Enabling Company Hub Enrollment for Windows Phone Devices


Microsoft allows the use of internal apps to add functionality to the native MDM clients (Company Apps on 8.0 devices and Workplace on 8.1 devices). With AirWatch the Company Hub is simply the AirWatch Agent. The agent is uploaded to the console as an Internal Application and designated the Company Hub. Pushing the app to a device allows AirWatch to perform a variety of device management functions such as Application Management, GPS tracking, Device Configuration, etc.

Important: Company Hub is not supported in Windows 10 Mobile. AirWatch recommends using the AirWatch Agent enrollment method as it offers simple step-by-step instructions for the end user.

Enabling Company Hub Enrollment


Initially configuring Company Hub enrollment requires signing the AirWatch Agent file directly using a certificate provided through Microsoft. The specific requirements to complete this process are outlined below.

  • The AirWatch Agent - The AirWatch Agent can be downloaded from the Resources portal on myAirWatch. The Agent will be downloaded as an .xap file.
  • Microsoft Developer Account - This is required for the AirWatch Admin to enable Company Hub enrollment in the console. Setting up Company Hub enrollment requires a Windows Account ID as well as a code signing certificate, which will be obtained through the developer account. Microsoft has additional information on registering a developer account available here
    • Windows Account ID - Note that this account is different from the Windows Live ID. This account allows the administrator to add applications to the Windows Phone Development Center.
    • Code Signing Certificate - This certificate is provided along with the developer package. This certificate will be used for 2 purposes, outlined below.
      • Generating an AET token - This token is a file with the .aetx extension. It will be uploaded to the AirWatch Console and is required to manage internal Windows Phone 8 applications. This is necessary to manage any WP8 internal applications, including the AirWatch Agent. Microsoft has additional information on creating an .aet token available here.
      • Signing the AirWatch Agent .xap file - After the AirWatch Agent has been code signed with a company's specific code signing certificate, it will be uploaded into the console as the Company Hub Application. There are two ways to code sign the AirWatch .xap: via a Powershell script, or with Visual Studio directly. Information regarding this process is available on Microsoft's website here.

Caution: The AET Token has an expiration date typically of one year. When the token is downloaded from Microsoft its expiration date may not be noted. When the token expires in the AirWatch console the administrator is not notified. Make sure to make a note of the expiration date, as there is currently not an expiration notice given. It is also advised that this process be done prior to device enrollment, as devices enrolled prior to the token upload will have to be re-enrolled to receive internal applications.

More information about the validation of company accounts can be found on Microsoft's website.

Code Signing the AirWatch Agent .xap file

After obtaining the Symantec Code Signing Certificate and the AirWatch .xap file from the Resources portal, you will need to Code Sign the AirWatch .xap. There are two ways to code sign the AirWatch .xap: with a Powershell script, and with Visual Studio.

To sign with Powershell, run the following command to ensure that the path environment variable is configured correctly for XapSignTool.

set path=%path%;"%ProgramFiles(x86)%\Microsoft SDKs\Windows Phone\v8.0\Tools\XapSignTool

Otherwise, you must specify the full path for XapSignTool when you run it on the command line in the following step.
ext run XapSignTool with the following command line. Be sure to replace the placeholder text in this command with appropriate values.

XapSignTool.exe sign /f PFXFile /p Password XAP

To sign with Visual Studio, start the VS2012 x86 Native Tools Command Prompt as an administrator. To access this prompt, open Start and type:

 VS2012 x86 Native Tools Command Prompt

Configuring the Company Hub in the AirWatch Console

Use the process below to upload the generated AET token and signed AirWatch Agent to the console, and then enable the AirWatch Agent as the Company Hub for WP8 devices.

Upload the AET token to the Console

  1. In the AirWatch Console, navigate to Groups & Settings -> All Settings or Devices -> Settings -> Devices & Users -> Windows -> Windows Phone 8 -> Agent Settings.
  2. In the Enterprise App Management section, select to Enable Enterprise App Management.
  3. Select the upload button next to the Upload Enterprise Token field to browse for the AET (.aetx) file.


Upload the signed AirWatch .xap file to the Console

  1. In the AirWatch Console, navigate to Apps & Books -> Applications -> List View.
  2. Select the Internal Application tab.
  3. Select Add Application and a window will appear.
  4. Select Upload.
  5. Select Browse to find the application file and then select Save to upload the internal application.

Select and enable the AirWatch Agent as the Company Hub

  1. Go to Groups & Settings -> All Settings or Devices -> Settings -> Devices & Users -> Windows -> Windows Phone 8 -> Company Hub Settings.
  2. Select Enable Company Hub.
  3. Enter the details for the Company Hub name, and use the drop-down to select the AirWatch Agent application.


Enrolling a Device

Enrolling a device through Company Hub allows the end user a simplified enrollment process, outlined below. Note that this process is only valid for users that belong to an Organization Group that has Company Hub enrollment enabled.

  1. On your phone, navigate to Settings -> Company Apps (WP8.0) / Workplace (WP8.1).
  2. Select Add Account.
  3. Enter the email address and password provided by your administrator and then click Sign In.
  4. Enter the server URL for the AirWatch environment into which you are enrolling if you are not making use of Windows Auto-Discovery Service. The server URL should be in the following format:https://{Device_Services_URL}/DeviceServices/Discovery.svc. Username and Domain are not required.
  5. Ensure Install company app or Hub is selected and then select Done.
  6. Ensure the AirWatch Agent gets pushed out to the device as an internal application.
  7. Company Hub Agent can take up to 5 minutes before device is fully enrolled.


Have more questions? Submit a request


Article is closed for comments.