Learn how to leverage the Require Authentication option with Automated Device Enrollment
What is Require Authentication?
The Require Authentication option in the Automated Device Enrollment Library Item allows administrators to force user authentication through an identity provider (IdP) before proceeding with device enrollment. Additionally, administrators can match the authenticated IdP user to a user in their IdP and automatically assign the matched user to the device record.
Configurable Options
Require Authentication
Enabling this option will require all eligible device types to authenticate through your configured IdP during Automated Device Enrollment.
If requiring authentication and using Google Workspace as your identity provider, then the Single Sign-On entry must be created using Custom SAML, as the built-in Google Workspace integration will result in a 403 error upon enrollment.
Connection
Select an SSO connection. If you haven't already configured one, you can learn more about supported SSO connection types and how to set them up.
An SSO connection does not need to be Active in Settings > Access to Require Authentication within Automated Device Enrollment. A connection should only be Active in settings if you want to authenticate Kandji administrators to the web app with that connection.
Assign user to device record
Enabling this option will attempt to match the user authenticated by the identity provider to a user that exists in your user directory integration(s). If the email address of the authenticated IdP user matches the email address in your integrated directory, the user will be assigned to the device.
Pre-fill primary account details
Enabling this option will automatically pre-fill the primary computer account details for the initial computer account created during Setup Assistant. If no users were matched and assigned to the device record, no details would be pre-filled.
If you are also deploying Passport, you must deselect the Pre-fill initial account creation details and Lock pre-filled account creation details options. Using the pre-fill and lock settings while skipping account creation, as recommended with Passport, will cause account creation conflict and result in a Setup Assistant error that requires the Mac to be erased.
Lock primary account details
Enabling this option will lock the prefilled primary account details for the initial computer account created during Setup Assistant.
Authentication Connection
The selected authentication connection for the Automated Device Enrollment profile is the SSO connection used to authenticate the user. Any user assigned to the "Application" within the Identity Provider will be allowed to complete the enrollment.
You can use the same connection (generally referred to as an application within the identity provider) that you use for your Kandji Team Members to authenticate into your Kandji tenant or configure an entirely new connection/application within Kandji and your identity provider specifically for device enrollment. If you elect to use the same connection/application, please note that your end users may see the Kandji application within your identity provider's application catalog. Assigning users to the application will not grant them administrative rights in Kandji.
Assign user to device record
The Assign user to device record option matches the user who authenticates during Automate Device Enrollment to a user in your integrated user directory. If a matching user is found, this user will be assigned to the device record.
If matching is enabled, and a user was pre-assigned to the device while awaiting enrollment, but a different user authenticates the enrollment, the authenticating user would be matched and assigned, replacing the pre-assigned user.
Enrollment Experience
Remote Management Screen during Automated Device Enrollment:
Authentication via Enrollment Customization WebView:
After successful authentication, enrollment continues, and the device setup proceeds: