All BLOCK ALL DATA accounts need to be created on the Internal CRM just as a any regular user

see New Device Setup

Set the account on the association BLOCK ALL DATA.

Secondary option is to use this Sign-up Link