Skip to main content

053: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: Medium to High

User Impact: High

Overview​

A Zero Trust device strategy should begin with a clear ownership and management model. The central question is whether a device is corporate-owned or personally owned, and whether the organization needs full device management, limited enrollment, or app-only protection. The answer affects privacy expectations, what controls can be enforced, and whether access decisions can rely on device compliance.

As a rule, corporate-owned devices should usually be enrolled and managed. Personally owned devices often use either limited enrollment or app-protection-only controls, depending on business need and employee privacy requirements.

Implementation Guidance​

  1. Inventory your major device populations: corporate-owned dedicated devices, corporate-owned assigned devices, shared devices, and BYOD.
  2. For corporate-owned devices, prefer a full enrollment model that supports compliance, configuration, certificates, Wi-Fi, VPN, update management, and remote actions.
  3. For BYOD devices, decide whether you truly need device enrollment. If the requirement is only secure access to Microsoft 365 data, consider app protection policies with Conditional Access instead of full enrollment.
  4. For Apple BYOD, compare account-driven user enrollment or other supported user-enrollment paths with MAM-only. For Android BYOD, compare Android Enterprise personally owned work profile with MAM-only.
  5. Document what each model allows: device compliance, Conditional Access based on compliance, certificate delivery, app deployment, remote wipe of work data, and privacy boundaries.
  6. Publish a user-facing ownership policy so employees understand what IT can and cannot see or control on personally owned devices.
  7. Keep exception cases small and explicit, such as executives, contractors, labs, or regulated frontline workflows.

Reference​