Skip to main content

Prerequisites

This page outlines everything required before initiating device enrollment into Beak MDM. The platform support matrix applies to all customers; the Windows-specific configuration is mandatory for any organization planning to enroll Windows endpoints. Some items — such as the Active Directory redirect URL — are provided by the Beak Support Team during setup.

Supported Platforms​

Beak MDM supports management across the following operating systems.

PlatformSupport LevelNotes
iOS / iPadOSFull SupportStandard Apple MDM enrollment workflow
macOSPartial SupportSelected functionalities are supported — contact the Beak Support Team for the current feature matrix
WindowsFull SupportRequires Azure AD (Work or School Account) configuration

Windows Prerequisites​

Supported Operating Systems​

The following Windows editions are supported for enrollment:

  • Windows 10 — Pro and Enterprise editions
  • Windows 11 — Pro and Enterprise editions

Note: Home editions of Windows are not supported, as they do not include the MDM enrollment capabilities required by the platform.

Work or School Account (Azure Active Directory)​

Windows enrollment requires a Work or School Account backed by Azure Active Directory (Azure AD). An Azure AD App Registration must be created in the customer's tenant, and the following credentials must be shared with the Beak Support Team:

CredentialDescription
Client IDThe Application (client) ID generated for the registered AD application
Client SecretA client secret value generated under Certificates & Secrets — note the expiry date and renew before it lapses
Tenant IDThe Directory (tenant) ID associated with the customer's Azure AD instance

Note: These three values must be shared with the Beak Support Team only through a secure, encrypted channel or a secret-sharing tool.

Redirect URL Configuration​

A Redirect URL must be configured under the Authentication settings of the Azure AD App Registration. This URL is provided by the Beak Support Team and is required for the authentication flow between Azure AD and the Beak MDM server.

  • Add the redirect URL — Under your AD App Registration, go to Authentication → Redirect URIs and add the URL provided by Beak Support.
  • Set Beak MDM as the default MDM — In Microsoft Entra ID, under Mobility (MDM and MAM), configure Beak MDM as the default MDM authority.
  • Configure discovery — Set the Terms of Use and Auto Discovery URL in the same application.

Domain Configuration & Default Company Mapping​

For Windows enrollment, the customer must provide the list of email domain(s) used by their organization. Each domain is mapped to a default company (tenant) in Beak MDM. Any user signing in with an email address belonging to a configured domain is automatically enrolled under that company.

Example: If the configured domain is abc.com, then any user enrolling with an account such as user@abc.com will have their device automatically enrolled into the default company associated with abc.com.

The following information must be shared with the Beak Support Team:

ItemDescription
Email Domain(s)The email domain(s) used by the organization (e.g., abc.com). Multiple domains can be configured if applicable
Default CompanyThe company / tenant in Beak MDM where devices enrolled with the above domain(s) should be placed by default

Note: This domain-to-company mapping is mandatory. Without it, users signing in with their Work or School account cannot be routed to the correct organization within the MDM.

Prerequisites Checklist​

Before initiating enrollment, confirm the following items are ready:

  • Supported platforms — Device operating systems fall within the supported platform list.
  • Windows edition — For Windows devices, the edition is Pro or Enterprise (Windows 10 or 11).
  • App registration — An Azure AD App Registration has been created in the customer's tenant.
  • Credentials shared — Client ID, Client Secret, and Tenant ID have been generated and securely shared with the Beak Support Team.
  • Redirect URL configured — The redirect URL from Beak Support has been added under AD App Registration → Authentication → Redirect URIs.
  • Domain mapping provided — The email domain(s) and corresponding default company name have been provided for domain-to-tenant mapping.
  • End-user accounts — End users have valid Work or School (Azure AD) accounts.

Best Practices​

  • Renew secrets ahead of expiry — Track the Client Secret expiration date and rotate it before it lapses to avoid enrollment and authentication failures.
  • Use a secure channel for credentials — Share Client ID, Client Secret, and Tenant ID only via an encrypted channel or secret-sharing tool, never over plain email or chat.
  • Confirm domain mapping first — Validate the domain-to-company mapping before rolling out Windows enrollment so devices land under the correct tenant.
  • Verify the device edition — Check that Windows endpoints run Pro or Enterprise before distributing enrollment URLs.

For any clarification on the prerequisites above — or assistance with the AD App Registration, Redirect URL configuration, or domain mapping — reach out to the Beak Support Team.