Enrollment

What does this do?

Enrollment is how an Android device joins KMM. During enrollment the device installs Android Device Policy, connects to your enterprise and lands in the device group you chose. From then on the device receives the policies, applications and settings of that group.

KMM supports three ways to enroll a device. All three start from the same thing: an enrollment token created in KMM.

• Zero-touch enrollment. The device enrolls by itself the first time it is switched on and connected to the internet. Nothing is typed on the device.
• QR code enrollment. The person setting up the device scans a QR code shown in KMM.
• Token enrollment. The person setting up the device types the token code shown in KMM.

Zero-touch is meant for fleets of new devices bought from a zero-touch reseller. QR code and token enrollment are meant for devices you set up by hand, one at a time.

Before You Start

• You need an editor or admin role to create or delete enrollment tokens. Viewers can open the page but cannot change anything.
• The device group the devices should join must already exist. Create it under Device Groups first.
• The device must be new or factory reset. Enrollment happens during the Android setup wizard and cannot be done on a device that is already in use.
• For zero-touch, the device must have been bought through a zero-touch reseller and be registered to your company in the zero-touch portal. Kuori manages the zero-touch portal on your behalf.

Zero-touch and manual enrollment do not mix

A device that is registered for zero-touch always enrolls through zero-touch. When such a device is switched on, Android fetches the zero-touch configuration before the setup wizard offers any other choice. You cannot skip it, scan a QR code or type a token on that device.

If you need to enroll a zero-touch device with a QR code or a token instead, ask your KMM administrators to remove the device from zero-touch first. Once the device has been removed, factory reset it and proceed with QR code or token enrollment as described below.

Creating an Enrollment Token

Every enrollment method needs a token, so create one first.

1. Open Enrollment Tokens in the side menu.
2. Select Create +.
3. Enter a Display Name so you recognize the token later.
4. Choose a Duration. This is how long the token stays valid, from half an hour up to five years, or Forever. Devices enrolled with the token stay enrolled after the token expires; only new enrollments stop.
5. Choose the Device Group the enrolled devices should join.
6. Additional Data is optional text saved with the token. You can leave it empty.
7. Switch One Time Only on if the token may be used for exactly one device. Leave it off for a token you will use for many devices.
8. Management and Required Account Email are only available for a Domain-Managed Enterprise. For other enterprises they are shown crossed out and the default is used. If you need them, upgrade the enterprise via the Enterprise page first.
9. Management and Required Account Email only works with domains where Enterprise has been binded to. For example if enterprise is binded to kuori.tech domain, only @kuori.tech emails will work with this.
10. Select Save.

The new token appears as a card on the Enrollment Tokens page. The card shows:

• Expiration as a UTC time.
• Personal Usage, Required Account Email and Device Group as chosen when the token was created.
• Token, the code used for token enrollment.
• QR Code, collapsed by default. Select the heading to show the code.
• Zero Touch DPC Extras, the text Kuori needs for zero-touch, with a Copy to clipboard button.

An expired token shows an Expired badge at the top of its card. Editors and admins can delete a token with the red delete button. Deleting a token does not unenroll devices that already used it.

Zero-touch Enrollment

With zero-touch the enrollment token is applied to the devices by Kuori, not on the device itself.

1. Create an enrollment token as described above. Use a long Duration or Forever, and leave One Time Only off, so the same token works for every device in the batch.
2. On the token card, select Copy to clipboard under Zero Touch DPC Extras.
3. Send the copied text to Kuori together with the list of devices that should use it. Kuori adds the configuration to your company in the zero-touch portal and assigns it to your devices.
4. Hand the devices to their users. When a device is switched on for the first time and connects to Wi-Fi or mobile data, it enrolls into the device group of the token without anyone doing anything on the device.

If a device was bought as zero-touch but has not been registered to your company yet, give Kuori the device serial numbers, manufacturer and model.

QR Code Enrollment

Use this when you set up devices by hand and have KMM open on a screen next to you.

1. Create an enrollment token as described above, or open an existing one that has not expired.
2. On the token card, select the QR Code heading to show the code.
3. Factory reset the device if it is not new, then switch it on.
4. On the Android Welcome screen, tap the same spot on the screen six times or in the email field, enter afw#setup and continue
5. The device asks to connect to Wi-Fi and then opens the QR code scanner. On some devices the scanner is offered directly on the Welcome screen.
6. Scan the QR code shown in KMM.
7. Follow the steps on the device. The device installs Android Device Policy, enrolls into KMM and applies the device group of the token.

Token Enrollment

Use this when you cannot scan a QR code, for example when the device has no camera or when you are giving instructions over the phone.

1. Create an enrollment token as described above, or open an existing one that has not expired.
2. Note the code shown under Token on the token card.
3. Factory reset the device if it is not new, then switch it on.
4. Go through the Android setup wizard until the Google sign-in screen.
5. In the email field, enter afw#setup and continue. The device installs Android Device Policy.
6. When asked for the enrollment code, type the Token exactly as shown in KMM.
7. Follow the remaining steps on the device. The device enrolls into KMM and applies the device group of the token.