# How to configure Self Enrollment? Device enrollment in the UEM is a process that smoothens the communication between the device and the organization. Enterprises can easily control and limit access to the organizational network, apps, and files on an enrolled device. Self Enrollment in Hexnode UEM helps secure user enrollment by enforcing authentication. This allows users to enroll their own devices by authenticating with the already known credentials. This exempts the admins from the hassle of enrolling the device by themselves. With Hexnode, you can setup self-enrollment using [Active Directory](https://www.hexnode.com/mobile-device-management/help/microsoft-active-directory-integration-with-hexnode-mdm/) (AD), [ Microsoft Entra ID](https://www.hexnode.com/mobile-device-management/help/azure-active-directory-integration-with-hexnode-mdm/), [Google](https://www.hexnode.com/mobile-device-management/help/how-to-integrate-g-suite-with-hexnode/), [Okta](https://www.hexnode.com/mobile-device-management/help/okta-integration-with-hexnode-mdm/), and [local](https://www.hexnode.com/mobile-device-management/help/how-to-configure-self-enrollment-for-non-directory-users-using-hexnode-mdm/) user authentication. Configure Self Enrollment for local users ----------------------------------------- Enable self-enrollment for local users to allow them to enroll their own devices by authenticating their pre-assigned local credentials. 1. Login to your Hexnode portal. 2. Go to **Enroll > All Enrollments > Enterprise > Self-Enrollment – Local**. 3. Select the option Local User under **Self Enrollment**. 4. Change the devices’ **Ownership** type to either **Corporate, Personal,** or **Let the user choose**. 5. Click on **Continue**. 6. To assign/change the password of the local user from the UEM console, select the required user/users and click on **Change password**. Type in the required password and click **OK**. If you want to create a new user, click on the option **Create a new user** and provide the Display name, Domain, Email, Alternate email, Mobile and Password of the user. The display name and email fields are mandatory. Share this password with the corresponding user. While enrolling devices, the user must provide their email (username) and authenticate with this pre-assigned password. Apart from assigning passwords to individual users from the UEM console, you can also assign passwords to users in Hexnode by [importing a CSV file](https://www.hexnode.com/mobile-device-management/help/pre-enrollment-of-devices-hexnode-mdm/). Configure Self Enrollment for directory users --------------------------------------------- Enable self-enrollment for directory users to allow them to enroll their own devices by authenticating with their AD, Microsoft Entra ID, Google or Okta credentials. 1. Login to your Hexnode portal. 2. Go to **Enroll > All Enrollments > Enterprise > Self-Enrollment – Local**. 3. Select the required domains (AD/ Microsoft Entra ID/ Google/ Okta) under **Self Enrollment**. 4. Change the devices’ **Ownership** type to either **Corporate, Personal,** or **Let the user choose**. 5. Click on **Continue**. How to enroll devices using Self Enrollment? -------------------------------------------- Enrolling Android devices ### Enrolling Android devices 1. Install the Hexnode UEM application on your device. 2. Open the app and enter the server name which is of the format:*portalname*.hexnodemdm.com. 3. Click on **Next**. 4. Choose your authentication method (local or directory) and enter the username and password. 5. Click on **Next**. 6. Read and **Agree** to the End User’s License Agreement. 7. Enable the **Device administration** permission, **Usage access** permission, **Draw over apps** permission, **Write system settings** permission, **Notification access** permission, and **Allow app installation** permission. 8. Click **Next**. 9. Click **Allow** in the following pop ups which asks for location, storage, and phone permissions. 10. Click on Grant for granting additional permissions like location, calls, etc. 11. Follow the on-screen instructions to complete enrollment. You can also self-enroll your devices to the Android Enterprise program either via the [Profile Owner](https://www.hexnode.com/mobile-device-management/help/how-to-enroll-a-device-in-android-in-the-enterprise-as-profile-owner-using-hexnode-mdm/) or [Device Owner](https://www.hexnode.com/mobile-device-management/help/how-to-enroll-a-device-in-android-in-the-enterprise-as-device-owner-using-hexnode-mdm/) enrollment methods. Enrolling iOS devices ### Enrolling iOS devices #### Device Enrollment 1. Open Safari on your iOS device and enter the enrollment URL. It is of the format: https://*portalname*.hexnodemdm.com/enroll/ 2. Check the box “I have read and agree to the terms of the Hexnode UEM” and click **Enroll**. 3. If you are a local or AD user, select the domain and enter the local/AD username and password of the user and click **Authenticate**. If you are a Microsoft/Googe/Okta user, you can authenticate by signing in with the corresponding directory credentials. 4. Click on **Allow** to download the configuration profile on the device and click **Close**. 5. Go to the **Settings** app on your device. Navigate to **General > Profile** and open the profile. 6. Click on **Install** to install the configuration profile and certificate. This will open up a pop-up tab ‘Install Profile’, click on **Install**. 7. The device will display a warning for the Hexnode root certificate installation and the MDM management, click on **Install**. 8. Click on **Trust** to enable remote management for Hexnode. 9. When the profile is installed, click **Done**. 10. In the popup that asks permission to install the Hexnode UEM app, click **Allow**. 11. Allow the MDM to access the location and send notifications. #### User Enrollment Follow the steps below if **Ownership** is selected as **Personal** and **Apple Enrollment Type** is selected as **User Enrollment** on the portal, 1. On your iOS device, open the Safari browser and enter the enrollment URL specified in the enrollment request. For example, https://portalname.hexnodemdm.com/enroll/. 2. Agree to the terms and conditions on the enrollment screen by enabling the checkbox and clicking **Enroll**. 3. Enter your “Managed Apple ID” and click on **Download Profile**. Follow the steps below if **Ownership** is selected as **Let the user choose** on the portal, 1. On your iOS device, open the Safari browser and enter the enrollment URL specified in the enrollment request. For example, https://portalname.hexnodemdm.com/enroll/. 2. Agree to the terms and conditions on the enrollment screen by enabling the checkbox and clicking **Enroll**. 3. Enter your username and password and select **I own this device**. Click on **Authenticate**. Alternatively, selecting **My organization owns this device** will enroll the device using *Device enrollment*. 4. Next, select how you want the devices to be managed by Hexnode UEM: - **Manage entire device** – To manage the device completely without limitations on MDM capabilities. - **Manage only work-related data and apps** – To manage corporate data by creating a separate volume on the device with limited MDM capabilities. 5. Select **Manage only work-related data and apps** and enter your “Managed Apple ID”. 6. Click on **Download Profile**. Next, go to **Settings > Enrol in Hexnode** and select **Enrol My iPhone** once the enrollment profile has been downloaded to the device. You will be asked to enter your Managed Apple ID password at this point. Once the enrollment is successful, you can see the downloaded Hexnode UEM profile in **General > VPN & Device Management**. Enrolling Windows PCs or Tablets ### Enrolling Windows PCs or Tablets **On a Windows 10 v1803 or later device,** Enrollment via Hexnode Installer app:** 1. On your Windows device, open the web browser. 2. Enter the Hexnode enrollment URL. It should be in the format: https://*portalname*.hexnodemdm.com/enroll/.** 3. Click on **Download**. This would initiate the Hexnode Installer app download on your device. 4. Open the app on your device. 5. Click **Yes** on the ‘Hexnode Installer Setup’ wizard to allow the Hexnode Installer app to make changes to your device. 6. Click on **Install** to continue with the installation. 7. Read the EULA agreement on the Hexnode Installer app and click on **Agree and Enroll**. 8. The Hexnode Installer then checks with the portal for the enrollment authentication settings. 9. If you are a local or AD user, enter your email ID/SAMAccount Name and click on **Authenticate**. If you are a Microsoft/Googe/Okta user, you can authenticate by signing in with the corresponding directory credentials. You should also choose the ownership of the device if asked. 10. If the authentication fails, an error message “Authentication failed! Try Again!” will be displayed. Click on **Enroll** to re-authenticate. 11. Now the device will process the enrollment request. If the enrollment request processing fails, 1. Click on **Enroll** to enroll the device. This will redirect you to **Settings > Accounts > Access Work or Scholl > Enroll in Device Management** on your device. 2. On the ‘Set up a work or school account’ pane, super admin’s Hexnode portal username, and the enrollment server address will be auto-filled, click on **Next**. 3. Read the instructions regarding the device setup and click **Got it**. Hexnode will now connect to the Workplace or School. It may take a few minutes to set up the connection, all the configurations and apps that your organization has set up for the user will soon be pushed to the device. If the user doesn’t have access to these after waiting for a few minutes, go to **Settings > Accounts > Access Work or school > Info > Sync**. 13. The Hexnode Agent app (HexnodeAgent) will get installed, and all the configurations will be applied to the device. Click on **Done** to exit the Hexnode Installer. 14. Click on **Finish** to exit the Setup. **On a Windows 10 v1709 or below device,** Native Windows enrollment:** While enrolling devices, the user must provide their email (username) and authenticate with this pre-assigned password. 1. Go to **Settings → Accounts → Access work or school**. 2. Select **Enroll only in device management**. 3. Enter your work email and click **Next**. 4. Now you will be asked to enter your Microsoft password, simply neglect this by closing the tab. 5. Enter the server URL, it will be of the format: https://*portalname*.hexnodemdm.com and click **Next**. 6. If you are a local or AD user, select the domain and enter the local/AD username and password of the user and click **Authenticate**. If you are a Microsoft/Googe/Okta user, you can authenticate by signing in with the corresponding directory credentials. 7. Read the instructions regarding setting up the device and click **Got it**. You have now successfully enrolled your PC. Enrolling macOS devices ### Enrolling macOS devices 1. Open Safari. 2. Enter the enrollment URL, it will be of the format https://*portalname*.hexnodemdm.com/enroll/. 3. Check the box “I have read and agree to the terms of the Hexnode UEM” and click **Enroll**. 4. If you are a local or AD user, select the domain, enter the username and password, and click **Authenticate**. If you are a Microsoft Entra ID, Google, or Okta user, click on Authenticate with Microsoft, Google, or Okta. 5. The MDM profile gets downloaded. Click **Continue** to allow the MDM profile to be configured on the Mac and click **Install**. 6. Enter the Mac administrator’s username and password to continue with the installation.