Skip to main content

096: User enrollment

Implementation Effort: Medium
User Impact: Medium

Overview​

User enrollment refers to enrollment flows in which the end user signs in and completes some or all of the device onboarding steps. On Android, this commonly includes personally owned work profile enrollment and other user-driven corporate onboarding experiences. A Zero Trust-friendly user enrollment experience makes the secure path easy to complete and well understood. Users should know what will happen to the device, what the organization can manage, and what business access they gain after enrollment.

Implementation Guidance​

  1. Prepare prerequisites before rollout: licensing, enrollment restrictions, branding, support contacts, Terms of Use if applicable, and the device types you will support.
  2. Communicate the privacy model clearly. BYOD users should understand the difference between work-profile or app-only management and full device control.
  3. Target enrollment profiles, device categories, apps, compliance policies, and configuration profiles so the device reaches a working secure state soon after enrollment completes.
  4. Require strong authentication during enrollment and validate whether MFA prompts or Conditional Access policies create loops that must be handled differently for bootstrap.
  5. Pilot the full user journey, including first sign-in, Company Portal or setup flow, required app installation, policy application time, and resource access after the device becomes compliant.
  6. Use enrollment troubleshooting reports and help desk metrics to improve instructions and reduce abandonment rates.

Reference​