070: User enrollment

Implementation Effort: Medium

User Impact: Medium

Overview

Apple user enrollment is designed for personally owned iOS/iPadOS devices where the organization wants a stronger management relationship than app-protection-only access, but without full corporate-style control of the device. It creates a managed work boundary and limits what administrators can see and control, which makes it appropriate for privacy-sensitive BYOD scenarios.

In a Zero Trust design, user enrollment is a middle ground between no device management and full corporate enrollment.

Implementation Guidance

1. Decide whether user enrollment is actually necessary. If the main requirement is to protect Microsoft 365 data in a small set of apps, app protection policies may be simpler.
2. If enrollment is needed, compare the supported Apple user-enrollment methods for your environment, including account-driven options where supported.
3. Document the limitations up front: not every configuration profile, certificate scenario, or remote action available for fully managed devices is available with user enrollment.
4. In the Microsoft Intune admin center, create the enrollment profile, scope it to the right users, and test required app delivery plus access controls.
5. Align Conditional Access and compliance expectations with what user-enrolled devices can actually report or enforce.
6. Publish user-facing privacy guidance so employees understand the organization manages the work context, not the full personal device.

Reference

• Supported actions for iOS/iPadOS user enrollment in Microsoft Intune
• Set up account-driven Apple User Enrollment in Microsoft Intune
• App protection policies overview for Microsoft Intune