Initial Setup Tasks for New Organisations
- Kari Mattsson
- Anonymous
This section covers the initial tasks that need to be done for a new organisation. It covers both mandatory and optional tasks. Please note that not all organisations require the same setup, as the organisations can differ from each other considerably. Certain configuration tasks must be done before provisioning any devices, while others can be done later as needed. For a simple organisation in a BYOD scenario, with no restrictions or company-provided applications, the default service settings can be fine as they are.
The tasks are presented in a rough logical execution order:
| Set Up Step | Required | Description | Instructions | |
|---|---|---|---|---|
| 1 | Organisation units | Optional | You may want to define basic user groups, such as technical support and management, as well as office locations. Organisation units help in entering contact information for users, as well as selecting different groups of users for management purposes. | Organisation Units |
| 2 | Name policies | Required | Name policies define allowed user account and device IDs that are needed for creating new users and devices with custom IDs. Configuring the name policies is not needed if random or name based IDs are used. | Name Policies |
| 3 | Account templates | Required | User accounts are created using templates, so you need to define templates before creating any user accounts, including manager accounts.
| Account Templates |
| 4 | Manager accounts | Optional | You typically need to set up additional managers who can administer the organisation. If you have a service desk that handles device provisioning, you may need to set up device installer accounts. | Manager Accounts |
| 5 | Certificate authority | Optional | A certificate authority is needed for certain security features, such as VPN tunnels and WPA2 WiFi authentication. This enables making such configuration in device templates (see below). | Certificate Authority |
| 6 | WSDM Clients and Company Hub | Optional | Instead of using the default (system-wide) WSDM client or Company Hub, you may need to set up different ones for your organisation. This is necessary only in rare cases. | Configuring WSDM Clients and Company Hub |
| 7 | Managed Google Play | Optional | Managed Google Play allows creating a custom Google Play store with a restricted selection of apps. It can be set up for work managed devices, as described in Introduction to Android EMM. This involves registering an "enterprise" in Google Play. It must be set up before configuring device templates to enable it and before any Android devices are provisioned. | Google Play |
| 8 | Samsung KNOX | Optional | Set up keys and licenses for Samsung KNOX devices. This enables additional functionalities for Samsung devices, but is not needed if standard Android features are sufficient. | |
| 9 | Apple VPP | Optional | VPP or Volume Purchase Program is an enterprise purchase option for the Apple App Store for apps and other content | Volume Purchase Programme (VPP) |
| 10 | Apple DEP | Optional | DEP or Device Enrollment Program is an easy way to enroll iOS devices | Device Enrollment Program |
| 11 | AET configuration | Optional | Application enrollment tokens (AETs) are needed for distributing applications to certain Windows phones | AET Configuration |
| 12 | Device groups | Optional | Device groups allow filtering and limiting operations and compliance rules to different groups of devices, according to departments, job roles, location, etc. They can be set in device configuration or templates. | Device Groups |
| 13 | Compliance rules | Optional | Compliance rules allow actively tracking that devices belonging to particular device groups comply to the rules. Different device platforms support different sets of rules, such as whether the device is encrypted or that certain applications are installed or not. | Device Compliance |
| 14 | Device templates | Required | Once all basic device-related settings are done, define templates for all the types of devices that are to be used in the organisation.
| Device Templates |
| 15 | LDAP or Active Directory | Optional | Set up connectivity to LDAP or Active Directory | LDAP and Active Directory Integration |
| 16 | Import existing users and devices | Optional | If you have existing users and devices, you may choose to batch-import them. | Import Accounts |
| 17 | Enable self-service setup | Optional | You can allow users to register themselves and their devices in the service. | Setting up Self-Service Setup for Device Owners |
If the organisation is following a BYOD policy with many different kinds of devices, you probably need to configure all device types. With a more limited policy with only company-issued devices, you only need to configure those devices.