--- title: On-premises authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. ms.topic: conceptual ms.date: 07/08/2024 --- # On-premises authentication device enrollment This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). > [!NOTE] > For the list of enrollment scenarios not supported in Windows, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery service The discovery web service provides the configuration information necessary for a user to enroll a device with a management service. The service is a restful web service over HTTPS (server authentication only). > [!NOTE] > The administrator of the discovery service must create a host with the address `enterpriseenrollment..com`. The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain **enterpriseenrollment** to the domain of the email address, and by appending the path `/EnrollmentServer/Discovery.svc`. For example, if the email address is `sample@contoso.com`, the resulting URI for first Get request would be: `http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc`. The first request is a standard HTTP GET request. The following example shows a request via HTTP GET to the discovery server given user@contoso.com as the email address. ```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: unknown Header Byte Count: 153 Body Byte Count: 0 ``` ```http GET /EnrollmentServer/Discovery.svc HTTP/1.1 User-Agent: Windows Phone 8 Enrollment Client Host: EnterpriseEnrollment.contoso.com Pragma: no-cache ``` ```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: text/html Header Byte Count: 248 Body Byte Count: 0 ``` ```http HTTP/1.1 200 OK Connection: Keep-Alive Pragma: no-cache Cache-Control: no-cache Content-Type: text/html Content-Length: 0 ``` After the device gets a response from the server, the device sends a POST request to `enterpriseenrollment./EnrollmentServer/Discovery.svc`. After it gets another response from the server (which should tell the device where the enrollment server is), the next message sent from the device is to `enterpriseenrollment.` enrollment server. The following logic is applied: 1. The device first tries HTTPS. If the device doesn't trust the server certificate, the HTTPS attempt fails. 1. If that fails, the device tries HTTP to see whether it's redirected: - If the device isn't redirected, the user is prompted for the server address. - If the device is redirected, the user is prompted to allow the redirect. The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address: ```http https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc ``` The following example shows the discovery service request. ```xml http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 http://www.w3.org/2005/08/addressing/anonymous https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc user@contoso.com 3 3.0 WindowsPhone 10.0.0.0 OnPremise ``` If a domain and user name are provided by the user instead of an email address, the <EmailAddress> tag should contain domain\\username. In this case, the user needs to enter the server address directly. <EmailAddress>contoso\\user</EmailAddress> Response The discovery response is in the XML format and includes the following fields: - Enrollment service URL (EnrollmentServiceUrl) - Specifies the URL of the enrollment endpoint that is exposed by the management service. The device should call this URL after the user has been authenticated. This field is mandatory. - Authentication policy (AuthPolicy) - Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user is authenticated when calling the management service URL. This field is mandatory. - Federated is added as another supported value. It allows the server to use the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. > [!NOTE] > The HTTP server response must not be chunked; it must be sent as one message. The following example shows a response received from the discovery web service for OnPremise authentication: ```xml http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8 urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 OnPremise 3.0 https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC ``` ## Enrollment policy web service For the OnPremise authentication policy, the UsernameToken in GetPolicies contains the user credential, whose value is based on the authentication policy in discovery. The following sample shows the policy web service request and uses `user@contoso.com` as the user name and `mypassword` as the password. ```xml http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 http://www.w3.org/2005/08/addressing/anonymous https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC user@contoso.com mypassword ``` After the user is authenticated, the web service retrieves the certificate template that the user should enroll with and creates enrollment policies based on the certificate template properties. A sample of the response can be found on MSDN. MS-XCEP supports flexible enrollment policies using various Complex Types and Attributes that include the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. > [!NOTE] > The HTTP server response must not be chunked; it must be sent as one message. The following snippet shows the policy web service response. ```xml http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598 0 CEPUnitTest 3 1209600 172800 true false 2048 101 0 0 1.3.14.3.2.29 1 0 szOID_OIWSEC_sha1RSASign ``` ## Enrollment web service This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DM client. The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on, match the certificate template), the client can enroll successfully. The RequestSecurityToken uses a custom TokenType (`http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken`), because our enrollment token is more than an X.509 v3 certificate. For more information, see the Response section. The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. > [!NOTE] > The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for OnPremise authentication. ```xml http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749 http://www.w3.org/2005/08/addressing/anonymous https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC user@contoso.com mypassword http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue DER format PKCS#10 certificate request in Base64 encoding Insterted Here 4 10.0.9999.0 MY_WINDOWS_DEVICE FF:FF:FF:FF:FF:FF CC:CC:CC:CC:CC:CC 49015420323756 30215420323756 Full CIMClient_Windows 10.0.9999.0 7BA748C8-703E-4DF2-A74A-92984117346A True ``` The following example shows the enrollment web service response. ```xml http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab 2012-08-02T00:32:59.420Z 2012-08-02T00:37:59.420Z http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken B64EncodedSampleBinarySecurityToken 0 ``` The following example shows the encoded provisioning XML. ```xml ```