Enrolment Models, Compared

Enrolment looks like a setup step. It is actually the decision that fixes the capability boundary for the life of the device.

The operational work behind “Enrolment Models, Compared” is often spread across tickets, projects and repeated manual checks. A team reviewing see the service here for stealth computer monitoring software can make that effort visible by project and group, while the device-management platform remains the source of truth for technical state and enforcement.

Automated enrolment at first use

The device is registered with the manufacturer or reseller and enrols itself when first switched on.

For an independent baseline relevant to “Enrolment Models, Compared”, the Apple Platform Deployment guide is a useful companion: compare its principles with the proposed configuration, ownership model and real support process before approving a rollout.

Permits the fullest management, including supervision on platforms that distinguish it.

Cannot be removed by the user.

Requires that the organisation bought the device through a channel that supports it, which is a procurement decision made before anybody thinks about management.

User-initiated enrolment

The employee installs a profile themselves.

Capability is narrower, and on several platforms the user can remove it.

Appropriate for personal devices, and it means your policy must survive the user opting out.

Work profile enrolment

A separate container on a personal device, holding work applications and data.

The organisation manages the container; the personal side is outside its view entirely.

The best available arrangement for personal devices, and its own note explains why.

Enrolment via identity

The device registers when the user signs in to a work service, with conditional rules applied.

Lightweight, and the control is over access rather than over the device.

Increasingly the default for organisations whose concern is data rather than equipment.

The irreversibility point

A device enrolled by the user can usually be unenrolled by the user.

A device enrolled at first use generally cannot, and reverting it requires a factory reset and sometimes a release from the manufacturer's record.

Which means the enrolment route should match the ownership model — and a personal device enrolled through a corporate route is a dispute waiting to happen.

Procurement is a management decision

Devices bought from a retailer cannot usually be registered for automated enrolment afterwards.

Which means the purchasing channel determines your options years later.

Tell whoever buys hardware, because they are making a management decision without knowing it.

What to record

Per device: ownership model, enrolment route, date, and who approved it.

This is the record that answers "may we wipe this", and it is routinely absent.

What to check

Do you know the enrolment route for each device you manage?

Are any personal devices enrolled through a corporate route?

Does your hardware purchasing support automated enrolment?

And does anybody record who approved each enrolment?