# Can users self-enroll securely?

Yes. Hexnode UEM supports secure self-enrollment, allowing employees to register their devices into the management system without direct IT intervention while maintaining strict security standards.

Key Security Mechanisms for Self-Enrollment
-------------------------------------------

Hexnode employs multiple layers of protection to ensure that only authorized users can enroll their devices:

- **Identity Provider (IdP) Integration:** Secure enrollment using existing corporate credentials via Active Directory, Microsoft Entra ID, Google Workspace, or Okta.
- **Mandatory Authentication:** Requires users to verify their identity through an additional layer, such as an Email/SMS OTP or a unique enrollment passcode.
- **Authentication Passcodes:** Admins can generate time-bound, one-time-use passcodes for specific users to prevent unauthorized access.
- **Domain Restrictions:** Enrollment can be restricted to specific organizational domains, ensuring only company-affiliated emails are accepted.

**How the Secure Self-Enrollment Process Works**
------------------------------------------------

The process is designed to be user-friendly yet robust. Below is the typical workflow:

- **Portal Access:** The user navigates to the organization’s dedicated Hexnode enrollment URL (e.g., yourdomain.hexnode.com).
- **Authentication:** The user enters their corporate credentials or the one-time passcode provided by the IT admin.
- **Terms & Conditions:** The user must review and accept the organization’s Terms of Use and Privacy Policy before proceeding.
- **Profile Installation:** Hexnode validates the device and prompts the user to install the UEM profile or agent.
- **Automated Configuration:** Once the profile is verified, the device is automatically encrypted and populated with necessary corporate apps and policies.