Settings

The Settings page gathers your MDM configuration in six sections: Platforms, Integrations, Notifications, Enrollment, Desktop app, and Automatic unenrollment. Go to MDM > Settings. Changes save automatically. There is no button to confirm. Fields you type in, such as URLs, the notification email, and domains, save shortly after you stop typing.

​

Platforms

One row per platform: Apple, Windows, Linux, and Android. Each row shows the platform status (Active, Action needed, or Being set up). The Apple and Windows rows also show whether zero-touch deployment is on. Click a row to open its settings.

• Apple: set up and renew the Apple Push Notification (APN) certificate. Once Apple is active, the same window lists your Apple Business accounts for zero-touch deployment and your Volume Purchase Program tokens for App Store apps. Click Add to connect one, or open its … menu to Renew or Disconnect it.
• Windows: once Windows is active, lists your Windows Autopilot setups for zero-touch deployment. Click Add to start one, or Finish setup on an unfinished one.
• Linux: shows whether Linux devices are managed.
• Android: click Connect Google Enterprise to bind Android Enterprise. See Android.

To turn a platform on or off, contact our team. The window says so next to the platform switch.

​

Integrations

The security and compliance tools connected to your devices: SentinelOne, ThreatDown, and Vanta. Each connected integration has a row with its status. Click it to see its details. Click Add integration to open the catalog. Each card shows its type (EDR or Compliance) and offers Connect, Talk to sales, or both. Integrations marked Coming soon cannot be connected yet.

​

Notifications

MDM notifications is the email address that receives MDM-related notifications, such as confirmations of locks and wipes.

​

Enrollment

​

Allowed domains for MDM invitations

Primo sends enrollment invitations to these domains only. Click Add domain to add one. Domains that come from your email provider cannot be removed.

​

Require authentication to enroll

When Require authentication to enroll is on, employees sign in with their work account before their device enrolls, in two places:

• the Zero-Touch Deployment setup flow on Apple devices
• the enrollment page that the iOS, iPadOS, and Android enrollment links open

Primo is the identity provider for this sign-in, so there is nothing to configure in SaaS. Turn it on if employees enroll iPhones or iPads through the enrollment link. The link is the same for every employee, so the sign-in is how Primo knows who enrolled the device and assigns it to them. With the setting off, these devices enroll without an owner. See Enroll iPhones and iPads.

​

Automatic device assignment

Primo matches a new device to an employee from its data. Choose one option:

• On: Primo assigns the device to the suggested employee.
• Suggest only: Primo displays the suggestion, and you validate it manually.
• Off: Primo makes no suggestion.

See Use assignment suggestion.

​

Resolve name conflicts

When a device and Primo disagree on its name, choose which one wins:

• Keep device name: the device name syncs from the physical device into Primo.
• Keep Primo name: Primo manages the hostname and pushes it to the device.

​

Automatic MDM migration

Windows only. When Automatic MDM migration is on, Windows devices enrolled in another MDM move to Primo on their own. See Migrate from another MDM.

​

All installers

Click All installers to download a generic MDM enrollment installer for any active platform. Use them when a device is enrolled before it is assigned. Available for: macOS, macOS agent (.pkg), iOS, iPadOS, Android (Personal / work profile), Android (Company-owned / fully managed), Windows (x64), Windows (ARM64), Linux (Debian/Ubuntu), Linux (Fedora/CentOS), Linux (Arch). Android exposes two enrollment modes side by side:

• Personal (work profile) — employee-driven enrollment on a personal device. An isolated work profile holds company apps and data; personal data stays private.
• Company-owned (fully managed) — IT-driven enrollment on a new or factory-reset company device. Primo manages the whole device.

See Android for the end-to-end flow of each mode. iOS and iPadOS, like Android, use a link to your enrollment page instead of a downloadable profile. Click Download next to iOS · iPhone or iPadOS · iPad to show the QR code, then scan it with the device or click Open link. Turn on Require authentication to enroll so each device is assigned to the employee who enrolls it. Use Reset enrollment links to invalidate existing installer links and generate new ones. The iOS, iPadOS, and Android links point to your enrollment page and stay the same after a reset.

​

Desktop app

​

Display Fleet Desktop to end users

When this setting is on, employees can check their security posture and install or update apps from the Fleet Desktop menu bar icon. If the change can’t be applied, the switch goes back to its previous value. While Primo Desktop is deployed, the setting is off and locked: the Primo app replaces the Fleet Desktop icon.

​

Transparency URL

Overrides the “Transparency” link in the Fleet Desktop app with a URL of your choice, directing employees to your own resource.

​

Support URL

Overrides the “Support” link in the Fleet Desktop app, directing employees to your chosen support resource.

​

Automatic unenrollment

Choose how long a device can stay offline before Primo unenrolls it and tags it To enroll: After 30 days offline, After 60 days offline, or After 90 days offline. Select Deactivated to keep offline devices enrolled. When automatic unenrollment is on, turn on Invite the employee to re-enroll to send an MDM invitation to the owner of an unenrolled device.