Starting in iOS 13 and macOS 10.15 Catalina, Apple introduced a new enrollment method called User Enrollment.
This is a notably different mode of enrollment than the previously available through Apple DEP, Enrollment link, or Supervised mode.
While these modes still exist, User Enrollment (sometimes referred to as UEMDM) aims to address Bring Your Own Device (BYOD) deployment scenarios specifically.
Why Another Enrollment Mode? #
What’s different from other enrollment methods? #
Device Information:
The MDM is no longer able to retrieve device-identifying information, such as a serial number, universal device identifier (UDID), IMEI, or Mac addresses. Instead, the device provides an anonymized identifier specifically created for the MDM enrollment. If a device is unenrolled from the MDM and then re-enrolls at a later time, a new identifier is generated, maintaining the anonymity of the end-user and the hardware.
App Management:
MDMs can still install and remove Apps but now they can just see the information about managed Apps. The rest of the Apps installed by the user remain private and will not be visible by the MDM and they can not be configured as managed apps.
Additionally, some native apps are prepared for User Enrollment scenarios, providing also the possibility to isolate information at the App level.
Profiles & Configurations:
Just a few profiles and configurations are available and can be enforced on the device:
- Wi-Fi.
- Per-app VPN.
- Account-related profiles, like email, calendar, contact, and Exchange/ActiveSync.
Commands:
User Enrollment also prevents administrators from setting or clearing passwords, wiping the device, and performing other device-level configurations.
What’s different from other enrollment methods? #
The User Enrollment method relies on Managed Apple IDs for user identification. This also enables two important features:
- App & media licensing: apps must be managed through Apple Business Manager and VPP so that necessary licenses are provisioned.
- iCloud access: Apple provides business-level iCloud services, such as shared storage for an organization. The Managed Apple ID acts as a credential to provide access to these resources.
We highly recommend reading the documentation related to Managed Apple IDs to fully understand the benefits and features.
