How to annals devices

This scenario is intended to guide organization administrators through the procedures for enabling users to annals devices. Users typically annals their own devices, only system administrators must enable the relevant settings. When devices are registered, you tin manage them in Admin Portal, install mobile device policies, and deploy mobile applications to specified devices.

Registering a device requires Privileged Access Service to push a user certificate to the device. Typically, nosotros apply the User Principle Name (UPN) as the subject alternative proper noun of the document. If you want to use Distinguished Proper name (DN), please contact Privileged Access Service Back up.

Note: If yous accept the Direct Control agent installed, y'all must remove information technology before installing the Centrify Mac Agent version 19.5 or higher to utilize MFA for Mac. The MFA for Mac characteristic is non compatible with the Directly Control agent. Refer to Installing and removing the amanuensis and leaving a domain for more data nigh uninstalling the Direct Control amanuensis and leaving an AD domain.

This scenario includes the following topics:

ClosedEnable users to register devices

Before a user tin can annals a device, you lot must provide this user with the relevant policy set.

  1. Log in to Admin Portal.
  2. Click Admission > Roles.
  3. Create a new role or select an existing role.
  4. Click Members > Add together.
  5. On the Add Members window:

    1. Enter the first few letters of the user, role, or Active Directory/LDAP business relationship/group you want to add and click the search icon.

    2. Select the relevant user, role, or Active Directory/LDAP business relationship/group and click Add together.

  6. Click Relieve to save the changes.

  7. Click Policies and either click Add Policy Set or select an existing policy.

  8. Click Devices > Device Registration Settings.

  9. Select Yes in the Let device registration policy.

  10. Configure the remainder of the policy settings.

    These settings utilize regardless of whether you use the Centrify directory policy service or Active Directory group policies to manage device configuration policies:

    Device registration control settings

    To enforce these limitations

    Allow user notifications on multiple devices

    Select Yes to transport authentication notifications to multiple registered devices and No to transport to the first registered device only (default setting), or "--" to use the default setting.

    Enable debug logging

    At that place are 2 logging modes on devices: regular - the default setting - and debug logging. Use this policy to turn on the debug logging fashion.

    Select Yes to enable debug logging, No to set regular logging, or "--" (Non configured) to apply the default setting.

    Enforce fingerprint scan for Mobile Authenticator

    Enforce Finger Print Browse for Mobile Authenticator Select Yeah to crave that users provide a finger impress scan to utilise mobile authenticator. Using the associated policy option, users can alternatively use the client application PIN for access. The default setting is No.

    Let non-compliant devices to enroll

    Preclude noncompliant devices from enrolling.

    To enable users to enroll a noncompliant device, select Yes in the drop-down menu.

    Open the tool tip for more information on this policy.

    Report mobile device location

    Select Yeah to allow devices to report their location, No to stop the device from reporting location, or "--" to utilize the default setting (Aye).

    Require client awarding passcode on device

    Select Yes to require a passcode to open the client awarding, No to allow opening the client awarding without a passcode, or "--" (Not configured) to use the default setting. Annotation: Y'all must select Yes to enable other customer application passcode policies.

  11. Click Save.

  12. Click Policy Settings.

  13. Specify the policy consignment:

    • All users and devices

      Applies this policy to all users and devices registered on Privileged Access Service.

    • Specified Roles

      Click Add together to select the roles to which y'all desire this policy practical.

    • Sets (Not applicable for unregistered devices)

      Specify the gear up type (currently only Device type is supported) for registered devices and the ready parameters (iOS devices, corporate owned devices, so on). Sets are a drove of devices, users, etc.

      Important: Do not use this option when configuring a policy for device registration. Sets simply use to registered devices. If you assign this policy to users who do not already have a device registration policy (through the All Users and Devices or Specified Roles option), device registration will fail.

  14. Click Salvage.