Home
Installation and Configuration
Read this guide to learn about the requirements and available installation scenarios to ensure that the deployment of BigFix MCM and BigFix Mobile goes smoothly in your environment.
Domain join installation and configuration
Read this section to learn the prerequisites and the tasks to install ODJ service to set up your environment to enroll Windows devices and join Active Directory domain or both Active Directory and Azure AD domain.
Prerequisites for hybrid domain join
Read this page to learn the prerequisites to set up ODJ service to support the Azure AD joined Windows devices to join on-premises AD on enrollment.

Installation and Configuration
Read this guide to learn about the requirements and available installation scenarios to ensure that the deployment of BigFix MCM and BigFix Mobile goes smoothly in your environment.
- MCM and BigFix Mobile server and components installation
- Identity service configuration
  Starting from UEM3.0, MCM extends the capability to identify and manage devices based on users. The users can be identified based on their associated attributes including names, roles, group memberships, distribution list memberships, or physical locations. The devices identified based on users can then be targeted and managed through various configurations to provide conditional access and ensure compliance, endpoint security, and App protection.
- Simple Certificate Enrollment Protocol (SCEP) configuration
  BigFix MCM supports certificate management and certificate-based authentication through Simple Certificate Enrollment Protocol (SCEP). SCEP is the fastest and most secure way to provision certificates to all your MCM-managed devices. With SCEP, IT Admins can automate issuing certificates to the endpoints to provide access to corporate Wi-Fi, VPN, and secure e-mail through encryption.
- Domain join installation and configuration
  Read this section to learn the prerequisites and the tasks to install ODJ service to set up your environment to enroll Windows devices and join Active Directory domain or both Active Directory and Azure AD domain.
  - Prerequisites for hybrid domain join
    Read this page to learn the prerequisites to set up ODJ service to support the Azure AD joined Windows devices to join on-premises AD on enrollment.
    - Azure AD – Add custom domain
      Learn how to add a custom domain in Azure AD.
    - Azure AD – Configure BigFix MDM
      Learn how to configure on-premises MDM in Azure AD.
    - MEM – Configure deployment profile
      Learn how to configure Windows autopilot deployment profiles for Hybrid AD join in Microsoft Endpoint Manager (MEM).
    - MEM – Import hardware hash
      Learn how to import hardware hash from a Windows 10 machine.
    - Azure AD Connect – Configure synchronization
      To configure synchronization between on-premises Active Directory (AD) and Azure Active Directory (Azure AD) using Azure AD Connect, follow these steps:
    - Azure AD connect – Configure Hybrid AD join
      To configure hybrid AD from device options in Azure AD Connect, follow these steps:
  - Prerequisites for AD domain join
    Read this page to learn the prerequisites to set up ODJ service to support Windows devices to join on-premises AD on enrollment.
  - ODJ and MDM SSL certificates and keys
    SSL certificates and keys are required to authenticate the MDM Server to the Windows ODJ Server. These certificates and keys must be generated through the BESAdmin command. The generated SSL certificates/keys are stored in the directory that you specify in the BESAdmin command.
  - Install and configure ODJ Service - BigFix WebUI
    ODJ service is an "Add-on" service and is installed through WebUI after completing the initial MDM server install. Log in to WebUI to install and configure ODJ Service.
  - Troubleshoot ODJ
    https://learn.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current
- SAML-authentication configuration
  MCM and BigFix Mobile supports Security Assertion Markup Language (SAML) authentication to enroll devices to protect sensitive data and ensure secure access to corporate resources.

Prerequisites for hybrid domain join

Read this page to learn the prerequisites to set up ODJ service to support the Azure AD joined Windows devices to join on-premises AD on enrollment.

Prerequisites

Before proceeding with the Hybrid Domain Join process, ensure that all the following prerequisites are met and that you have the necessary information and access required to perform the configuration and implementation steps.

The endpoint must be a physical Windows 10 or Windows 11 machine.
Note: Windows Autopilot enrolment with Offline Domain Join cannot be performed on a virtual machine.
ODJ and MDM SSL certificates and keys.
Global Administrator credentials for your Azure AD tenant.
Azure Active Directory (Azure AD) Configuration
- Add custom domain in Azure Active Directory and verify
- Configure BigFix MDM in Azure Active Directory
Microsoft Endpoint Manager (MEM) Configuration:
- Create Windows Autopilot deployment profiles for Hybrid AD join
- Import Hardware hash of the devices
On-premises AD
- Provision and Grant the service account permissions to create computer objects in Active Directory
Azure AD connect
- Configure synchronization
- Configure Hybrid AD join