Enrollment Processes

In addition to your provided company requirements for device management, our operations team may require additional information from your company to complete the full enrollment process.

We have documented the general processes of the most common device management softwares to share what to expect. These processes may deviate depending on your company and device requirements. If any additional information is needed, your Customer Success Manager will be in contact with you.

Apple Business Manager

Apple Business Manager (ABM) is a web-based platform designed for businesses and organizations to manage and deploy Apple devices. ABM allows administrators to:

  • Enroll new devices in Mobile Device Management (MDM) systems for remote control and configuration.
  • Manage devices from deployment to retirement.

Automatic Enrollment

Our team will follow this process to complete automatic enrollment of your devices:

  1. GroWrk will ask you to provide your DEP ID/Organization ID.
    1. If you are unsure where to find your Organization ID, sign up for Apple Business Manager and start the process here.
  2. GroWrk will share the Reseller ID of our warehouse to you.
  3. GroWrk will receive serial number of the newly purchased device and will share it with you to confirm that the device is enrolled.

Apple Business Registration

Enrolling your company in the Apple Business Manager program will create an Apple ID for your company. To get started with registration, sign up using this link here. Signing up requires the following information:

  1. Company name
  2. D-U-N-S number
    1. If you do not have a D-U-N-S number, you can register and obtain it through Dun & Bradstreet. Read the following information here.
  3. Phone number
  4. Website

Please ensure that you are creating the Apple Business account with a company affiliated email, not a personal Gmail or Yahoo address.

Manual Enrollment

For existing devices or those purchased outside authorized channels, manual enrollment is required, which involves additional steps. Manual ABM enrollment can be requested if and when you purchase devices before issuing your ABM, purchase devices through a non-authorized Apple reseller, or if automatic enrollment is not available for your region.

This service is available in the following regions:

  • Canada
  • Chile
  • Colombia
  • Costa Rica
  • Japan
  • Kenya
  • Mexico
  • Nigeria
  • Pakistan
  • Poland
  • Rwanda
  • Uganda
  • Ukraine
  • United Arab Emirates
  • United States
  • European Union

To get started with manual enrollment:

  1. Access Apple Business through https://business.apple.com/.
  2. Enroll your company in the Apple Business Manager program and activate an Apple ID and password for your company. The user registered under the company Apple ID will be given the Administrator role will have access to self-manage all of the devices registered under your company.
  3. Additional users can be added by creating profiles granting limited privileges, such as the Enrollment Administrator role, who is able to perform enrollment tasks for new devices. These additional users will have limited access in contrast to Administrator role due to security policies. It is recommended in good practice to create these additional roles.

In contrast to automatic enrollment, manual enrollment requires third-party access to your company’s ABM portal. Third parties are able to perform necessary tasks for device registration on behalf of companies, which is why GroWrk will ask for access to your ABM portal, either with administrator or enrollment administrator permissions. After access is received with the correct permissions, GroWrk will proceed with enrolling new devices to your ABM inventory.

JumpCloud

For our team to complete the enrollment process of your devices, please provide the following information:

  1. Your MDM link or Agent
  2. Your Connect Key
  3. The username and password to start the device. It is recommended to use generic credentials to be used for all devices for this process.

GroWrk will pass this information to our warehouses to access your devices. The process should be completed in three to five business days. You’ll be notified after confirming with our warehouse that enrollment has been completed, and your devices will be visible in Device Management.

Windows Autopilot

Automatic Enrollment

After a device is purchased:

  1. Windows Autopilot will be pre-registered by our team.
  2. The device will be shipped to the assigned user.
  3. Finishing the process requires the user to connect to a network and verify their credentials, then device will be ready to use.

Manual Enrollment

After you purchase a device and indicate that it needs to be enrolled in Autopilot:

  1. GroWrk will confirm whether this service is available within the region.
  2. The hash will be shared to you as a link or in a CSV file.
  3. Register the hash in your console using the following steps:
    1. In the Microsoft Intune admin center, select Devices > Windows > Windows enrollment > Devices (under Windows Autopilot Deployment Program) > Import.
    2. Under Add Windows Autopilot devices, browse to the CSV file that lists the devices that you want to add.
    3. Select Import to start importing the device information. Importing can take several minutes.
    4. After import is complete, select Devices > Windows > Windows enrollment > Devices (under Windows Autopilot Deployment Program) > Sync.
      A message says that the synchronization is in progress. The process might take a few minutes to complete, depending on how many devices are being synchronized.
    5. Refresh the view to see the new devices.
    For more information, view Microsoft’s documentation here.

Azure

To enroll your devices with Azure, our team will follow the following steps:

  1. GroWrk will gather information about the device that is being enrolled, such as device type, make, model, and serial numbers (if available).
  2. Provide your company’s Azure AD domain name or tenant ID. This will help GroWrk ensure that the correct device is enrolled with your organization.
  3. Confirm your preferred enrollment method with us (e.g., Azure AD Join, Apple DEP, Android Enterprise).

Kandji

Automated device enrollment (all device types)

An Apple Business Manager account is required for automated enrollment. Please be sure to provide your account credentials to GroWrk and the team will follow this process:

  1. Assign Mac or iOS Devices to the Kandji MDM server inside of Apple Business Manager.
  2. Navigate to Devices > Automated Device Enrollment to confirm that the desired devices are listed in Kandji.
  3. Turn on the device, connect to the internet, and begin the Setup Assistant. A Remote Management screen during the setup process will confirm enrollment has been successful.

Jamf

For enrollment you will need:

  • Managed Apple IDs in Apple School Manager.
  • A push certificate in Jamf School (mobile devices only)

The GroWrk team will be able to install and enroll your devices in Jamf School with the following information provided by you:

  1. Your Jamf School credentials
  2. Network ID (listed in On-device enrollment (iOS & macOS) in Jamf School).
  3. Your users’ Managed Apple IDs.
  4. Device passcodes (for iOS devices only)

Addigy

Prerequisites for enrollment:

  1. An Apple Push Certificate, which needs to be assigned at a Global or Policy level.
  2. An Addigy account, with access to the dashboard.
  3. Add your organization in Addigy. (This is the first step for enrollment.)

Note that there are three installation methods available. Please consider which would be best for your organization, and we will confirm whether the service is available before we start the enrollment process.

  1. Automated Device Enrollment
    1. This method allows devices that have been added to Apple Business Manager to automatically enroll into Addigy. Devices properly configured to enroll via ADE will enroll automatically when they go through Setup Assistant. Configuring Automated Device Enrollment
  2. Device Enrollment (Manual enrollment)
    1. Allows you to either download the MDM directly, copy the download link and provide it to your users, or use a QR Code. ****Once the MDM enrollment profile is on the device, it will need to be manually approved by a user with admin credentials. More information can be found here: How To: Manually Enroll macOS into Addigy's MDM
  3. User Enrollment (BYOD)
    1. This method is for personal devices. It will push an MDM with limited control over the device. User Enrollment (BYOD)

Scalefusion

To enroll your devices, GroWrk will need the following:

  1. Your Scalefusion account credentials
  2. Organization-specific requirements to apply and define configuration policies

The following process will be performed:

  1. Configure Organization:
    • Set up your organization within Scalefusion.
  2. Enroll Devices:
    • Enroll devices into the Scalefusion MDM solution using the appropriate enrollment method for your devices.
  3. Configure Policies:
    • Define and apply configuration policies to devices based on your organization's requirements.
  4. Manage Apps and Content:
    • Utilize the app management and content distribution features to deploy and manage applications and content on enrolled devices.
  5. Monitor and Troubleshoot:
    • Use the monitoring and troubleshooting tools to track device status and address any issues that may arise.

For more information, view Scalefusion’s documentation for Macs and Windows.

Kolide

GroWrk may require your Kolide credentials to perform the following processes according to your device operating system:

For iOS devices:

  1. First, obtain the macOS Kolide agent installer for your Kolide account.
  2. Open the kolide-launcher.pkg file to begin the installation process.
  3. When the installation wizard opens, select Continue.
  4. Select Install.
  5. If prompted for Touch ID or administrative permissions, enter them and select Install Software.
  6. Once the installation is complete, select Close.

Granting full disk access

Mac devices utilize a granular permissions system to limit applications’ access to important system or user files. Without additional access, Kolide may be unable to check plain-text credentials in Downloads, Documents, and Desktop folders. If full disk access is something you wish to enable, GroWrk will follow this process:

  1. Click the Apple icon in the top left corner of your screen and then select System Settings from the pull-down menu.
  2. In the left menu pane of the System Settings window, select the menu item labeled Privacy & Security.
  3. In the right pane, select Full Disk Access.
  4. Find the line item for Kolide and select the toggle to enable full disk access. Once selected, you may need to provide a password or a biometric confirmation to confirm the change.

For Windows devices:

  1. First, obtain the Windows Kolide agent installer for your Kolide account.
  2. Double-click the kolide-launcher.msi file to begin the installation wizard.
  3. Follow the on-screen instructions to complete the installation.
  4. If prompted, reboot the computer.

For more details, view Kolide’s documentation.

OperationsSustainable Procurement
SupportSupport Tickets