The MDM settings page holds every configuration option for your MDM in one place. Use it to check platform status, connect integrations, set enrolment behaviour, control the desktop app and decide what happens to devices that stay offline.

Feature/Functionality

Overview

Go to MDM > Settings. The page is split into six sections:

• Platforms. One row each for Apple, Windows, Linux and Android, with its status.
• Integrations. The security and compliance tools connected to your devices.
• Notifications. The email address that receives MDM notifications.
• Enrolment. How devices enrol, who they are assigned to and how they are named, plus the generic installers.
• Desktop app. What employees see in the desktop app on their computer.
• Automatic unenrollment. How long a device can stay offline before it is unenrolled.

Every change saves on its own. There is no button to confirm. Fields you type into, such as URLs, the notification email and domains, save a moment after you stop typing.

You need the permission to manage MDM settings to change anything on this page. Without it, or before your MDM has been deployed, the page is read-only.

How to use

1. Go to MDM > Settings.
2. Check Platforms to confirm each platform is Active. Click a row to open its settings.
3. Use Integrations to review or add a connection.
4. Change the options under Notifications, Enrolment, Desktop app and Automatic unenrollment as needed. Each change saves straight away.
5. Click All installers in Enrolment to download an installer or show an enrolment link.

Platforms

Each row shows the platform status: Active, Action needed or Being set up. The Apple and Windows rows also show whether zero-touch deployment is on. Click a row to open its settings:

• Apple. Set up and renew the Apple Push Notification (APN) certificate. Once Apple is active, the same window lists your Apple Business accounts for zero-touch deployment and your Volume Purchase Programme tokens for App Store apps. Click Add to connect one, or open its … menu to Renew or Disconnect it.
• Windows. Once Windows is active, the window lists your Windows Autopilot set-ups for zero-touch deployment. Click Add to start one, or Finish setup on one you left half done.
• Linux. Shows whether Linux devices are managed.
• Android. Click Connect Google Enterprise to link Android Enterprise. See the Android set-up article.

You cannot switch a platform on or off yourself. Contact our team; the window says so next to the platform switch.

Integrations

The security and compliance tools connected to your devices: SentinelOne, ThreatDown and Vanta. Each connected integration has its own row with its status. Click it to see the details.

Click Add integration to open the catalogue. Each card shows its type (EDR or Compliance) and offers Connect, Talk to sales or both. Integrations marked Coming soon cannot be connected yet.

Notifications

MDM notifications is the email address that receives MDM notifications, for example confirmations of locks and wipes.

Enrolment

Allowed domains for MDM invitations. Enrolment invitations only go to these domains. Click Add domain to add one. Domains that come from your email provider cannot be removed.

Require authentication to enroll. With this on, employees sign in with their work account before their device enrols. The sign-in appears in two places:

• the Zero-Touch Deployment set-up flow on Apple devices
• the enrolment page opened by the iOS, iPadOS and Android enrolment links

Factorial IT acts as the identity provider for this sign-in, so you do not need to configure anything in SaaS.

Switch it on if employees enrol iPhones or iPads through the enrolment link. Every employee gets the same link, so the sign-in is the only way Factorial IT knows who enrolled the device and can assign it to them. With the setting off, these devices enrol with no owner. See Enrol iPhones and iPads.

Automatic device assignment. Factorial IT works out which employee a new device belongs to from the device data. Pick one option:

• On: the device is assigned to the suggested employee.
• Suggest only: the suggestion is shown and you approve it by hand.
• Off: no suggestion is made.

See Use assignment suggestion.

Resolve name conflicts. When the device and Factorial IT disagree on a device's name, choose which one wins:

• Keep device name: the name set on the physical device syncs into Factorial IT.
• Keep Factorial IT name: Factorial IT manages the hostname and pushes it to the device.

Automatic MDM migration. Windows only. With Automatic MDM migration on, Windows devices enrolled in another MDM move across to Factorial IT on their own. See Migrate from another MDM.

All installers. Click All installers to download a generic enrolment installer for any active platform. Use them when a device is enrolled before it has an owner.

Available for: macOS, iOS, iPadOS, Android (Personal / work profile), Android (Company-owned / fully managed), Windows (x64), Windows (ARM64), Linux (Debian/Ubuntu), Linux (Fedora/CentOS), Linux (Arch).

The macOS row downloads the enrolment profile. The agent then installs itself after enrolment. If it does not, click the chevron on the macOS row to show the Agent package, click Download .pkg and install it on the device.

Android offers two enrolment modes next to each other:

• Personal (work profile). The employee enrols their own device. Company apps and data live in a separate work profile, and personal data stays private.
• Company-owned (fully managed). IT enrols a new or factory-reset company device. Factorial IT manages the entire device.

The Android set-up article walks through each mode from start to finish.

iOS and iPadOS work like Android: instead of a downloadable profile, they use a link to your enrolment page. Click Download next to iOS · iPhone or iPadOS · iPad to show the QR code. Scan it with the device, or click Open link. Turn on Require authentication to enroll so that each device is assigned to the employee who enrols it.

Click Reset enrollment links to cancel the current installer links and create new ones. The iOS, iPadOS and Android links point to your enrolment page, so they do not change after a reset.

Desktop app

Display Fleet Desktop to end users. With this on, employees can check their security status and install or update apps from the Fleet Desktop icon in the menu bar. If the change cannot be applied, the switch goes back to where it was.

Transparency URL. Replaces the "Transparency" link in the Fleet Desktop app with a URL you choose, so employees land on your own page.

Support URL. Replaces the "Support" link in the Fleet Desktop app, so employees reach the support resource you pick.

Automatic unenrollment

Choose how long a device can stay offline before it is unenrolled and tagged To enroll: After 30 days offline, After 60 days offline or After 90 days offline. Pick Deactivated to keep offline devices enrolled.

With automatic unenrolment on, turn on Invite the employee to re-enroll to send the owner of an unenrolled device a fresh MDM invitation.

Troubleshooting and FAQ

Troubleshooting

• I cannot change anything on the page. You lack the permission to manage MDM settings, or your MDM has not been deployed yet. In both cases the page is read-only.
• iPhones and iPads enrol without an owner. Require authentication to enroll is off. Turn it on. Devices already enrolled stay unassigned and need assigning by hand.
• An installer link no longer works. Someone may have used Reset enrollment links. Download the installer again to get the new link.
• The agent did not install on a Mac. Open All installers, click the chevron on the macOS row and download the Agent package to install it by hand.
• Zero-touch deployment is not working. Open the Apple or Windows row in Platforms. Apple devices need an Apple Business account and Windows devices need a Windows Autopilot set-up.
• App Store apps do not deploy. Open the Apple row in Platforms and check the Volume Purchase Programme token.
• An invitation is not sent to an employee. Their email domain is not in Allowed domains for MDM invitations. Add it.

FAQ

1. Is there a save button?
   No. Every change saves on its own, and typed fields save a moment after you stop typing.
    
2. Do the iOS, iPadOS and Android links change when I reset enrolment links?
   No. They point to your enrolment page and stay the same.
    
3. What happens to devices that stay offline for a long time?
   With automatic unenrolment on, they are unenrolled and tagged To enroll after 30, 60 or 90 days offline, whichever you chose. You can also invite the employee to enrol again automatically.
    
4. Can I move Windows devices from another MDM without re-enrolling them?
   Yes. Turn on Automatic MDM migration and they move across to Factorial IT.
    
5. Who sets the device name?
   It depends on Resolve name conflicts. Keep Factorial IT name lets Factorial IT set the hostname; Keep device name takes the name from the device itself.
    
6. Can I switch a platform on or off myself?
   No. Contact our team.