Skip to main content

Enroll Windows MDM Using a Provisioning Package

Overview​

Bulk enrollment with Windows MDM improves the onboarding process for IT Admins by simplifying and expediting device enrollment of Windows 10/11 laptop and desktop devices.

Users can download an XML archive containing configuration files, import the files in Windows Imaging and Configuration Designer (WCD), export the provisioning package to a USB flash drive, start the device, enroll in MDM, download the Agent, and access the device with a dynamically created account readily available on the Home screen.

Features​

  • Create a pre-configured installation enrollment provisioning package file (.ppkg) and deploy to all Windows 10 and 11 endpoints.
  • Highly scalable: bulk enroll devices with the same configuration files quickly and efficiently.
  • Reduce the time it takes to deploy from hours to minutes.
  • Reduce the calls to Support for manual deployments.

Prerequisites​

  • Make sure your device is running Windows 10 or 11.
  • Install Windows Configuration Designer.
  • Admin must have “Administrator” or “Administrator with Billing” privileges to download the XML configuration from the JumpCloud Admin Portal.
  • Internet access is required. Devices must either be connected to LAN, or the WiFi configuration must be added to the provisioning package.
  • To streamline the provisioning process for you and your end-users, enable self-service account provisioning. For more information, see Provision New Users on Device Login.

Considerations​

  • These configuration files expire after 90 days and are eligible for a maximum of 500 devices.
  • If you create a new configuration file, any older file will become invalid.

Create a Provisioning Package​

Download the JumpCloud configuration file and create a provisioning package in WCD.

  1. Log in to the JumpCloud Admin Portal.
Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

  1. Go to Device Management > Devices, then select the Devices tab.

  2. Download the configuration file.

    1. Click the + icon to add a new device.

    2. Click the Windows tab.

    3. In the Windows Install section, click the Create Provisioning Package tab, then click Download Configuration File.

      Windows Install screen with the Create Provisioning Package tab selected.

    note

    Save the configuration file in a recognizable folder so that you can add the ICD customization file to it later.

  3. Import the configuration file.

    1. Open Windows Imaging and Configuration Designer (WCD).

    2. Go to File > Open Project.

      Open Project command in Windows Configuration Designer.

    3. Browse to the ICD project file in the folder where you saved the XML configuration file.

      ICD project file in the configuration folder.

      note

      Open the ICD project file from a folder that also contains customizations.xml. The pre-configurations require both files in the same folder.

    4. Select jumpcloud.icdproj and click Open. A new tab displays the provisioning package project.

  4. Add customizations in WCD.

    1. Configure an admin account with administrator privileges.

      • Expand Accounts and select Users.

        User account settings in Windows Configuration Designer.

      • In the UserName field, enter the name of the local admin user, then click Add. A red exclamation mark appears next to Users.

      • Expand Users and select the UserName field.

      • In the Password field, enter a password.

      • In the UserGroup field, select Administrators from the drop-down menu.

    2. (Optional) To configure wireless connectivity, see the Microsoft documentation.

      Wireless connectivity settings in Windows Configuration Designer.

    3. (Optional) If you are using a Windows Home device, enter a Windows product key to upgrade to an MDM-compatible OS version.

  5. Export the provisioning package to a USB drive.

    1. In WCD, click Export, then select Provisioning package.

      Provisioning package export command in Windows Configuration Designer.

    2. (Optional) Configure additional policy settings in the Settings section.

    3. Complete the Build wizard options.

    4. (Optional) Encrypt and sign the package with a certificate.

      Options to encrypt and sign the provisioning package.

    5. On the Select where to save the provisioning package screen, save the file to a USB drive.

    6. Click Build.

    7. When the build is complete, click Finish.

    8. Click Output location to review the generated files.

For more information, see the Microsoft documentation.

Apply a Provisioning Package​

Apply a provisioning package from a USB drive during initial device setup.

  1. Start the Windows device on the initial setup screen. Windows initial setup screen.

  2. Insert the USB drive and click Install provisioning package, then click Next.

    note
    • If there is only one provisioning package on the USB drive, the provisioning package is automatically applied.
    • If nothing happens when you insert the USB drive, press the Windows key five times.

  3. When the .ppkg file is installed, remove your USB drive and Windows will continue provisioning the device.

    note

    It may take up to 5 minutes for the provisioning package to finish installing.

    Windows device completing provisioning.

Apply a Provisioning Package to Previously Set Up Devices (Non-OOBE)​

Apply a provisioning package to a device that has already been set up.

  1. Go to Settings > Accounts > Access work or school > Add or remove a provisioning package, then click Add a package.
  2. In the Choose a method section, select Removable Media.
  3. Select the JumpCloud .ppkg file you want to apply, then click Add.
  4. Confirm you want to allow the file to make changes to your device, and that it is from a trusted source.
note

For more information, see the Microsoft documentation.

Opening the Provisioning Package from the Desktop​

You can also apply a provisioning package by opening its .ppkg file from the Windows desktop on a device that has already been set up.

  1. Open the JumpCloud .ppkg file.
  2. Click Yes, add it.
  3. Wait for the device to restart. The device displays a prompt that it will restart in one minute.
  4. After the device restarts, verify that it appears in the JumpCloud Admin Portal. The package enrolls the device in mobile device management (MDM) and installs the JumpCloud Agent.

If the device does not appear in the Admin Portal, start the JumpCloud Agent service in services.msc or restart the device again.

Troubleshooting​

Symptoms

The provisioning package completes but presents the following errors:

  • "Setup completed with errors"
  • "Enroll in device management: Failed"

Cause

The device isn't connected to the internet while running the provisioning package. This can be caused by lack of LAN/Ethernet connection, or an incorrect WiFi configuration.

Resolution

Ensure the device is connected to LAN while running the provisioning package, or ensure the WiFi configuration within the package is correct. To check the WiFi configuration, see the wireless connectivity instructions in step 5 under Create a Provisioning Package.

Was this information helpful?