Home Getting Started How to Enroll Devices

How to Enroll Devices

Last updated on Apr 17, 2026

How to Enroll Devices

Device enrollment is the process of connecting your school's devices to KyberGate so they can be filtered, monitored, and managed. KyberGate supports iPads, Chromebooks, macOS, and Windows devices through platform-specific enrollment methods.

Before You Begin

  • You must have Admin access to the KyberGate dashboard
  • You need admin access to your MDM solution (for iPads/macOS) or Google Admin Console (for Chromebooks)
  • Have the KyberGate PAC file URL and CA certificate ready (both available in the dashboard under Devices → Enrollment)
  • Ensure your network allows outbound connections to *.kybergate.com on ports 80, 443, 8080, and 8443

Enrollment Overview

KyberGate uses a proxy-based architecture for web filtering. Enrollment involves two key components:

  1. PAC File (Proxy Auto-Configuration) — Tells the device where to send its web traffic for filtering
  2. CA Certificate — Enables KyberGate to inspect HTTPS traffic (SSL/MITM inspection) so encrypted sites can be properly categorized and filtered

Both must be deployed to every filtered device.

Method 1: Enrolling iPads via MDM

This is the most common enrollment method for schools with iPad fleets.

  1. Log in to the KyberGate Dashboard

  2. Go to Devices → Enrollment → iPad

  3. Download:

    • The KyberGate CA Certificate (.cer file)
    • Note the PAC File URL (e.g., https://pac.kybergate.com/proxy.pac?org=YOUR_ORG_ID)

  4. In your MDM (Jamf Pro, Mosyle, or Kandji):

    For Jamf Pro:

    • Go to Configuration Profiles → New
    • Add a Certificate payload → upload the KyberGate CA certificate → set to "Trust"
    • Add a Global HTTP Proxy payload → select "Auto" → enter the PAC file URL
    • Scope the profile to your target devices/groups
    • Click Save

    For Mosyle:

    • Go to Management → Profiles
    • Create a new profile with the Certificate and Proxy payloads
    • Deploy to your target device groups

    For Kandji:

    • Create a new Library Item with Certificate and Proxy settings
    • Assign to your target Blueprint

  5. Devices will receive the profile on next check-in (usually within 15 minutes)

  6. Verify enrollment: Go to Devices in the KyberGate dashboard — enrolled iPads should appear with a green status

💡 Pro Tip: Test the profile on a single device before deploying to your entire fleet. Verify that browsing works normally, blocked sites show the KyberGate block page, and activity appears in the dashboard.

Method 2: Enrolling Chromebooks via Google Admin

  1. Log in to the KyberGate Dashboard

  2. Go to Devices → Enrollment → Chromebook

  3. Copy the Chrome Extension ID for your organization

  4. In Google Admin Console:

    • Navigate to Devices → Chrome → Apps & Extensions → Users & Browsers
    • Click the + button → Add Chrome app or extension by ID
    • Paste the KyberGate extension ID
    • Set installation policy to Force install
    • Select the target Organizational Units (OUs)
    • Click Save

  5. The extension will automatically install when students sign in to their Chromebooks

  6. The extension configures proxy settings and certificate trust automatically — no additional MDM configuration needed

💡 Pro Tip: Create a test OU in Google Admin with a few devices to validate the extension before rolling out to the entire school.

Method 3: Enrolling macOS Devices

  1. Log in to the KyberGate Dashboard
  2. Go to Devices → Enrollment → macOS
  3. Download the KyberGate Agent (.pkg installer)

Via MDM (recommended):

  • Upload the .pkg to your MDM (Jamf Pro, Mosyle, or Kandji)
  • Deploy as a managed installation to target devices
  • The agent handles everything automatically: installs the CA certificate, configures the PAC file, and starts filtering

Manual installation:

  • Double-click the .pkg file on the target Mac
  • Follow the installation wizard
  • Enter admin credentials when prompted
  • The agent will start automatically and appear in the menu bar

Method 4: Enrolling Windows Devices

  1. Log in to the KyberGate Dashboard
  2. Go to Devices → Enrollment → Windows
  3. Download the KyberGate Agent (.msi installer)

Via GPO/SCCM/Intune:

  • Deploy the .msi as a software package through your preferred management tool
  • The installer runs silently with /quiet flag
  • Example silent install: msiexec /i KyberGateAgent.msi /quiet /norestart

Manual installation:

  • Run the .msi installer on the target Windows PC
  • Accept the UAC prompt
  • The agent installs, configures proxy settings, installs the CA certificate, and starts filtering

Verifying Enrollment

After enrolling devices, verify everything is working:

  1. Check the Devices page — The device should appear with a green status indicator
  2. Browse to a blocked site — The KyberGate block page should appear
  3. Check Activity Logs — Browsing activity from the device should appear within 2–5 minutes
  4. Test HTTPS filtering — Visit an HTTPS site in a blocked category to confirm SSL inspection is working (you should see the block page, not a browser certificate error)

Troubleshooting

Device not appearing in dashboard:

  • Confirm the PAC file URL is correctly configured
  • Verify the device has internet connectivity
  • Check your MDM for deployment errors or pending profile installations

Certificate errors in the browser:

  • The CA certificate may not be installed or trusted
  • On iOS: Check Settings → General → About → Certificate Trust Settings
  • On macOS: Check Keychain Access → System → look for the KyberGate certificate
  • On Windows: Run certmgr.msc and check Trusted Root Certification Authorities

HTTPS sites not being filtered:

  • This indicates the CA certificate is not properly installed
  • Reinstall or redeploy the certificate through your MDM
  • Some apps (like Firefox) maintain their own certificate store — see our Firefox configuration guide

Related Articles