A method, system, and computer-readable storage media for granting a device access to a managed group are disclosed. Identification information may be exchanged between a management device in the managed group and a managed device through a secure first channel. If the identification information is verified by the management device, the managed device may be granted access to the managed group through the secure first channel. If access is granted, the managed device may access the managed group through a secure communication session on a network. If the identification information is not verified, the management device may send a cryptographic key to the managed device through the secure first channel. The cryptographic key may be used to create an encrypted communication session between the managed device and management device over the network.