Skip to main content

097: Userless Enrollment

Implementation Effort: Medium
User Impact: Medium

Overview​

Userless enrollment is used when a device is intended for a shared task, kiosk, scanner, meeting room, or other scenario where associating the device with one primary user is not the right management model. In Intune, this typically maps to dedicated-device or similar device-centric management patterns. For Zero Trust, userless devices should have highly constrained functionality, device-based targeting, limited data persistence, and a clear reprovisioning path when the device changes hands or falls out of a healthy state.

Implementation Guidance​

  1. Select the correct enrollment pattern for the scenario, such as Android Enterprise dedicated devices or a supported AOSP path when Google Mobile Services are not present.
  2. Use automated provisioning where possible, such as QR, zero-touch, or other bulk onboarding methods that fit your hardware supply chain.
  3. Target policies and apps to device groups rather than user groups when no primary user context exists.
  4. Deploy only the required apps and settings, and pair the device with kiosk, launcher, network, update, and compliance controls appropriate to its role.
  5. Document the operational lifecycle: how the device is named, handed out, recovered, reset, and returned to service.
  6. Monitor for drift, app crash loops, and devices that are offline or stuck outside compliance for extended periods.

Reference​