Approve a New Laptop for Company Apps with Device Trust

TL;DR — If your new laptop can reach the internet but company apps say the device is not trusted, the laptop usually is not enrolled in device management or is missing the company certificate/profile used by Zero Trust checks. Enroll the laptop in your company's device-management tool, sign in with your work account, sync policies, and confirm the device shows as compliant before trying the app again. Reading time: ~5 min

Goal

When you finish, your new laptop is enrolled and marked compliant (meeting company security rules) in your organization's device-management system, and company apps open without the "device not approved," "untrusted device," or repeated login-block messages.

Prerequisites

• Your work email address and password
• Your second factor for sign-in, such as an authenticator app or security key
• A stable internet connection on the new laptop
• Local administrator access on the laptop if your company requires it for enrollment
• Your company's device-management or identity portal URL, if they gave you one
• One of these access levels in your company's admin tools if you are doing the approval yourself: device admin, endpoint admin, or identity admin
• The laptop's serial number if your company pre-registers devices (usually printed on the box or in the OS settings)
• Windows 11 or macOS 14+ recommended

Steps

Step 1: Confirm the block is a device-trust issue

Open the company app in your browser and try to sign in.

If your company uses a browser access portal, use the exact URL they gave you. If you are not sure, use your normal app URL.

What you should see when this succeeds: the error mentions the device, compliance, management, certificate, or trust, not a wrong password.

Step 2: Enroll the laptop in device management

Use the path for your operating system.

Windows 11

Open:

Settings → Accounts → Access work or school → Connect

Enter your work email address, complete sign-in, then choose the option to allow your organization to manage the device if prompted.

After sign-in, open:

Settings → Accounts → Access work or school → <your work account> → Info → Sync

What you should see when this succeeds: your work account appears under "Access work or school," and Sync finishes without an error.

macOS

If your company gave you a management portal link, open it in Safari or Chrome and sign in with your work account. If your company uses Apple's built-in enrollment, open:

System Settings → Privacy & Security → Profiles

If a profile is waiting, click it and install it. If there is no profile, use the company enrollment link from IT or your identity portal.

What you should see when this succeeds: a company management profile appears in Profiles, and you are prompted to allow management or install a certificate.

Step 3: Complete identity sign-in and device registration

In your company's identity portal, sign in with your work account and approve the sign-in with your second factor.

If your company uses a browser-based device registration page, complete it there. A common flow looks like this:

[New Laptop] ---- 1. sign in ----> [Identity Portal]
[Identity Portal] ---- 2. enroll ----> [Device Management]
[Device Management] ---- 3. policy/profile ----> [New Laptop]
[New Laptop] ---- 4. compliance status ----> [Identity Portal]
[Identity Portal] ---- 5. allow app ----> [Company App]

What you should see when this succeeds: the portal shows the device as registered, managed, or enrolled.

Step 4: Force a policy sync on the laptop

This pulls down the latest company rules, certificates, and app-access checks.

Windows 11

Open:

Settings → Accounts → Access work or school → <your work account> → Info → Sync

If you have Company Portal installed, you can also open it and use:

Company Portal → Settings → Sync

macOS

Open your company's management app if installed and click Sync, Check for updates, or Refresh. If your company uses profiles only, remove nothing; just leave the laptop online for 5-10 minutes after enrollment.

What you should see when this succeeds: the sync finishes, and any company certificates, VPN settings, or browser profiles appear automatically.

Step 5: Check that the device is marked compliant in the admin portal

If you are an admin approving the laptop, use your provider's dashboard. Vendor names vary, but the path is usually under devices.

Use one of these common paths in your provider's dashboard:

Identity provider dashboard → Devices → All devices → <new laptop>

or:

Device-management dashboard → Devices → <new laptop> → Compliance

Set or confirm these literal states if your system allows manual approval:

Managed: Yes
Compliant: Yes
Blocked: No
Owner: <user's work email>

If your system does not allow manual changes, wait for the compliance check to finish and refresh the page every 2 minutes.

What you should see when this succeeds: the device status is "Compliant," "Trusted," or "Approved."

Step 6: Retry the company app from a supported browser

Open the app again in a supported browser. If your company standard is not documented, try the browser installed by the management profile first.

Use the exact app URL, then sign in with your work account.

What you should see when this succeeds: the app opens normally instead of showing a device block page.

Verify it works

Check all three of these:

1. On the laptop, the work account or company profile is present.

Windows 11

Settings → Accounts → Access work or school

Expected result: your work account is listed and connected.

macOS

System Settings → Privacy & Security → Profiles

Expected result: a company profile is installed.

1. In the admin or self-service portal:

Devices → <new laptop>

Expected result: status shows "Compliant," "Managed," or "Trusted."

1. In the company app:

Open the app URL and sign in.

Expected result: no device-trust error, and the app home page loads.

Common pitfalls

The laptop was signed into the app, but not enrolled in management

Mistake: You completed normal work-account login but skipped the "allow your organization to manage this device" step.

Symptom: Password works, but the app says the device is untrusted or non-compliant.

Fix: Go back to Settings → Accounts → Access work or school → Connect on Windows, or install the company profile on macOS, then sync again.

The wrong account was used during enrollment

Mistake: The laptop was enrolled with a personal Microsoft, Google, or Apple account instead of the work account.

Symptom: The device appears in the OS, but not in the company devices list.

Fix: Remove the personal connection, then enroll again with the exact work email address.

Policy sync has not finished yet

Mistake: You tried the app immediately after enrollment.

Symptom: The device shows as registered, but still not compliant.

Fix: Leave the laptop online for 5-10 minutes, then use the Sync button again and refresh the device page.

The browser does not have the company certificate or profile yet

Mistake: You used a different browser before the management profile finished installing.

Symptom: One browser is blocked, but another works.

Fix: Use the company-standard browser, or wait for sync to complete and reopen the browser.

The device was pre-registered with the wrong serial number

Mistake: An admin entered the wrong serial number when preparing the laptop.

Symptom: Enrollment finishes, but the device never matches the approved record.

Fix: In the admin dashboard, correct the serial number on the device record or delete the bad record and enroll again with the actual laptop.

Old login state is cached in the browser

Mistake: The browser kept an old failed sign-in session.

Symptom: You keep seeing the same block page even after the device becomes compliant.

Fix: Sign out of the app, close all browser windows, reopen the browser, and try again in a private/incognito window.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.