Skip to main content

032: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: High
User Impact: High at design time, Medium at runtime

Overview​

One of the most important design decisions in a Zero Trust mobile program is when to require device enrollment and when to rely on app protection without enrollment. The answer should be based on device ownership, business data sensitivity, regulatory obligations, and the amount of device control the organization legitimately needs.

This review should happen before administrators build policies, because it determines whether the organization will use compliance policies, device restrictions, certificates, Wi-Fi/VPN profiles, or only app-level protections.

Implementation Guidance​

  1. Break your mobile estate into clear scenarios:
    • Corporate-owned fully managed devices
    • Corporate-owned personally enabled devices
    • Personally owned BYOD devices
    • Shared or frontline devices
  2. For each scenario, decide whether you need:
    • Full enrollment and compliance
    • App protection without enrollment
    • No mobile access at all
  3. Use enrolled-device scenarios when you must manage the device posture itself, such as OS updates, certificates, Wi-Fi/VPN, endpoint security, or kiosk/shared-device behavior.
  4. Use app protection without enrollment when the goal is to protect data inside supported apps while respecting personal-device boundaries.
  5. Map these decisions to Microsoft Entra Conditional Access so users are routed into the correct access model.
  6. Document exceptions such as contractors, partners, executives, and regulated populations.
  7. Revisit the model annually as platform capabilities and business needs change.

A common mistake is forcing enrollment for every mobile user when app protection would meet the business requirement, or allowing app-only access where strong device trust is actually required.

Reference​