Endpoint Registration and Provisioning
This domain tests the endpoint lifecycle: how an endpoint becomes known to EMS, how it is grouped, and how it receives configuration and software. The exam frequently separates registration from provisioning, so know which action creates the endpoint record and which action delivers settings.
Registration methods
- Invitation is the primary EMS-driven method. EMS generates a code or link delivered by email, SMS, or manually. The user installs FortiClient, enters the invitation, and the endpoint registers to EMS.
- AD/LDAP connection supplies users and groups for assignment. Importing a user does not by itself register that user’s endpoint; registration still requires an invitation or another registration path.
- FortiGate telemetry can send endpoint information to EMS through the EMS connector, which is useful in environments where endpoints already pass through a FortiGate.
- Registration binds the endpoint to EMS and creates the record used for profiles, compliance, vulnerability results, and ZTNA tags.
Provisioning
- A provisioning profile delivers settings and can include antivirus, web filtering, application firewall, USB control, VPN, ZTNA, vulnerability scan, and patch management.
- Profiles are assigned to endpoints, users, or groups. Assignment through AD groups is the scalable approach; direct endpoint assignment is useful for exceptions.
- FortiClient installation can be distributed by EMS-hosted installer, GPO, or a software management tool. The installer must point to the correct EMS address, and the endpoint must be able to reach TCP 8013.
- After registration, the endpoint checks in and applies the assigned profile. Changes made in EMS are delivered on the next check-in, not instantly.
Worked example
A company hires 50 sales staff. The administrator creates an AD group called Sales, creates an EMS invitation scoped to that group, and assigns a profile with antivirus, web filtering, and SSL VPN. FortiClient is deployed by GPO with the EMS address embedded. When each user enters the invitation, the endpoint record appears under the Sales group and the profile is applied. Reasoning: the invitation establishes registration, the AD group drives assignment, and the profile delivers the security settings.
Traps that cost marks
- Confusing registration with provisioning: an endpoint can be registered but still have no profile applied.
- Letting invitations expire, then troubleshooting the endpoint instead of issuing a new invitation.
- Expecting AD synchronization to be immediate; group changes can take a sync cycle.
- Assigning a profile to a user when the requirement is endpoint-based, or the reverse, producing unexpected inheritance.
- Ignoring license limits; a registered endpoint may not receive licensed features if entitlements are exhausted.