As an administrator, you can push a MobileID install link to users, and then users can click the link to install both the MobileID app and their MobileID token. (Installing MobileID by link is supported on Windows, Android and iOS, but not on MacOS).
Installing MobileID by link requires the DualShield Deployment Service (DDS) to be accessible from the public network.
Set up Deployment Service
Set up SSO Service
If you also plan to enable OOBA by push authentication, then the DualShield SSO is also required. SSO provides the function of OOBA registration and verification.