A method comprising: receiving, by a mobile computing device, a command to enroll with an enterprise mobile device management server; in response to receiving the command to enroll with the enterprise mobile device management server, launching, by the mobile computing device, an enrollment application; requesting, by the mobile computing device, using the enrollment application, configuration information for the enterprise mobile device management server from an automatic discovery service; after requesting the configuration information for the enterprise mobile device management server from the automatic discovery service, receiving, by the mobile computing device, a message comprising the configuration information for the enterprise mobile device management server from the automatic discovery service; sending, by the mobile computing device, using the enrollment application, an enrollment request message to the enterprise mobile device management server, wherein the enrollment request message comprises the configuration information for the enterprise mobile device management server; switching, by the mobile computing device, from the enrollment application to a certificate management system application on the mobile computing device; requesting, by the mobile computing device, using the certificate management system application, one or more derived credentials from a certificate management system server; storing, by the mobile computing device, using the certificate management system application, the one or more derived credentials in a shared vault on the mobile computing device; switching, by the mobile computing device, from the certificate management system application to the enrollment application; retrieving, by the mobile computing device, using the enrollment application, a derived credential of the one or more derived credentials stored in the shared vault on the mobile computing device; and providing, by the mobile computing device, using the enrollment application, the derived credential of the one or more derived credentials retrieved using the enrollment application to the enterprise mobile device management server to enroll the mobile computing device with at least one mobile device management service provided by the enterprise mobile device management server. receiving, by a mobile computing device, a command to enroll with an enterprise mobile device management server; in response to receiving the command to enroll with the enterprise mobile device management server, launching, by the mobile computing device, an enrollment application; requesting, by the mobile computing device, using the enrollment application, configuration information for the enterprise mobile device management server from an automatic discovery service; after requesting the configuration information for the enterprise mobile device management server from the automatic discovery service, receiving, by the mobile computing device, a message comprising the configuration information for the enterprise mobile device management server from the automatic discovery service; sending, by the mobile computing device, using the enrollment application, an enrollment request message to the enterprise mobile device management server, wherein the enrollment request message comprises the configuration information for the enterprise mobile device management server; switching, by the mobile computing device, from the enrollment application to a certificate management system application on the mobile computing device; requesting, by the mobile computing device, using the certificate management system application, one or more derived credentials from a certificate management system server; storing, by the mobile computing device, using the certificate management system application, the one or more derived credentials in a shared vault on the mobile computing device; switching, by the mobile computing device, from the certificate management system application to the enrollment application; retrieving, by the mobile computing device, using the enrollment application, a derived credential of the one or more derived credentials stored in the shared vault on the mobile computing device; and providing, by the mobile computing device, using the enrollment application, the derived credential of the one or more derived credentials retrieved using the enrollment application to the enterprise mobile device management server to enroll the mobile computing device with at least one mobile device management service provided by the enterprise mobile device management server.