A computing device that performs auto-discovery on first boot and automatically enrols the computing device with an Enterprise Mobility Management, EMM, server upon first boot of the device, comprising: a non-transitory, computer-readable medium containing instructions; at least one processor that executes the instructions to perform stages comprising: in response to firmware executed during first boot of a computing device, contacting a vendor server at a first address provided in the firmware and sending the vendor server a serial number which is included in the firmware; receiving a second address of a management server from the vendor server if the computing device is to be managed; downloading a management agent from the management server, the management agent enforcing policies on the computing device, wherein the policies are defined at the management server; installing the management agent; and blocking user login to an operating system of the computing device until after the management agent is installed on the computing device; wherein the vendor server is a server operated by a manufacturer or vendor of the computing device and stores ownership information including device serial numbers to check whether the computing device is a managed device; and wherein the management server is a server in an EMM system and takes control of the computing device before the operating system loads; wherein the policies comprise compliance rules which set forth one or more conditions that must be satisfied in order for the computing device to be deemed compliant and other limitations on device functionality; wherein in an instance in which the computing device is deemed not compliant, the management server takes steps to control access of the computing device to enterprise files, enterprise applications and enterprise email. a non-transitory, computer-readable medium containing instructions; at least one processor that executes the instructions to perform stages comprising: in response to firmware executed during first boot of a computing device, contacting a vendor server at a first address provided in the firmware and sending the vendor server a serial number which is included in the firmware; receiving a second address of a management server from the vendor server if the computing device is to be managed; downloading a management agent from the management server, the management agent enforcing policies on the computing device, wherein the policies are defined at the management server; installing the management agent; and blocking user login to an operating system of the computing device until after the management agent is installed on the computing device; wherein the vendor server is a server operated by a manufacturer or vendor of the computing device and stores ownership information including device serial numbers to check whether the computing device is a managed device; and wherein the management server is a server in an EMM system and takes control of the computing device before the operating system loads; wherein the policies comprise compliance rules which set forth one or more conditions that must be satisfied in order for the computing device to be deemed compliant and other limitations on device functionality; wherein in an instance in which the computing device is deemed not compliant, the management server takes steps to control access of the computing device to enterprise files, enterprise applications and enterprise email. in response to firmware executed during first boot of a computing device, contacting a vendor server at a first address provided in the firmware and sending the vendor server a serial number which is included in the firmware; receiving a second address of a management server from the vendor server if the computing device is to be managed; downloading a management agent from the management server, the management agent enforcing policies on the computing device, wherein the policies are defined at the management server; installing the management agent; and blocking user login to an operating system of the computing device until after the management agent is installed on the computing device; wherein the vendor server is a server operated by a manufacturer or vendor of the computing device and stores ownership information including device serial numbers to check whether the computing device is a managed device; and wherein the management server is a server in an EMM system and takes control of the computing device before the operating system loads; wherein the policies comprise compliance rules which set forth one or more conditions that must be satisfied in order for the computing device to be deemed compliant and other limitations on device functionality; wherein in an instance in which the computing device is deemed not compliant, the management server takes steps to control access of the computing device to enterprise files, enterprise applications and enterprise email.