Choosing a Windows Enrollment Method

Once your Windows Enterprise is activated, you can start enrolling your Windows Devices in Applivery. Let's take a look at the available enrollment methods.

Enrollment options

Windows provides multiple ways to enroll Devices depending on your identity infrastructure (cloud-only, hybrid or on-premises), the level of automation you need, and whether Devices are enrolled one at a time or in bulk.

All enrollment methods result in the Device being managed by Applivery, but they differ in two key aspects:

• Automation level: Some methods require the end user to manually add a work account from the Settings app, while others enroll the Device automatically the moment it joins your identity provider — with no user interaction required.

• Identity source: Windows Devices can be tied to Microsoft Entra ID (cloud identity), an on-premises Active Directory domain, or enrolled as standalone Devices with no identity join at all, using a provisioning package.

Regardless of the method, every Windows Device must reach the Windows Enterprise activation step before it can be enrolled, and every enrollment can be layered with a Smart Enrollment to conditionally assign Policies based on user or Device data.

Manual Enrollment

The classic manual enrollment method, done from the Device itself via Settings > Accounts > Access work or school. The user enters their corporate email address, and Windows automatically discovers the Applivery MDM server using your organization's Auto-Discovery Domain — a CNAME DNS record that avoids the need for manual server URLs or enrollment tokens. It works independently of Entra ID and is well suited for one-off enrollments or Devices that are not managed through a directory service. You can learn more about it here.

Microsoft Entra ID Enrollment

Ties Device enrollment directly to your corporate identity system. Once the integration is configured, any Device that joins Microsoft Entra ID automatically enrolls into Applivery, with no separate enrollment step required. This is the recommended method for corporate-owned, cloud-managed fleets, since it also enables Single Sign-On and automated Policy assignment based on user and group identity. You can learn more about it here.

Windows Autopilot

Microsoft's zero-touch provisioning technology. A brand-new Device configures itself the first time it's turned on, with no manual imaging or setup: during the out-of-box experience it is redirected to Applivery, so the Agent, your Policies and your Apps are installed automatically the moment the user signs in. It requires an active Entra ID integration, since the redirection is configured through the MDM handover in Entra. It's the method for shipping Devices straight from the vendor to the employee. You can learn more about it here.

Domain Join

For environments running an on-premises Active Directory. The Device enrolls automatically when it joins the domain, with no user interaction, which makes it the on-premises counterpart to Entra ID enrollment. It's the natural choice for corporate-owned Devices in on-premises or hybrid setups, where identity already lives in your own directory rather than in the cloud.

Direct Provisioning

Allows generating a provisioning package tied to an Enrollment Template, which bundles enrollment credentials (including an auto-generated secret) so Devices can be enrolled without any user interaction or directory join, typically applied during first boot or via USB. This method is best suited for bulk, offline or kiosk-style deployments, and it's the only one that works when the Device isn't tied to any identity provider. You can learn more about it here.

Enrollment methods