017: Review enrolled vs unenrolled for BYOD/Corporate

Implementation Effort: Medium to High – Requires device-ownership decisions, enrollment-path design, and user communications.

User Impact: High – Enrollment choices directly affect privacy boundaries, app access, support model, and end-user setup experience.

Overview

A Zero Trust device strategy must distinguish between personally owned and corporate-owned devices because the acceptable management depth, privacy model, and support obligations are different. In Microsoft Intune for iOS and iPadOS, BYOD and corporate-owned scenarios each have supported enrollment paths, and the chosen path determines what the organization can enforce. The right design balances security requirements, user privacy, app access needs, and the operational burden of device lifecycle management.

Implementation Guidance

1. Classify the device populations first: personally owned by knowledge workers, corporate-owned assigned devices, shared devices, and specialized or frontline scenarios may all need different enrollment patterns.
2. For personally owned iOS or iPadOS devices, prefer the enrollment and app-management model that preserves personal privacy while still enforcing work-data controls. In many organizations, app protection without full enrollment or a lighter-weight user enrollment model is the right baseline for BYOD.
3. For corporate-owned iOS or iPadOS devices, use Apple Business Manager with Automated Device Enrollment wherever possible so devices are supervised, consistently configured, and easier to recover or reassign.
4. Define which resources truly require a compliant enrolled device versus which can be accessed from an approved app with app protection. Do not force full enrollment for every scenario if app-level protection meets the requirement.
5. Document privacy expectations clearly for users. BYOD programs fail when users believe personal content is visible to IT even when it is not.
6. Review the design periodically as business risk, supported Apple enrollment flows, and Microsoft Intune features evolve.

Reference

• Device enrollment guide for Microsoft Intune - Microsoft Intune — Provides enrollment guidance for supported platforms, including iOS and iPadOS.
• Step 5 – Enroll devices in Microsoft Intune - Microsoft Intune — Covers enrollment and deployment options for devices, including iOS and iPadOS in Intune.
• App Protection Policies Overview - Microsoft Intune — Describes Intune app protection policies that apply to iOS and iPadOS apps.
• Tutorial - Use Apple Business to enroll iOS/iPadOS devices in Intune - Microsoft Intune — Shows how to use Apple Business Manager and automated device enrollment with Intune.