Autogenerate an Enrollment Provisioning Package (PPKG)

Before you begin

These steps are optional as part of creating an Add Devices Rule to enroll a Windows Modern device. See the following links for directions on creating an enrollment rule for your devices:

Enrolling Windows Modern Phone Devices

Enrolling Windows Modern Desktop Devices

Enrolling Windows Modern HoloLens Devices

About this task

A distributable provisioning package (PPKG) may be created for autoenrollment as part of an Add Device Rule.


  1. When prompted to choose a destination Device Group for devices enrolling under the rule, click Certificate Based Enrollment. Automate Certificate Enrollment is selected by default.
    Certificate based enrollment option.
  2. In the Lifetime (in years) dropdown, select the number of years that the client enrollment certificate will live before it is necessary to regenerate it.
    Client certificate lifetime selection.
  3. Include MobiControl Root Certificate is checked by default to ensure the certificate will be part of the .ppkg file. Uncheck this only if MobiControl will not use a self-signed certificate.
  4. Select the device group where the device will be enrolled.
  5. Return to the previous enrollment page to resume the remaining steps for enrolling your Windows Modern devices.
    Note: When all steps are completed, and the rule is created, the .ppkg file will be available for download. See Download Provisioning Package (PPKG).