Prepare to enroll devices and deliver resources


Before proceeding, be sure to complete all tasks described in Onboarding and resource setup.

Endpoint Management supports various enrollment options. This article covers the basic setup required to enable all supported devices to enroll. The following diagram summarizes the basic setup.

Workflow diagram for preparing an environment for device enrollment

For a list of supported devices, see Supported device operating systems.

Set up an Apple Push Notification service (APNs) certificate for iOS devices

Endpoint Management requires an Apple Push Notification service (APNs) certificate from Apple to enroll and manage iOS devices. Endpoint Management also requires an APNs certificate if you plan to use push notifications for Secure Mail for iOS.

Set up Firebase Cloud Messaging (FCM) for Android devices

Firebase Cloud Messaging (FCM) controls how and when Android devices connect to the Endpoint Management service. Any security action or deployment command triggers a push notification to prompt users to reconnect to Endpoint Management.

  • FCM setup requires that you configure your Google account. To create Google Play credentials, see Manage your developer account information. You also use Google Play to add, buy, and approve apps for deployment to the Android Enterprise workspace on a device. You can use Google Play to deploy your private Android apps, public apps, and third-party apps.

  • To set up FCM, see Firebase Cloud Messaging.

Set up Endpoint Management AutoDiscovery Service


As of December 31, 2018, the AutoDiscovery Service URL is replaced with For more information, see the Citrix support article

Autodiscovery is an important part of many Endpoint Management deployments. Autodiscovery simplifies the enrollment process for users. They can use their network user names and Active Directory passwords to enroll their devices. They don’t need to enter details about Endpoint Management. Users enter their user name in user principal name (UPN) format; for example, The Endpoint Management AutoDiscovery Service enables you to create or edit an autodiscovery record without assistance from Citrix support.

AutoDiscovery is recommended for high security environments. AutoDiscovery supports certificate pinning, which prevents man-in-the-middle attacks. Certificate pinning ensures that the certificate signed by your enterprise is used when Citrix clients communicate with Endpoint Management. For information about certificate pinning, see Certificate pinning.

To access the Endpoint Management AutoDiscovery Service, navigate to and then click Request AutoDiscovery.

The AutoDiscovery Service

Request AutoDiscovery

  1. On the AutoDiscovery Service page, claim a domain. Click Add Domain.

    The ADS List screen

  2. In the dialog box that opens, enter the domain name of your Endpoint Management environment and then click Next.

    The Domain name field

  3. The next screen provides instructions on verifying that you own the domain.

    The Verify your domain screen

    • Copy the DNS token provided in the Endpoint Management Tools Portal.

    • Create a DNS TXT record in the zone file for your domain in your domain hosting provider portal.

      To create a DNS TXT record, log in to the Domain Hosting Provider portal for the domain you added in the previous step. You can edit your Domain Name Server Records and add a custom TXT record.

    • Paste the Domain Token in your DNS TXT record and save your Domain name Server record.

    • Back in the Endpoint Management Tools Portal, click Done to start the DNS check.

    The system detects your DNS TXT record. Alternatively, you can click I’ll update later, and the record is saved. The DNS check doesn’t start until you select the record that has a status of “Waiting” and then click DNS Check.

    This check ideally takes about an hour, but it can take up to two days to return a response. To see the status change, you might need to leave the portal and return.

    Waiting status in ADS List screen

  4. After you claim your domain, you provide information about the AutoDiscovery Service. Right-click the domain record for which you want to request autodiscovery and then click Add ADS.

    Claimed status in ADS List screen

  5. Enter the requested information and then click Next. If you are unsure about your instance name, add a default instance of zdm.

    Endpoint Management Info options


    In the preceding screenshot, “WorxHome” refers to the app that’s now named Secure Hub.

  6. Enter the following information for Secure Hub and then click Next.

    The Secure Hub Info settings

    • User ID Type: Select the type of ID with which users sign on as either E-mail address or UPN.

      Use UPN when the user’s User Principal Name is the same as their email address. Both methods use the domain entered to find the server address. If you choose E-mail address, users are prompted to enter their user name and password. If you choose UPN, users are prompted to enter their password.

    • HTTPS Port: Enter the port used to access Secure Hub over HTTPS. Typically, the HTTPS port is 443.

    • iOS Enrollment Port: Enter the port used to access Secure Hub for iOS enrollment. Typically, this port is 8443.

    • Required Trusted CA for Endpoint Management: Indicate whether a trusted certificate is required to access Endpoint Management or not. This option can be OFF or ON. To use a trusted certificate, contact Citrix Support to upload the certificate. To learn more about certificate pinning, see the section on certificate pinning in Secure Hub. To read about the ports required for certificate pinning to work, see the support article on Endpoint Management Port Requirements for ADS Connectivity.

  7. A summary page displays all the information you entered in the preceding steps. Verify that the data is correct then click Save.

    The summary page

At this point, you can enroll all supported devices. Proceed to the next section to prepare to deliver resources to devices.

Default device policies and mobile productivity apps

If you onboard starting with Endpoint Management 19.5.0 or later, we preconfigure a few device policies and mobile productivity apps. That configuration enables you to immediately deploy basic functionality to device users.

For the Android, Android Enterprise, iOS, macOS, and Windows Desktop/Tablet platforms, your site contains these preconfigured device policies:

  • Passcode device policy: The Passcode device policy is On, with all default passcode settings enabled.

  • App inventory device policy: The App inventory device policy is On.

  • Restrictions device policy: The Restrictions device policy is On, with all default restrictions settings enabled.

Those policies are in the AllUsers delivery group, which contains all Active Directory and local users. We recommend that you use the AllUsers delivery group only for initial testing. Then, create your delivery groups and disable the AllUsers delivery group.

All Endpoint Management device policies are documented under Device policies. That article includes information about how to use the console to edit device policies. For information about some commonly used device policies, see Device policies and Use Case Behavior.

For the iOS and Android platforms, your site contains these preconfigured mobile productivity apps:

  • Secure Mail
  • Secure Web
  • Citrix Files

Those apps are in the AllUsers delivery group.

For more information, see About mobile productivity apps and MDX policies for mobile productivity apps at a glance.

Continue your Endpoint Management configuration

After you complete the basic setup for device enrollment, how you configure Endpoint Management varies widely based on your use cases. For example:

  • What are your security requirements and how do you want to balance those requirements with user experience?
  • Which device platforms do you support?
  • Do users own their devices or use corporate-owned devices?
  • What device policies do you want to push to devices?
  • What types of apps do you provide users?

This section helps you navigate through the many configuration choices by directing you to articles in this documentation set.

As you complete configuration in third-party sites, make note of the information and its location, for reference when you configure Endpoint Management console settings.

Security and authentication

Endpoint Management uses certificates to create secure connections and authenticate users. Citrix provides wildcard certificates for your Endpoint Management instance.

Recommended background reading:

For a discussion of authentication components and recommended configurations by security level, see the “Advanced concepts” article, Authentication.

See also, Security and user experience.

For an overview of the authentication components used during Endpoint Management operations, see Certificates and authentication.

You can choose from the following types of authentication. Configuring authentication includes tasks in the Endpoint Management and Citrix Gateway consoles.

To deliver certificates to users, configure:

For other authentication options, see other articles under Certificates and authentication.

Device enrollment

You configure device enrollment modes to allow users to enroll their devices in Endpoint Management. Endpoint Management offers seven modes, each with its own level of security and steps users must take to enroll their devices.

Azure Active Directory enrollment is supported for iOS, Android, and Windows 10 devices. For information about configuring Azure as your identity provider (IdP), see Single sign in with Azure Active Directory.

Device policies and management

  • Device (MDM) policies

    • All Endpoint Management device policies are documented under Device policies. For information about some commonly used device policies, see Device Policies and Use Case Behavior.

    • Some policies are common across multiple platforms and some policies are platform-specific.

      You can filter device policy lists in the Endpoint Management console. For example, you can filter by platform to see a list of policies most often used for that platform. For information, see Device policies.

  • Client properties

  • Delivery groups

Prepare apps for deployment

For information about the apps supported by Endpoint Management, see Add apps.

Other configuration

  • The Role-Based Access Control (RBAC) feature in Endpoint Management lets you assign predefined roles, or sets of permissions, to users and groups. These permissions control the level of access users have to system functions. For information, see Configure roles with RBAC.

  • You create automated actions in Endpoint Management to specify the action to take in reaction to events, certain settings, or the presence of apps on user devices. For information, see Automated actions.