First Device Enrollment

This guide walks you through enrolling your first device with Zero. Enrollment connects your device to your organization's management console.

Enrollment Overview

The enrollment process:

  1. Admin generates an enrollment token in the management console
  2. User installs Zero on their device
  3. User runs enrollment with the token
  4. Device registers and receives policies
  5. Work profile is created and activated

Step 1: Generate Enrollment Token

In the Zero management console:

  1. Navigate to Devices → Enrollment
  2. Click Generate Token
  3. Select the user or group for this enrollment
  4. Set token expiration (default: 24 hours)
  5. Copy the enrollment token or QR code
Token Types:
  • Single-use: Can only be used once
  • Multi-use: Can enroll multiple devices (great for groups)
  • Zero-touch: For automated fleet enrollment

Step 2: Enroll Device

CLI Enrollment

# Enroll with token
sudo zero enroll --token wv_enroll_xxxxxxxxxxxxx

# Or with server URL
sudo zero enroll \
  --server https://manage.yourcompany.com \
  --token wv_enroll_xxxxxxxxxxxxx

GUI Enrollment

  1. Launch the Zero application
  2. Click "Enroll Device"
  3. Enter the enrollment token or scan QR code
  4. Authenticate if required (SSO, password)
  5. Wait for enrollment to complete

Step 3: Verify Enrollment

# Check enrollment status
zero status

# Expected output:
# Status: Enrolled
# Organization: Your Company
# Device ID: dev_abc123
# Policies: 3 active
# VPN: Connected

Step 4: Start Work Profile

# Start the work profile
zero start

# Or use the system tray icon

Your work profile window will appear with a colored border indicating it's the isolated work environment.

Troubleshooting

Token Expired

Enrollment tokens expire after the configured time. Request a new token from your administrator.

Network Error

# Test connectivity to management server
curl -I https://manage.yourcompany.com/api/health

# Check DNS resolution
nslookup manage.yourcompany.com

Permission Denied

Enrollment requires root/admin privileges:

# Linux
sudo zero enroll --token xxx

# Windows (Run as Administrator)
zero enroll --token xxx

Next Steps