Manage your devices with Gusto (as an admin)

1. Head to the Devices section of your admin account.
2. Review the details of the Early Access Beta for this feature—scroll down the page to find answers to FAQs.
3. Click Get started.
   • By selecting Get started you agree to the Gusto Device Management terms and conditions. 

This one-time setup for admins will only take a few minutes and is required by Apple for added security. It gives Gusto the permission to manage your company’s devices and you can revoke access at any time. 

1. From the “Set up Apple device management” page, scroll to step one and click Download Gusto_CSR.plist.
   • You do not need to open this file—you’ll use it in the next step. It gives Gusto permission to manage your company’s Apple devices and allows you to revoke Gusto’s access at any time.
2. Visit https://identity.apple.com/pushcert/ and sign in.
   • Make sure you have access to and are using a company-controlled Apple ID, or create a new one.
   • Employees will not need access to this Apple ID/account.
3. After signing in to Apple, click Create a Certificate in the top-right of the page.
4. Read the Terms of Use, check the box stating you accept the terms, then click Accept.
5. Click the Choose file button and choose the file Gusto_Certificate_Signing_Request.plist, usually located in your “Downloads” folder. 
   • You do not need to enter any notes—they are optional to help you identify this file later.
6. Click Upload.
7. On the “Confirmation” page, click Download. 
8. The downloaded file will be named MDM_ Gusto, Inc._Certificate.pem.
9. Click Done.
10. Upload the push certificate (MDM_ Gusto, Inc._Certificate.pem) in Gusto by clicking Select file.
11. Click Finish setup.

You’ve successfully enrolled in the Device Management program. Once you enroll the first device (this could be your device), you can start managing it through Gusto.

Enrolling devices in your company’s device management program helps you enforce security and compliance policies, remotely lock or wipe the device if it’s lost, stolen or during employee departures, and automatically capture and view basic device details.

Heads up

You’re only able to enroll devices that are owned by the company. We encourage you to remind your employees not to enroll their personal devices for now. In the future, we plan to support employee-owned devices, so stay tuned.

Devices can be enrolled in two ways:

• Send enrollment invitations to employees
• Team members must have an email address on file in Gusto
• The person assigned to the device will get an email invitation to enroll the devices themselves.
• Most secure and saves you time.
• Manually enroll devices using one time codes
• Use this option for team members who do not have an email address on file in Gusto.
• Good for admins enrolling devices for others, or enrolling unassigned devices.

If you need use both methods, select one method to start. Then come back and enroll the remaining devices using the other method.

Enroll devices by sending enrollment invitations to employees

1. Head to the Devices section—if you clicked Enroll my first device at the end of getting set up you’ll be taken to the “Enroll new devices” page automatically.
2. Click Enroll devices. 
3. Confirm Send enrollment invitations to the primary device users is selected. 
   • The person assigned to the device will be asked to enroll the device themselves via email invitation—this means only employees or contractors with an email address on file in Gusto will be able to enroll their device. 
   • Coming soon: the ability to set up the device manually on behalf of an employee with a one-time code. 
4. Click Next: Assign devices. Here’s what you can expect once you’ve added devices and owners:
   • We’ll send each teammate an invitation with enrollment instructions—they’ll have 10 days to enroll their device or you’ll need to resend a new enrollment link. 
     • We remind them about the deadline 3 days before.
   • Track device enrollments—view pending enrollments from your Devices dashboard under the “Pending enrollments” tab where you can send enrollment reminders, cancel enrollments, and more. 
   • Enrolled devices will appear in your Devices list.
     • Once enrolled, you can start managing those devices.
5. Scroll to the “Select teammates and devices” header, then click the dropdown under the “Device Assignee” column.
6. Select an employee.
   • For now, it’ll default to showing the devices as a company-owned computer, since phones and tablets are not fully supported at this time.
7. Click Add.
   • A new line will appear so you can add additional employees/devices as needed.
8. When you’re ready to invite the team to enroll their computers, click Send invitations—invitations will be sent immediately.

You’ll be taken back to the Devices dashboard, where you can see invitations sent in the Pending Enrollment tab.

Enroll devices manually using one-time codes

1. Head to the Devices section—if you clicked Enroll my first device at the end of getting set up you’ll be taken to the “Enroll new devices” page automatically.
2. Click Enroll devices.
3. Select Manually enroll devices using one-time codes.
4. Click Continue.
   • You’ll need to have the device in front of you so you can generate a one-time code to manually enroll those devices for team members. You can also leave them unassigned.
5. On the device you want to enroll, open a browser and go to https://app.gusto.com/device_enroll.
6. Enter the one-time enrollment code from Gusto, then follow the on-screen instructions to enroll. Codes expire after 5 minutes.
   • You can regenerate the code as needed by clicking Get a new code. 
7. Generate a new code for each device you want to enroll.

Successfully enrolled devices will appear in your enrolled devices list. Any devices you’ve started an enrollment for but did not finish will appear in your pending enrollments list.

Resend, cancel, or view pending enrollments

1. Under the “Actions” column, click the three-dot menu.
2. Select to either:
   • Re-send enrollment invitation
   • Cancel the enrollment
   • View the enrollment link—use this if the teammate cannot find their link or if you want to see what they will.

Head to the Devices section of your Gusto account to review the devices you manage. Use the “Active” and “Pending Enrollment” tabs to review all information.

For active devices, under the “Device” column, click the link to manage that device.

Here’s what you can see and do with each device:

• Review inventory details, such as:
• Who the device is assigned to
• Model 
• Serial number
• OS Version
• Check the device status/health
• How much storage is available
• Encryption status (is the hard drive protected)
• View profiles & enrollments
• Review all security measures set in place by the device management program (e.g. password complexity, firewalls, etc)
• View applications
• List of applications that the employee has installed on the device
• Add custom notes
• Examples: purchase details, who had the computer previously, what’s been repaired historically, age of the device, etc.
• Lock device (more info below)
• Wipe device (more info below)

Click the dropdowns below to learn more about each action you can take while managing the devices.

To locate the security profiles on a device:

1. Head to the Devices section.
2. Click on the device name under the “Device” column.
3. Click the Profiles & enrollment dropdown.

View the security profiles applied to the device.

Types of security profiles

If you need help at any time, get the quickest answers by emailing [email protected] directly.