A cloud-based management system comprising a cloud server, a managed device and an agent, wherein the cloud server comprises: a network interface coupled to a managed device and an agent via a network; and a controller coupled to the network interface and configured to: receive, over the network, an identifier of the managed device; receive, over the network, from the agent, a request to pair with the managed device; provide, over the network, an unlock token to the managed device responsive to receiving the request to pair with the managed device; provide, over the network, the unlock token and a pairing token to the agent responsive to receiving the request to pair with the managed device, the agent being configured to provide the unlock token to the managed device responsive to receiving the unlock token from the cloud server; receive, over the network, a pairing token from the managed device, the pairing token being sent by the managed device to the cloud server based on the managed device validating the unlock token received from the agent; validate the received pairing token using the provided pairing token; and pair the agent with the managed device responsive to a successful validation of the received pairing token using the provided pairing token. a network interface coupled to a managed device and an agent via a network; and a controller coupled to the network interface and configured to: receive, over the network, an identifier of the managed device; receive, over the network, from the agent, a request to pair with the managed device; provide, over the network, an unlock token to the managed device responsive to receiving the request to pair with the managed device; provide, over the network, the unlock token and a pairing token to the agent responsive to receiving the request to pair with the managed device, the agent being configured to provide the unlock token to the managed device responsive to receiving the unlock token from the cloud server; receive, over the network, a pairing token from the managed device, the pairing token being sent by the managed device to the cloud server based on the managed device validating the unlock token received from the agent; validate the received pairing token using the provided pairing token; and pair the agent with the managed device responsive to a successful validation of the received pairing token using the provided pairing token. receive, over the network, an identifier of the managed device; receive, over the network, from the agent, a request to pair with the managed device; provide, over the network, an unlock token to the managed device responsive to receiving the request to pair with the managed device; provide, over the network, the unlock token and a pairing token to the agent responsive to receiving the request to pair with the managed device, the agent being configured to provide the unlock token to the managed device responsive to receiving the unlock token from the cloud server; receive, over the network, a pairing token from the managed device, the pairing token being sent by the managed device to the cloud server based on the managed device validating the unlock token received from the agent; validate the received pairing token using the provided pairing token; and pair the agent with the managed device responsive to a successful validation of the received pairing token using the provided pairing token.