Presented herein are techniques for securely configuring or managing devices in a variety of geographic locations. At a device manager for a device, a first public key of a first public-private key pair is presented to a network management system as part of a request for one or more work orders. The work order, generated and signed by the network management system using a second private key of a second public-private key pair, includes the first public key, and is received by the device manager. The signed work order is provided to the endpoint device for validation of the signed work order using a second public key, and all subsequent communications from the device manager to the endpoint device are sent such that the communications are signed with the first private key. In some embodiments, each work order is valid for a specified amount of time.