Add troubleshooting section for Elastic Agent automatic unenrollment on 401 errors

[Copilot]

Summary

Adds documentation for Elastic Agent automatic unenrollment behavior when receiving 401 errors during check-in. In versions < 8.19.0 and < 9.1.0, agents are automatically unenrolled after 7 consecutive 401 failures. This behavior was removed in 8.19.0/9.1.0.

Changes:

• Added troubleshooting section "{{agent}} is automatically unenrolled after failed check-ins with 401 errors" to troubleshoot/ingest/fleet/common-problems.md
• Updated table of contents with new section reference
• Documented version-specific behavior for versions < 8.19.0 and < 9.1.0
• Provided resolution steps: re-enrollment process and investigating 401 error causes
• Added version-gated admonition explaining behavior change in 8.19.0/9.1.0
• Listed common causes: expired API keys, misconfiguration, authentication issues

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

2. Tool(s) and model(s) used: GitHub Copilot

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Website]: Add troubleshooting section about failed check-ins and 401</issue_title>
<issue_description>### Type of issue

None

What documentation page is affected

https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems

What happened?

We should cover the situation that if an Elastic Agent in versions < 9.1.0 or 8.19.0 gets a 401 while checkin in for more than 7 times, it gets auto-unenrolled.

This behavior has been changed on 9.1.0 and 8.19.0, removing the auto-unenrollment.

Additional info

No response</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Website]: Add troubleshooting section about failed check-ins and 401 #3708

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

Vale Linting Results

Summary: 1 suggestion found

💡 Suggestions (1)

File	Line	Rule	Message
troubleshoot/ingest/fleet/common-problems.md	535	Elastic.Capitalization	'is automatically unenrolled after failed check-ins with 401 errors' should use sentence-style capitalization.

[github-actions]

🔍 Preview links for changed docs

• troubleshoot/ingest/fleet/common-problems.md

[vishaangelova]

@lucabelluccini, could you please take a look if this is what you had in mind?

[vishaangelova]

Hi, @blakerouse! Would you mind having a look at this small PR to verify its truthfulness? Thank you!

[blakerouse]

You don't need to uninstall. You can just re-enroll it. The UI will provide an installation command, that can just be changed to an enroll command.

I can see how using uninstall/install seems easier to explain, but it is not actually required.

A re-enroll is actually better because it doesn't remove any state about what has already been ingested for logs. If they are re-enrolling back to the same cluster they would probably want that, instead of a re-ingestion of all logs.

[blakerouse]

I would add more here, to say that once the underlying reason for the 401's is resolved the Elastic Agents will re-connect and resume working.