Getting started with Enrollment Configurations

Introduction

The following is a description of how to create and use enrollment configurations in CapaInstaller.

Enrollment configurations enable fast and easy enrollment of mobile devices for administration, according to the relevant business units and other company structures.

When enrolled via a specific enrollment configuration the device is sorted and categorized, ready for management, the second it is enrolled.

Requirements

Technical requirements

iOS specific requirements

Simple Certificate Enrollment Service

Simple device enrollment: The default configuration

CapaInstaller enables administrators and users to enroll devices in a simple manner, right out of the box.

Enrolling devices are enabled by default via the Default Enrollment Configuration. Simply point an internet browser on the device, to the default enrollment URL.

https://<server>:443/cimdm/

This configuration is configured with AD authentication and devices enrolled will not be joined into any groups or have any asset tags applied. Enrolled devices will end up in the root of the “Computers and Devices” section among all your other non-sorted devices and computers.

To utilize the more powerful features of the Enrollment Configuration system administrators should clone the default configuration and create a set of new enrollment configurations fitting for the organization’s enrollment needs.

Device enrollment: Creating your first Enrollment Configuration

Configuration dialog
When you open the configuration dialog it will only contain the general section, where you can specify a name, description, and enrollment ID. The enrollment ID will be a part of the enrollment URL and is limited to 15 characters. Once created the Enrollment ID string cannot be altered. You can add additional sections of settings to the configuration by clicking the buttons on the left side. Once added, they can be removed again by clicking the red x in the upper right corner of a section.

Configuration dialog

When you open the configuration dialog it will only contain the general section, where you can specify a name, description, and enrollment ID. The enrollment ID will be a part of the enrollment URL and is limited to 15 characters. Once created the Enrollment ID string cannot be altered.
You can add additional sections of settings to the configuration by clicking the buttons on the left side. Once added, they can be removed again by clicking the red x in the upper right corner of a section.

Location and Groups

In the location and groups section, you can choose where the target devices are placed in your CapaInstaller management infrastructure during enrollment.

First, you decide on a Management Point (CMP) and a Business Unit (BU), and then you can select a unit folder in either the CMP or BU.

Next, you can choose one or more groups in the CMP and/or BU that the devices should be made members of during enrollment.

This enables fine-grained sorting of devices enrolling in CapaInstaller. Sort units by Company, Location, Department or any other structural division your organization are built around.

If this option is not configured, devices will still be able to enroll, but like the default enrollment configuration, they will end up in the root of the “Computers and Devices” section among all your other non-sorted devices and computers in the default management point.

Asset tags

To offer even finer granularity in enrollment scenarios, and to support customers utilizing CapaInstaller Asset Management in identifying and describing company devices, this configuration option offers to assign asset tags to devices.

The asset tags which can be chosen here are created in Work with assets.

Click the Add button in the Asset tags panel to open the Asset Browser dialog.

You can select multiple values in the same entry to give the enrolling user a choice between them, or you can select only one value if you don’t wish to give the user a choice.

The values you or the enrolling user chooses will be assigned to the enrolled devices.

Authentication

This option offers the possibility to secure enrollment with authentication and enables support for linking users to enroll devices.

Three authentication modes are offered.

Active Directory
Simple
None

If you have no access to authentication via an Active Directory you can set up a simple user/password to be asked at the enrollment page prior to enrolling the device.

Linked user: Select existing users to link the device to or prompt for a username on the enrollment page. This option is available for Simple and None authentication modes. If AD authentication is chosen, the AD user enrolling the device will also be linked to the device.

Below is an example of a configuration with simple authentication chosen, and the user enrolling a device will be asked to supply a user name to be linked to the device.

Example of a configuration with no authentication selected, where all devices being enrolled using it will be linked to the same user:

VPP Enrollment

In the Volume Purchase Program section, you can select one of your VPP accounts and/or give the user the option to choose one during enrollment. Devices running iOS8 or higher, enrolled with this configuration, will receive an invitation to the selected VPP account. This will associate the Apple ID on the device with the VPP Account, once the user on the device accepts the invitation.

The combination of this VPP setting and which groups devices should be made members of, enables users to enroll their device, and without further actions from an administrator be able to receive licensed applications.

A possible enrollment scenario to take advantage of this:

Devices are made a member of a group that contains some licensed applications, which are configured to retrieve licenses from the same VPP account selected in this configuration. Once devices are enrolled, an invitation to VPP is sent and applications from the groups are assigned. The first attempt to install the licensed applications will result in the status ‘Needs license key’. Once the user accepts the invitation sent to their device, they will be associated with the VPP account, and the system will periodically check and assign the license they need and attempt the installation again.