Skip to main content

Device Management (MDM) for Organizations in the Enterprise Portal (Preview)

Configure Mobile Device Management (MDM) for Windows, Apple, and Android devices across your organizations from the Enterprise Portal. Each Organization can also manage their own MDM resources respectively.

Terminology:

  • Enterprise Portal: Portal where Enterprise Admins manage settings for multiple organizations under one Enterprise. Differs from the JumpCloud Admin Portal, which is for one organization.
    • Enterprise (formerly Enterprise Configuration): Centralized hub for all the organizations' objects in the Enterprise Portal. Items can be created and shared for organizations in the Enterprise Portal from this hub.
  • Organizations: A division of the enterprise (for example a region or a country) that maintains its own users, devices, and resources.
  • Enterprise Administrator: Admin who has full access to all orgs and enterprise resources.
  • Organization Administrator: Admin whose access is limited to explicitly granted orgs.

Enterprise Portal Admins can see all of the devices they manage across all orgs in the Enterprise Portal, and quickly take action to resolve any issues. You can filter by Organization, Status, or Device OS to see which devices require action and select from options like locking, restarting, or shutting down devices. You can also start Remote Assist from here. See Manage Devices in the Enterprise Portal to learn more.

Windows MDM​

Admins can enroll devices in Windows MDM using one of the following methods:

note

Each device enrolled in Windows MDM is associated with its specific organization.

Apple MDM​

Apple Push Notification Service (APNs) Configuration​

The Apple Push Notification Service (APNs) certificate is configured and managed solely in the MDM page of the Enterprise. Organizations inherit this certificate and cannot upload, replace, or delete it.

Prerequisites:

  • You must have Enterprise-level Administrator privileges to configure APNs.

Considerations:

  • Every Organization inherits the APNs configuration from the Enterprise. This configuration is visible under Organizations, but it is not editable.
  • APNs certificates need to be renewed yearly to continue to securely manage and communicate with Apple devices.
  • Enterprise Admins can download enrollment profiles for any organization. Organization Admins can download the enrollment profile for their organization. Devices enroll into an organization, not into the Enterprise layer itself.

To configure APNs in the Enterprise Portal:

  1. Log in to the Enterprise Portal.
  2. In the top right, open the organization selector and select Enterprise.
  3. Go to Device Management > MDM. Confirm the badge under MDM shows Enterprise.
  4. Click the Apple tab.
  5. Under APNs Configuration for MDM, complete certificate setup for your Enterprise.

Automated Device Enrollment (ADE) Configuration​

For organizations using Automated Device Enrollment (ADE), configuration requires linking JumpCloud to a unique Device Management Service in Apple Business Manager or Apple School Manager via a JumpCloud-generated key. Enterprise Admins can add and manage tokens at the Enterprise level. Organizations inherit those tokens by default. Organization Admins can also add an ADE token for their specific organization.

On the ADE tab, you can:

  • View Server Tokens across organizations, including which organization manages each token, token status, expiration, and device count.
  • Open All Devices to review ADE devices associated with those tokens.
  • Click + Add to upload a new server token.

You can manage multiple ADE server tokens at the Enterprise level. Each token represents a Device Management Service in ABM or ASM, keeps its own macOS and iOS/iPadOS enrollment settings, and tracks its own synchronized devices. JumpCloud prevents the same Apple Device Management Service from being connected to more than one organization in the Enterprise.

Considerations:

  • ADE tokens added at the Enterprise are inherited by organizations.
  • Each ADE server token must be renewed yearly for automated enrollments to continue working.
  • After tokens are linked, assign device records in ABM or ASM to the correct Device Management Service.

Understanding ADE Device Placement​

When an Apple device is enrolled through ADE with an Enterprise-managed token, organization placement is based on the User Authentication setting in the ADE enrollment configuration (macOS or iOS/iPadOS):

User AuthenticationWhere the device enrolls
EnabledThe organization the authenticated user belongs to
DisabledThe default organization for the Enterprise

For a token uploaded directly to an organization, enrolled devices land in that organization. User Authentication can still control the enrollment experience, but it does not change which organization receives the device.

To configure ADE, see Configure Automated Device Enrollment to learn more.

To create a Device Management Service in Apple Business Manager:

  1. Log in to Apple Business Manager, select your profile name, then select Preferences.
  2. Click on Device Management Services, then click Add.

After creating and linking the Device Management Service, configure the end user’s setup experience for macOS and iOS/iPadOS enrollments that use ADE.

To configure the ADE user enrollment experience:

  1. From the Enterprise Portal, in the top right, open the organization selector and select Enterprise.
  2. Go to Device Management > MDM.
  3. Click the Apple tab.
  4. Under ADE Configuration, click Manage ADE, then open the token you want to configure.
  5. Click Configure macOS or Configure iOS and iPadOS.
  6. Set the Setup Assistant options for your enrollment flow.
  7. Under User Authentication, select Enable if you want devices to enroll in the organization of the authenticating user. Clear Enable if new devices should enroll in the default organization.
  8. Click Save.

For Setup Assistant options and zero-touch enrollment details, see Configure Automated Device Enrollment.

Once the Organizations are set up with their respective ADE connection and the associated enrollment settings, device records in Apple Business Manager need to be assigned to the correct Device Management Service.

note

The Device Management token expires after one year and will need to be renewed for automated device enrollments to continue working.

Personal Device Enrollment and Account-Driven User Enrollment (ADUE)​

Account-Driven User Enrollment (ADUE) is supported for iOS and iPadOS devices only. Personal device enrollment and ADUE enroll each device into the organization the user belongs to.

You configure these settings in the Enterprise Portal > Device Management > MDM > Apple under iOS Enrollment. Organizations can inherit the Enterprise settings or override Personal Device Enrollment where allowed.

For Redirect, Host File, and Apple Business Manager setup details, see Configure Account-Driven Enrollment. Use the sections below for Enterprise Portal–specific considerations and configuration details.

To configure personal device enrollment:

When enabled, users can enroll personal iOS devices from the User Portal under Security > Enroll your iOS Device. Enrolled devices appear in the Admin Portal for the user’s organization. You can also choose a device group to add enrolled devices to automatically.

  1. From the Enterprise Portal, in the top right, open the organization selector and select Enterprise.
  2. Go to Device Management > MDM.
  3. Click the Apple tab, then scroll to iOS Enrollment.
  4. Under Personal Device Enrollment, select Allow users to enroll personal mobile devices and access Enroll Your iOS Device in the User Portal.
  5. Under Select which Device Group to automatically add devices to, select a device group.

Understanding Account-Driven Enrollment Methods​

Select a method to enable Account-driven Enrollment:

  • Redirect (JumpCloud-supplied URL)
  • Host File (self-hosted JSON)
  • Apple Business Manager (fallback service discovery; additional ABM or ASM requirements)

See Configure Account-Driven Enrollment to learn more and how to configure each method.

Configuring Account-Driven Enrollment with Apple Business Manager​

The Apple Business Manager option uses Apple’s fallback service discovery. Devices retrieve the enrollment redirect URL from the Device Management Service configured as the default in ABM or ASM. Use this when you are not configuring Redirect or Host File, or when you need Apple’s fallback path.

Considerations:

  • ADUE with the Apple Business Manager option is for iOS and iPadOS only (iOS/iPadOS 18.2 or later for this discovery method).
  • ADE must already be configured in JumpCloud, and your domain must be verified in ABM or ASM.
  • In ABM or ASM, set that Device Management Service as the default for iPhone and iPad devices.
Important

If you do not configure Redirect or Host File and rely only on the Apple Business Manager fallback option, service discovery uses the default Device Management Service for iPhone and iPad devices in ABM or ASM.

Apple allows only one default Device Management Service per operating system. If your Enterprise has multiple ADE tokens (multiple MDM servers in ABM), JumpCloud and ABM still use a single default server for this discovery path. When defaults are unchanged, the first JumpCloud-linked Device Management Service token uploaded in ABM is typically the default.

If you have several MDM servers in ABM and their tokens all reside in JumpCloud, choose one Device Management Service as the ADUE discovery target, then set that server as the default for iPhone and iPad devices in Apple Business Manager. Confirm the default matches the JumpCloud ADE token you intend to use for Account-driven Enrollment.

  1. From the Enterprise Portal, in the top right, open the organization selector and select Enterprise.
  2. Go to Device Management > MDM.
  3. Click the Apple tab, then scroll to Account Driven Enrollment Configuration.
  4. Select Apple Business Manager.
  5. Click Enable.
  6. Under Test Your Configuration, click Test to validate the enrollment flow for your ABM or ASM tenant.

Apple VPP Configuration​

Apple’s Volume Purchase Program (VPP) tokens added at the Enterprise automatically share down to all Organizations, allowing each Organization to deploy App Store applications on Apple devices. See Manage Software with Apple's VPP to learn more.

Considerations:

  • Each Organization can have multiple Apps & Books (VPP) content tokens added from different Apple Business Organizational Units. However, these tokens cannot be shared across different Organizations. The content tokens also need to be renewed once yearly.
  • Licenses for public and Custom/B2B applications must be purchased and allocated separately for each unique Organization in Apple Business Manager.

Additional Apple MDM Resources​

Android EMM​

Android Enterprise Registration in Enterprise Configuration​

Android EMM is registered and configured solely in the Enterprise MDM > Google tab. See Set Up Android EMM to learn more.

Considerations:

  • Every Organization inherits the Android EMM registration from the Enterprise.
note

The ability to delete an Android EMM registration is exclusively available within the Enterprise.

Turning On Google Authentication for an Enterprise​

If Organization Admins require end-user device authentication during the enrollment process, they must enable Google Authentication within the Google Admin Portal. See Configuring Device Authentication to learn more.

  1. Log in to the Google Admin Console.
  2. Go to Devices > Mobile & endpoints > Settings > Third-party integrations.
  3. Click the pencil icon next to the desired Android Enterprise Mobility Management (EMM) solution to edit it.

  1. Org Admins can enable/disable the integration by selecting or clearing the Enable third-party Android mobile management checkbox.
  2. Click Manage EMM providers.

A list of available EMM providers appears.

  1. Turn on the Authenticate Using Google option by toggling the button for the desired enterprise.

note

Enabling this feature will use your configured identity provider (IdP) to perform end user authentication, for example JumpCloud, Google, or another configured IdP.

Configuring Zero-Touch Enrollment​

Each Organization will need to enroll in Android Zero-Touch (ZTE) Portal individually.

From the JumpCloud Admin Portal, go to MDM > Google. Then scroll down to the Android Zero-Touch Enrollment section, and click Launch Zero-Touch Portal.

note

Google controls the Admin roles and permissions within the Android ZTE Portal. IT Admins accessing the ZTE portal via JumpCloud may see a different scope of devices than what is configured through JumpCloud's RBAC settings.

Enrollment Tokens​

As an Enterprise Admin, you can create Android enrollment tokens and select the organization each token belongs to. Devices that use the token enroll into that organization. When you view enrollment tokens from Enterprise, the Token Managed By column shows which organization owns each token.

Organization Admins create tokens for their own organization only. The organization is selected automatically.

Important

Ensure you’re using the correct tokens for your Organization. Don’t use tokens created in one Org to enroll devices intended for another.

  1. Log in to the Enterprise Portal.
  2. In the top right, open the organization selector and select Enterprise.
  3. Go to Device Management > MDM. Confirm the badge under MDM shows Enterprise.
  4. Click the Google tab.
  5. Under Android Install, click Create Enrollment Token, or go to Enrollment Tokens and create a new token.
  6. Select the enrollment type, then continue to the Enrollment Token step.
  7. Under Organization, select the child organization where the token should reside. The device enrolls into this organization.
  8. Under Name, enter a token name.
  9. Configure Token Use, Token Expiration, and whether to use the token for Zero-touch enrollment.
  10. Click Create Token.

For enrollment token options and device enrollment steps, see Adding Enrollment Tokens to learn more.

Commands, Policies, and Software Management​

Org Admins have comprehensive control over all enrolled devices within their Organization, encompassing Commands, Policies, and Software Management. See Managing Devices to learn more.

Commands: You can execute commands on Linux, macOS, and Windows devices. See Get Started: Commands to learn more.

Policies: Policies enable the customization of managed devices across various platforms, including Windows, macOS, iOS/iPadOS, Linux, and Android. See Get Started: Policies to learn more.

Software Management: In addition to Apple's VPP, software can be managed on Windows, macOS, Android, and iOS/iPadOS devices. See Get Started: Software Management to learn more.

note

Private and Web apps created within Google's Managed Google Play Store iFrame are universally accessible across all Orgs and can be added to the available applications list for each respective Org.

Was this information helpful?