Enrolling Windows 10 Devices

The first step to start managing your Windows 10 devices is to enroll them to MobiLock Dashboard. In this guide we will look at the steps to prepare for enrollment and look at the various enrollment methods.

Before You Begin

  1. Make sure to have a valid MobiLock Dashboard account.
  2. Login to MobiLock Dashboard.
  3. Have access to one Windows 10 laptop, or desktop or surface device for enrolling.

Step 1: Create a Device Profile

Start by creating a Device Profile. Device Profiles are a nifty way to group your policies together that can be applied to one or multiple devices. In this guide we will create a basic Windows Device profile to get started with enrollment. To understand the various policies and how to configure them refer to our detailed guide on Windows Device Profile. Here are the basic steps to get you started,

  1. Navigate to Device Management > Device Profile. Click on CREATE NEW PROFILE.
  2. In the create profile dialog, select Windows, give a name to your profile and click SUBMIT.
  3. Create the Device Profile, by configuring an Application Policy and configuring the other Settings.
    We have pre-populated a list of selected applications. You will not see all the applications installed on your test device. The applications installed on the devices will start appearing once they are enrolled.
  4. Once you have selected an application policy and configured your settings, click on CREATE PROFILE. Once the profile is created it will start appearing in the list of profiles as shown below.

Step 2: Create a Enrollment Configuration

The next step is to create an Enrollment Configuration. Enrollment configurations are useful to create basic rules for enrollment like device naming convention, the default device profile or group for devices and a default license that should be applied. Once created you can get a QR Code for your enterprise mobile devices and a URL for enterprise Windows 10 devices. Follow the steps below to create a configuration,

  1. Navigate to Device Enrollment > QR Code. Click on CREATE.
  2. In Basic section, give a name for your configuration and select a naming convention for the devices that enroll using this configuration. Click NEXT to go to next step,



    Selecting Use OS Name as name prefix, prefixes the device names with their OS types. For example a Windows device will be prefixed with Windows- and an Android device will be prefixed with Android-
  3. In the Group/Profile section, under Windows Device Profile dropdown, select the windows profile that we created in Step 1. Click NEXT
    You can use the same configuration across Android, iOS and Windows devices.
  4. The License section helps you set a default license for the devices enrolled using this configuration. This is an optional section and can be left blank. If the selected licenses has no free slots or this option is left blank, then the next available license is used to enroll the device.
  5. Click on SAVE to create the configuration. Once a configuration is created it will appear in the list of enrollment configurations.
  6. To enroll your Windows 10 devices, you would need the enrollment URL. To get the enrollment URL, click on the configuration from the list and click on the Copy icon to copy the URL.
Use the option from the action panel, to have the enrollment URL & steps sent to your registered email.

Step 3: Enrolling your Windows 10 Device

Now that you have created a configuration and have got a enrollment URL, you can start enrolling Windows devices. You can enroll your Windows device using Microsoft Edge OR using the Connect to Work or School App that comes pre-loaded on Windows 10 devices. Here we discuss both the approaches.

Enrolling Windows 10 Device using Microsoft Edge

Enrolling using Microsoft Edge is most hassle free way of on-boarding your Windows devices and we recommend using this method whenever possible.

  1. Power on your Windows device and sign in to the machine. Launch Microsoft Edge from the Start Menu
  2. Copy/Paste the enrollment URL that was generated in Step 2 and hit the Enter key.
  3. If the URL is valid, then post validation, a dialog will be shown asking for permission to open Microsoft Account. Click Yes
  4. Clicking on Yes in the above step will open the Connect to Work or School app. The email id of the MobiLock Dashboard admin will be pre-filled along with the enrollment URL. Click Next.
    If you are enrolling an employee's device, or want to enroll it using a different email, you can change the email id. This will be the email id associated with that device in MobiLock Dashboard.
  5. At this point the enrollment of the device will start and you will see some progress screens as shown below.
  6. On a stable internet connection, it should take around a couple of minutes to complete registration. Click Got It when you see this screen.
  7. This completes the enrolling. At this point the device will start communicating with MobiLock Dashboard and will take about another couple of minutes for the policies to be applied.

Enrolling Windows 10 Device using Connect to work or school App

Windows 10 devices come pre-loaded with the default application Connect to work or school App, that lets you enroll your device to an MDM. There might be some cases where you want to use this application to enroll your device instead of using Microsoft Edge. In such cases please follow the steps below,

  1. Power on your Windows device and sign in to the machine.
  2. From the Start Menu, search for Connect to work or school and launch the application.
  3. You would see a screen as shown below. In most Windows 10 devices you would see the two options,
    1. Enroll only in Device Management: This is the preferred approach for enrollment. Select this option.
    2. Connect: If for some reason Enroll only in Device Management is not available then select this option.
  4. This will start the enrollment process and show you the first screen.
  5. If you had started enrollment using Enroll only in Device Management then you can use your enterprise e-mail address, however if you started the flow using Connect then you would have to use a dummy email address as Microsoft tries to validate the domain and tries to onboard using that domain. Click NEXT
  6. The application will try to validate the entered e-mail and show a screen below. In this screen Copy/Paste the enrollment URL that was generated in Step 2 and click NEXT.
  7. At this point the enrollment of the device will start and you will see some progress screens as shown below.
  8. On a stable internet connection, it should take around a couple of minutes to complete registration. Click Got It when you see this screen.
  9. This completes the enrolling. At this point the device will start communicating with MobiLock Dashboard and will take about another couple of minutes for the policies to be applied.

Validating the Enrollment

  1. Once the device is successfully enrolled it will start appearing on MobiLock Dashboard under Devices section as a Managed device.
  2. On the enrolled Windows 10 device if you open the Connect to work or school application, it will now display the device management state.
  3. Clicking on Info button in the above screen will show you that the device is managed by MobiLock Pro and show you the Device sync status.
If you see that the device is not sync'ing the latest policies, you can use Sync button in above screen to initiate a manual sync with MobiLock Dashboard.

Frequently Asked Questions

Question: We can see a Disconnect button when we open the Connect to work or school app, does that mean end-users can unenroll the device?

Answer: No. Clicking on Disconnect will show an error to the end user. The ONLY way to unenroll the device is to delete the device from MobiLock Dashboard.

Question: When we open the URL in Microsoft Edge or Connect to work or school app, we see an error?

Answer: Most probably the URL is invalid. Please try to copy/paste the URL again. If it still does not work, please contact our support.

Question: We have multiple local user-accounts on our Windows device. Does enrollment from user account, enforce the policies when logged in with other user-accounts?

Answer: No. Enrollment is specific to a user-account. If there are multiple user-accounts, we suggest disabling other accounts and having one administrator account and one user-account. We suggest keeping the credentials to administrator account private and enroll while signed into the user-account.

Question: We use an Active Directory and our users login using a domain joined account. Can we auto-enroll the devices when users login to their AD account?

Answer: Yes*. That should be possible with the help of your AD/IT admin. If the enrollment URL is configured on a per user basis then enrollment could be automated. However AD configuration varies quite a lot and things might not work always.


How did we do?