Before you start
There is nothing to switch on. Management is active from the moment your account exists, so you can go straight to enrolling.
Check the edition first, because it decides what you get:
Edition |
Managed |
|---|---|
Pro |
Yes |
Enterprise |
Yes |
Education |
Yes |
Home / Family |
Enrols, but most features do not apply |
Home devices will enrol and report, and that is about it — no BitLocker, no Entra ID join, and only part of the controls. If the machine is company property, upgrade it to Pro rather than working around the gaps.
Coming from another MDM? You do not have to re-enrol machine by machine. Turn on automatic Windows MDM migration in MDM > Settings and devices move across on their own.
Overview
Windows is the quickest platform to start with, because there is nothing to configure. What does need checking is the edition: Home cannot be managed at all.
Edition |
Can be managed |
Pro |
Yes |
Enterprise |
Yes |
Education |
Yes |
Home / Family |
No |
Factorial IT uses Fleet as the MDM agent on Windows. It installs from a lightweight .msi and reports device state, applies controls and runs scripts.
How to use
- Confirm the edition is Pro, Enterprise or Education. Home devices cannot enrol.
- Enrol the device. No certificate, portal or extra setup is required — MDM works from the moment your account is created.
- If devices are already managed elsewhere, migrate them automatically instead of re-enrolling by hand.
Tips and best practices
- Audit editions before the rollout, not during it. Discovering Home machines one at a time is the most common way a Windows rollout slips.
- Use the automatic migration if you are coming from another MDM. Manual re-enrolment on every device costs days and gains nothing.
- Set up Zero Touch before the next hardware order, so new machines arrive ready instead of needing a visit.
Troubleshooting and FAQ
Troubleshooting
- The device will not enrol. Check the edition first. Windows Home has no MDM capability, and no configuration works around it — the machine needs an edition upgrade.
- The agent installed but the device reports nothing. Confirm the device can reach your MDM server on port 443 outbound. See Network whitelisting.
FAQ
-
Do we need a certificate, like Apple's APNs?
No. Windows needs no certificate and no portal configuration.
-
Can we upgrade a Home device instead of replacing it?
Yes. Once it runs Pro, Enterprise or Education it can enrol normally.
-
Do we have to re-enrol devices from our old MDM?
No. Enrolled hosts can be migrated automatically.