Category Filter

G Suite Enrollment for Windows Devices

Hexnode’s seamless integration with G Suite helps businesses to import their users or groups directly to the MDM console. This fluid integration facilitates enterprises to enroll their Windows devices with the configured G Suite account.

First, the organization must set up G Suite with MDM to import its directories in Hexnode. After syncing the users with the portal, admin can either send enrollment requests to the G Suite (Google) users or allow them to enroll their devices with their dedicated credentials manually. In both cases, the users have to authenticate themselves with their G Suite usernames and passwords. In this way, G Suite users can enroll their Windows devices in Hexnode MDM.

Assign the devices to G Suite Users

Enrolling Windows devices via G Suite authentication is a two-step process:

  1. Configure G Suite
  2. Enroll Windows devices via G Suite Authentication

Configure G Suite

Note:

Your organization should have a G Suite account.


Create Service Account

Creating Service Account
  1. Using the G Suite admin credential, log in to Google Developers Console.
  2. Click on Create Project.
  3. Create a New Project by providing the following details.
    • Project Name: Provide a suitable project name, and a corresponding project ID will be generated.
  4. From the Navigation Menu on the left pane, select APIs and Services > Credentials.
  5. Click on Create Credentials and from the drop-down list that appears select Service account.
  6. Select New service account and provide the following details.
    • Service account name: Provide a suitable name for the service account.
    • Service account ID: An account ID will be automatically generated. If required, you can edit it.
    • Service account description: Provide a suitable description for your service account.
    • Click on Create.
  7. Role: From the drop-down list, select Service Accounts > Service Account Admin, and click Continue.
  8. From Navigation menu > IAM & Admin > Service Accounts. Select your service account and click on Actions > Edit.
  9. Select the checkbox Enable G Suite Domain-wide Delegation.
  10. Click on Add Key > Create new key and choose the key type as JSON and click on Create.
  11. A JSON key will be downloaded. This key is later uploaded on to Hexnode MDM server.
  12. Click on Save.
  13. Now, click on View Client ID.
  14. Copy the Client ID.
  15. From the Navigation menu, select Dashboard and click on Enable APIs and Services.
  16. In the search box that appears, type admin sdk and select the same from the search results.
  17. Click on Enable to enable Admin SDK API.

Manage API Client Access for MDM

This process provides the MDM with specific API access to apply the configurations to the managed devices. Ensure to Enable API access in the Admin console.

Manage API Client Access for MDM
  1. Using your G Suite Admin credentials, log in to Google Admin Console and click on Security.
  2. From API Permissions, click on MANAGE DOMAIN WIDE DELEGATION, and click on +Add new.
  3. Authorize the API clients by providing the following details.
    • Client ID: Paste the Client ID copied from Google Developer Console.
    • OAuth scopes: Copy and paste the link https://www.googleapis.com/auth/admin.directory.user – To sync individual users.
    • https://www.googleapis.com/auth/admin.directory.group – To sync user groups.
    • Click on Authorize.

    Note:

    To sync user groups from your G Suite account to the Hexnode console, you need to provide both the URLs separated by comma.

Integration of G Suite with Hexnode MDM Server

  1. Log in to your Hexnode MDM portal.
  2. Navigate to Admin > G Suite.
  3. You will have the following options to be configured.

    Configure G Suite with Hexnode MDM for Windows enrollment
    • G Suite Admin Email: Enter the G Suite admin email address of the domain that you want to synchronize with Hexnode.
    • Domain Name: Provide the domain name of the G Suite account where the users you want to sync with Hexnode resides.
    • G Suite key: Upload the JSON key previously downloaded.
  4. Click on Save to configure G Suite.

Enroll Windows devices via G Suite Authentication

Once the G Suite account is configured, you can start enrolling your Windows devices in Hexnode MDM.

Step 1: Enrollment Setup

You can either send enrollment requests (Email/SMS) to the G Suite users or allow them to enroll manually using the ‘Self Enrollment’ feature.

Send enrollment requests to G Suite users
  1. Go to Enroll > Platform-Specific > Windows > Windows PCs & Tablets.
  2. Switch the authentication mode to Authenticated Enrollment.
  3. Select Google User under Enrollment Request. In this case, users will receive an email or SMS with the Hexnode server address and other enrollment instructions.
  4. Change the device Ownership if required.
  5. Click Next.
  6. Select the mode for sending enrollment requests to the G Suite users as Email, SMS, or even both.
  7. Change the Domain from Local to your G Suite domain and select the user you need to send the enrollment request.
  8. Click Send. The enrollment request will be successfully sent to the selected Google user.

Note:

Apart from the method mentioned above, you can also send enrollment requests to the required Google users under Manage > Users/User Groups/Directory Services > Select users > Actions > New Enrollment.


Self Enrollment
  1. Go to Enroll > Platform-Specific > Windows > Windows PCs & Tablets.
  2. Switch the authentication mode to Authenticated Enrollment.
  3. Select Google User under Self Enrollment.
  4. Change the device Ownership if required.
  5. Click Next.
  6. The enrollment settings will be successfully updated, and the users can now enroll their devices with their dedicated credentials.

Step 2: Enroll the device via Authenticated Enrollment

Hexnode offers two enrollment methods to enroll Windows devices.

Method 1: Using Hexnode Installer App

Follow the below steps on your Windows machine to enroll it using the Hexnode Installer app:

  1. Enter the Hexnode enrollment URL on a web browser. The URL will be of the format:
    https://{portalname}.hexnodemdm.com/enroll/
  2. The URL will take you to a page where you can download the Hexnode Installer app.
  3. Click Download to initiate the Hexnode Installer app download.
  4. Open the app and click Yes on the ‘Hexnode Installer Setup’ wizard to grant permission for the app to make changes to the device.
  5. Click Install to continue with the installation.
  6. Next, go through the EULA agreement and then click Agree and Enroll.
  7. Now, change the domain from local to your G Suite domain and enter your G suite credentials. Click Authenticate.
  8. Next, the device will process the enrollment request. In case the processing fails,
    • Click Enroll to take you to Settings > Accounts > Access Work or School > Enroll in Device Management on your device.
    • The username and the enrollment server address will be auto-filled on the ‘Set up a work or school account’ pane. Click Next.
    • Go through the device setup instructions and click Got It to connect Hexnode to the Workplace or School. It may take a few minutes to set up the connection. Any configurations or apps that the organization has set up for the user will be applied to the device. In case the device takes more time to set up the connection, navigate to Settings > Accounts > Access work or school > Info > Sync.
  9. The agent app (HexnodeAgent) will be installed on the device, and all the configurations will be automatically applied to it. Click Done to exit the Hexnode Installer.
  10. Click Finish to exit the setup.

Method 2: Native Enrollment
  1. On your Windows device, go to Settings > Accounts > Access work or school.
  2. Click Enroll only in device management.
  3. Enter your work email and click Next.
  4. You’ll be asked to enter your Microsoft password, neglect this step by closing the tab.
  5. Next, enter the enrollment URL which will be of the format:
    https://{portalname}.hexnodemdm.com 
  6. Click Next.
  7. On the authentication page, click Sign in with Google and authenticate by entering your G Suite username and password.
  8. Click Got It after reading the setup instructions. The Windows device is now successfully enrolled with Hexnode MDM.