Windows MDM enrollment

This page enrolls Windows PCs in Outpost mobile device management using the MDM client built into Windows. When you finish, the PC receives settings from your profiles through Windows’ own management channel, in addition to anything the Outpost agent does on it.

Before you begin

• The mdm:enroll permission, and mdm:manage to change the client’s Windows MDM settings. See Roles and permissions.
• The Windows provider must be available for your account. Providers become available as Outpost enables them.
• For Microsoft Entra join and Autopilot, administrator access to the client’s Microsoft Entra tenant, to register Outpost as its MDM application.

A PC that runs the Outpost agent and enrolls in MDM stays one device record and counts once.

Choose an enrollment method

Method	Ownership	How the PC enrolls
Microsoft Entra join	Corporate	The PC joins the client’s Entra tenant, and Windows enrolls it in the MDM application registered there.
Windows Autopilot	Corporate	The same as Entra join, during the out-of-box experience.
Started by the Outpost agent	Corporate	The agent already on the PC enrolls it, with no user steps.
Work account	Personal (BYOD)	The user adds their work account in Windows. Outpost manages only what belongs to that account.

Register Outpost in the client’s Entra tenant

Do this once per client before Entra join or Autopilot.

1. In the Microsoft Entra admin center for the client’s Entra tenant, open Mobility (MDM and MAM), select Add application, then Create your own application.
2. Enter the client’s MDM discovery and terms of use addresses from Outpost.
3. Add the application’s details to the client’s Windows MDM settings in the console.

Outpost accepts an Entra sign-in only when the token is for that MDM application and comes from the Entra tenant you registered.

Enroll a PC that runs the Outpost agent

1. Make sure the PC is enrolled with the Outpost agent. See Install and enroll the agent.
2. Start MDM enrollment for the PC from the console. The agent requests a single-use token that expires after 10 minutes, and uses it to enroll the PC in Windows MDM.

Enroll a personal PC with a work account

1. On the PC, open Settings > Accounts > Access work or school.
2. Select Connect and sign in with the work account.
3. If Windows does not find the enrollment service on its own, enter the MDM enrollment address for the client.

How the PC receives changes

When you change a profile or send a command, Outpost wakes the PC in this order:

1. Through the Outpost agent, when the PC has one.
2. Through Windows push notifications, when they are configured.
3. Otherwise, Windows checks in on its own schedule.

Verify

The PC shows an MDM enrollment on its device record, with its enrollment type and last check-in time. Request a sync. The sync completes when Windows checks in after the request.

Next steps

• Deploy apps to mobile devices
• Profiles and policies