Skip to main content

How does Device configuration work (e.g. MDM enrollment)?

  • Updated

There are 3 types of device management that Workwize is able to enroll on any device:

  1. Automated Device Enrollment (ADE) - Apple Business Manager (ABM):
    1. This method leverages Apple Business Manager to automatically enroll corporate-owned iOS/iPadOS and Mac devices without any user interaction. The devices are pre-configured with organizational settings and enrolled into ABM (and then can be enrolled into MDM) when turned on.
    2. To find more information how to get started with ABM, you can access this guide.
  2. Automated Windows Enrollment: This includes methods like Windows Autopilot, to automatically enroll corporate-owned Windows devices without user involvement. Our suppliers may require you to give them access to enroll, we will be in touch if that’s the case.
  3. Imaging: Imaging in IT refers to the process of creating a standardized operating system image, including pre-configured settings, drivers, applications, and security policies, which can be deployed across multiple devices to ensure consistency and streamline setup. This involves capturing the image from a fully configured system using tools like Sysprep for Windows, and deploying it via network, local, or cloud methods.

1. How a device is enrolled with Apple Business Manager (ABM)?

Step 1: Share your Apple Business Manager ID with Workwize

This allows the reseller to properly link the device serial numbers to your ABM account during procurement. The following details must be share with your dedicated Customer Success Manager (CSM):

  1. Organisation ID
  2. D-U-N-S number
  3. Customer number
  4. VAT Number
  5. Geographies needed

For some suppliers which are required by Apple to directly invoice clients, we may also need the following details:

  1. Billing Address
  2. Contact person for finance
  3. Contact person for shipping

Step 2: Add Reseller IDs of Apple Authorized Resellers (AARs) that work with Workwize

Your Customer Success Manager (CSM) will communicate you the Apple Reseller ID (from suppliers that we will use, depending on the geographies needed) that you need to authorize from your side, so that they can enroll device for your company.

Step 3: Configure MDM Server in Apple Business Manager

The following steps act as an indication only (please note that you need to check internally if these steps apply exactly for your setup).

  1. In the Apple Business Manager portal, go to Settings > Data Sources
  2. Click "Connect to Data Source" and select your MDM solution (e.g. Jamf, Mosyle, etc.)
  3. Follow the prompts to download a public key and create a new MDM server entry in ABM
  4. Download the MDM server token (.p7m file) provided by ABM
  5. In your MDM solution, upload the MDM server token file
  6. This establishes a connection between your MDM and your Apple Business Manager account

Step 4: Workwize AARs will assign Devices to MDM Server

  1. The Supplier will assign the device serial numbers to your MDM server entry in ABM during their provisioning process
  2. User will receive the laptop enrolled (when you or employees unbox the new Apple devices, follow the setup prompts - devices will automatically enroll into your MDM solution during setup).

2. How a device is enrolled with Automated Windows Enrollment?

To enroll devices with Automated Windows Enrollment (also known as Automatic MDM Enrollment) via a Workwize’s supplier your company, follow these steps:

Step 1: You need to enable Automatic MDM Enrollment in the Microsoft Intune admin center:

The following steps act as an indication only (please note that you need to check internally if these steps apply exactly for your setup).

  1. Go to Devices > Enrollment > Automatic Enrollment
  2. Under MDM User Scope, select "All" to allow all users to auto-enroll devices
  3. Save the configuration

Step 2: Workwize supplier will provision and ship devices

  1. In most cases, our suppliers will upload device hardware hashes to the Windows Autopilot deployment program for the end-user company's tenant
  2. User will receive the laptop enrolled (sign in to the device with account, it will automatically register with Azure AD and enroll into Intune without any prompts).

3. How is a device enrolled with Imaging ?

Step 1: Workwize shares FTP server login details

  1. You will be required to login with the credentials shared from the Workwize team for a platform called SFTPGo

Untitled (6).png

 

Step 2: Upload your FTP file

  1. Upload your FTP file and review if all is correct

Untitled (7).png

Related articles