---
title: "Windows MDM enrollment"
description: "Enroll Windows PCs in Outpost MDM through Microsoft Entra join, Autopilot, a work account, or the Outpost agent. This feature is in preview."
url: "https://support.outpostplatform.com/mdm/windows/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Windows MDM in Outpost (preview) uses the MDM client built into Windows. Corporate: Microsoft Entra join and Windows Autopilot through an MDM app in the client's Entra tenant, or enrollment started by the Outpost agent. Personal: a work account added in Windows. A PC with agent and MDM is one record and counts once."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows"]
  permission: "mdm:enroll"
  preview: true
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/mdm/windows.md"
license: "CC BY 4.0"
---

# Windows MDM enrollment

This page enrolls Windows PCs in Outpost [mobile device management](/mdm/)
using the MDM client built into Windows. When you finish, the PC receives
settings from your profiles through Windows' own management channel, in
addition to anything the Outpost agent does on it.

## Before you begin

- The `mdm:enroll` permission, and `mdm:manage` to change the client's Windows
  MDM settings. See [Roles and permissions](/depot/roles-and-permissions/).
- The Windows provider must be available for your account. Providers become
  available as Outpost enables them.
- For Microsoft Entra join and Autopilot, administrator access to the client's
  Microsoft Entra tenant, to register Outpost as its MDM application.

A PC that runs the Outpost agent and enrolls in MDM stays one device record
and counts once.

## Choose an enrollment method

| Method | Ownership | How the PC enrolls |
| --- | --- | --- |
| Microsoft Entra join | Corporate | The PC joins the client's Entra tenant, and Windows enrolls it in the MDM application registered there. |
| Windows Autopilot | Corporate | The same as Entra join, during the out-of-box experience. |
| Started by the Outpost agent | Corporate | The agent already on the PC enrolls it, with no user steps. |
| Work account | Personal (BYOD) | The user adds their work account in Windows. Outpost manages only what belongs to that account. |

## Register Outpost in the client's Entra tenant

Do this once per client before Entra join or Autopilot.

1. In the Microsoft Entra admin center for the client's Entra tenant, open
   **Mobility (MDM and MAM)**, select **Add application**, then **Create your
   own application**.
2. Enter the client's MDM discovery and terms of use addresses from Outpost.
3. Add the application's details to the client's Windows MDM settings in the
   console.

Outpost accepts an Entra sign-in only when the token is for that MDM
application and comes from the Entra tenant you registered.

## Enroll a PC that runs the Outpost agent

1. Make sure the PC is enrolled with the Outpost agent. See
   [Install and enroll the agent](/agent/install-and-enrollment/).
2. Start MDM enrollment for the PC from the console. The agent requests a
   single-use token that expires after 10 minutes, and uses it to enroll the
   PC in Windows MDM.

## Enroll a personal PC with a work account

1. On the PC, open **Settings** > **Accounts** > **Access work or school**.
2. Select **Connect** and sign in with the work account.
3. If Windows does not find the enrollment service on its own, enter the MDM
   enrollment address for the client.

## How the PC receives changes

When you change a profile or send a command, Outpost wakes the PC in this
order:

1. Through the Outpost agent, when the PC has one.
2. Through Windows push notifications, when they are configured.
3. Otherwise, Windows checks in on its own schedule.

## Verify

The PC shows an MDM enrollment on its device record, with its enrollment type
and last check-in time. Request a sync. The sync completes when Windows
checks in after the request.

## Next steps

- [Deploy apps to mobile devices](/mdm/apps/)
- [Profiles and policies](/automation/profiles/)