret)
+	secret, err := svc.ds.VerifyEnrollSecret(enrollSecret)
 	if err != nil {
 		return "", osqueryError{
 			message:     "enroll failed: " + err.Error(),
@@ -96,7 +96,7 @@ func (svc service) EnrollAgent(ctx context.Context, enrollSecret, hostIdentifier
 
 	hostIdentifier = getHostIdentifier(svc.logger, svc.config.Osquery.HostIdentifier, hostIdentifier, hostDetails)
 
-	host, err := svc.ds.EnrollHost(hostIdentifier, nodeKey, secretName, svc.config.Osquery.EnrollCooldown)
+	host, err := svc.ds.EnrollHost(hostIdentifier, nodeKey, secret.TeamID, svc.config.Osquery.EnrollCooldown)
 	if err != nil {
 		return "", osqueryError{message: "save enroll failed: " + err.Error(), nodeInvalid: true}
 	}
diff --git a/server/service/service_osquery_test.go b/server/service/service_osquery_test.go
index 02a914b876..9c0863ab68 100644
--- a/server/service/service_osquery_test.go
+++ b/server/service/service_osquery_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/fleetdm/fleet/server/live_query"
 	"github.com/fleetdm/fleet/server/logging"
 	"github.com/fleetdm/fleet/server/mock"
+	"github.com/fleetdm/fleet/server/ptr"
 	"github.com/fleetdm/fleet/server/pubsub"
 	"github.com/go-kit/kit/log"
 	"github.com/stretchr/testify/assert"
@@ -31,17 +32,18 @@ var expectedDetailQueries = len(detailQueries) - 3
 
 func TestEnrollAgent(t *testing.T) {
 	ds := new(mock.Store)
-	ds.VerifyEnrollSecretFunc = func(secret string) (string, error) {
+	ds.VerifyEnrollSecretFunc = func(secret string) (*kolide.EnrollSecret, error) {
 		switch secret {
 		case "valid_secret":
-			return "valid", nil
+			return &kolide.EnrollSecret{Secret: "valid_secret", TeamID: ptr.Uint(3)}, nil
 		default:
-			return "", errors.New("not found")
+			return nil, errors.New("not found")
 		}
 	}
-	ds.EnrollHostFunc = func(osqueryHostId, nodeKey, secretName string, cooldown time.Duration) (*kolide.Host, error) {
+	ds.EnrollHostFunc = func(osqueryHostId, nodeKey string, teamID *uint, cooldown time.Duration) (*kolide.Host, error) {
+		assert.Equal(t, ptr.Uint(3), teamID)
 		return &kolide.Host{
-			OsqueryHostID: osqueryHostId, NodeKey: nodeKey, EnrollSecretName: secretName,
+			OsqueryHostID: osqueryHostId, NodeKey: nodeKey,
 		}, nil
 	}
 
@@ -55,12 +57,12 @@ func TestEnrollAgent(t *testing.T) {
 
 func TestEnrollAgentIncorrectEnrollSecret(t *testing.T) {
 	ds := new(mock.Store)
-	ds.VerifyEnrollSecretFunc = func(secret string) (string, error) {
+	ds.VerifyEnrollSecretFunc = func(secret string) (*kolide.EnrollSecret, error) {
 		switch secret {
 		case "valid_secret":
-			return "valid", nil
+			return &kolide.EnrollSecret{Secret: "valid_secret", TeamID: ptr.Uint(3)}, nil
 		default:
-			return "", errors.New("not found")
+			return nil, errors.New("not found")
 		}
 	}
 
@@ -74,12 +76,12 @@ func TestEnrollAgentIncorrectEnrollSecret(t *testing.T) {
 
 func TestEnrollAgentDetails(t *testing.T) {
 	ds := new(mock.Store)
-	ds.VerifyEnrollSecretFunc = func(secret string) (string, error) {
-		return "valid", nil
+	ds.VerifyEnrollSecretFunc = func(secret string) (*kolide.EnrollSecret, error) {
+		return &kolide.EnrollSecret{}, nil
 	}
-	ds.EnrollHostFunc = func(osqueryHostId, nodeKey, secretName string, cooldown time.Duration) (*kolide.Host, error) {
+	ds.EnrollHostFunc = func(osqueryHostId, nodeKey string, teamID *uint, cooldown time.Duration) (*kolide.Host, error) {
 		return &kolide.Host{
-			OsqueryHostID: osqueryHostId, NodeKey: nodeKey, EnrollSecretName: secretName,
+			OsqueryHostID: osqueryHostId, NodeKey: nodeKey,
 		}, nil
 	}
 	var gotHost *kolide.Host
@@ -112,7 +114,6 @@ func TestEnrollAgentDetails(t *testing.T) {
 	assert.Equal(t, "2.12.0", gotHost.OsqueryVersion)
 	assert.Equal(t, "zwass.local", gotHost.HostName)
 	assert.Equal(t, "froobling_uuid", gotHost.UUID)
-	assert.Equal(t, "valid", gotHost.EnrollSecretName)
 }
 
 func TestAuthenticateHost(t *testing.T) {
diff --git a/server/service/service_teams.go b/server/service/service_teams.go
index 9d1064a537..7b46dde46f 100644
--- a/server/service/service_teams.go
+++ b/server/service/service_teams.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/fleetdm/fleet/server/contexts/viewer"
 	"github.com/fleetdm/fleet/server/kolide"
+	"github.com/pkg/errors"
 )
 
 func (svc service) NewTeam(ctx context.Context, p kolide.TeamPayload) (*kolide.Team, error) {
@@ -24,6 +25,16 @@ func (svc service) NewTeam(ctx context.Context, p kolide.TeamPayload) (*kolide.T
 		team.Description = *p.Description
 	}
 
+	if p.Secrets != nil {
+		team.Secrets = p.Secrets
+	} else {
+		// Set up a default enroll secret
+		secret, err := kolide.RandomText(kolide.EnrollSecretDefaultLength)
+		if err != nil {
+			return nil, errors.Wrap(err, "generate enroll secret string")
+		}
+		team.Secrets = []*kolide.EnrollSecret{{Secret: secret}}
+	}
 	team, err := svc.ds.NewTeam(team)
 	if err != nil {
 		return nil, err
@@ -45,6 +56,9 @@ func (svc service) ModifyTeam(ctx context.Context, id uint, payload kolide.TeamP
 	if payload.Description != nil {
 		team.Description = *payload.Description
 	}
+	if payload.Secrets != nil {
+		team.Secrets = payload.Secrets
+	}
 
 	return svc.ds.SaveTeam(team)
 }
@@ -140,3 +154,7 @@ func (svc service) ListTeams(ctx context.Context, opt kolide.ListOptions) ([]*ko
 func (svc service) DeleteTeam(ctx context.Context, tid uint) error {
 	return svc.ds.DeleteTeam(tid)
 }
+
+func (svc service) TeamEnrollSecrets(ctx context.Context, teamID uint) ([]*kolide.EnrollSecret, error) {
+	return svc.ds.TeamEnrollSecrets(teamID)
+}
diff --git a/server/service/transport_teams.go b/server/service/transport_teams.go
index ff4856027e..2f5a2d1da6 100644
--- a/server/service/transport_teams.go
+++ b/server/service/transport_teams.go
@@ -81,3 +81,12 @@ func decodeModifyTeamUsersRequest(ctx context.Context, r *http.Request) (interfa
 	}
 	return req, nil
 }
+
+func decodeTeamEnrollSecretsRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	id, err := idFromRequest(r, "id")
+	if err != nil {
+		return nil, err
+	}
+	req := teamEnrollSecretsRequest{TeamID: id}
+	return req, nil
+}