Dashboard Setup: EMM Zero-Touch Enrollment

The zero-touch enrollment process involves two key phases: Dashboard Setup and Device Setup. Follow the instructions below to complete the dashboard configuration.

Prerequisites for EMM Zero-Touch Enrollment

• Managed Google Domain: Must be verified for domain ownership. Each domain binds to a single EMM console. (Refer to Google Workspace for Enterprise onboarding guides).
• Google Workspace Infrastructure: Enterprise IDs and managed Google Accounts for employees leverage your existing Workspace directory.
• Android Partner Portal Access: Requires a valid Zero-Touch account set up by an authorised Zero-Touch reseller partner.
• Eligible Corporate Devices: Devices must be purchased directly through authorised business resellers or Google Enterprise partners.

Phase 1: EMM Binding & Console Setup

Access Mobile Guardian Dashboard:

• Sign in to the Mobile Guardian business dashboard.
• Go to Settings in the left navigation panel and select Android Settings.
• Click Google Workspace Account Enrollment.

Access Google Admin Console:

• Open a new tab and sign in to admin.google.com using a Super Administrator account.

Configure Third-Party Integrations:

• Navigate to Devices > Mobile & endpoints > Settings > Third-Party integrations.
• Select the target Organizational Unit (OU) designated for EMM enrollment.

• Enable Third-party Android mobile management.
• Click Add EMM provider (or Manage EMM providers).

Generate Authentication Token:

• Copy the existing token or click Generate Token to create a new one.

Update Mobile Guardian Settings:

• In the Mobile Guardian dashboard, enter the Google domain admin email address.
• Paste the authentication token generated from the Google Admin Console.

Configure Mandatory Global Policies:

• Default Application Runtime Permissions: Set to Auto Grant.
• System Update Policy: Set to Automatic.
• Require Secondary Login: Toggle Enable (Mandatory for employees to authenticate using their corporate email and password during device enrollment).
• Save the Android EMM settings.

Domain & Access Controls:

• Corporate-Owned Single-Use (COSU) Mode: Locks devices into single-app kiosk mode displaying only the Mobile Guardian Launcher and approved corporate apps from the Enterprise Catalogue.
• Require Secondary Login: Enforces user sign-in strictly to authorised company domains.
  • If not enabled, the device will be enrolled, but the Employee will not be able to sign on to the device.
• Restrict Sign-in to Managed Domain: Restricts domain authorisation within applications (e.g., limiting Google Chrome logins to @yourcompany.com).
  • Google Workspace Settings need to be set for the domain to be visible

Finalise Enterprise Binding:

• Verify that the Enterprise ID in Mobile Guardian matches the ID in the Google Workspace Admin console (refresh the browser if necessary).
• Select the corresponding Enterprise ID from the dropdown in Google Admin and click Save to bind Mobile Guardian to your Organizational Unit.

Phase 2: Link Zero-Touch Account

• In the Mobile Guardian dashboard, navigate to the Link Zero-Touch Account setup option and click Next.

• Select your corporate Zero-Touch Account from the prompt and click Link.

• Click Next to finalise the integration.

• Click Save once the account successfully maps to the dashboard.

Completion

Upon finishing these steps, you will be redirected to the main settings page confirming your active enterprise profile. You are now ready to proceed to Device Setup.