Enrollment methods for Apple devices

There are three main methods of device enrollment in a device management service. One of those methods—Device Enrollment—has two different ways for a user to enroll: account-driven and profile-based. When you enroll Apple devices in a device management service, depending on the enrollment method, those devices can be supervised. Supervision generally denotes that the organization owns the device, which provides additional control over its configuration and restrictions. The table below summarizes the enrollment methods and whether they result in the device being supervised. For more information on supervision, see About Apple device supervision.

Enrollment method	Minimum supported operating system versions	Supervised upon enrollment?
Account-driven User Enrollment	iOS 15 iPadOS 15 macOS 14 visionOS 1.1	No
Account-driven Device Enrollment	iOS 17 iPadOS 17 macOS 14 visionOS 1.1	No (iPhone, iPad, Apple Vision Pro) Yes (Mac)
Profile-based Device Enrollment	iOS 4 iPadOS 13.1 OS X 10.7 tvOS 9	No (iPhone, iPad, Apple TV) Yes (Mac)
Automated Device Enrollment	iOS 13 iPadOS 13.1 macOS 10.14.4 tvOS 13 watchOS 10 visionOS 2.0	Yes

Note: Not all enrollment options are available in all device management services. To learn which options are available for your devices, consult your developer’s device management service documentation.

How enrollment methods help to protect the user’s privacy

The table below shows what information and capabilities are available to a device management service depending on the enrollment method. For more information on additional data separation capabilities that account-driven enrollment methods support, see Account-driven enrollment methods.

Depending on the method an organization uses to enroll the device in a device management service, information about the user, their data, and the device vary. Account-driven User Enrollment and account-driven Device Enrollment provide the user with the most privacy and data separation. Profile-based Device Enrollment and Automated Device Enrollment provide IT teams the most control over the device.

Note: The table below illustrates key differences of enrollment methods, but isn’t a fully comprehensive list:

Ability	Account-driven User Enrollment	Account-driven Device Enrollment	Profile-based Device Enrollment	Automated Device Enrollment
Enforceable restrictions	Curated list	Unsupervised only	Unsupervised only	All
Require passcode
Remotely erase managed data
Configure per-app VPN
Install and configure managed apps
Query the operating system version number
Query unique device identifiers like serial number
Query the device’s time zone
Query the device phone number
Query the roaming status
Query list of all apps
Configure VPN
Remotely erase all content and settings
Require complex passcode or password
Enforce software updates
Enforce and manage FileVault
Set the device name in macOS
Manage Activation Lock in macOS
Take over management of a personal app
Manage Activation Lock in iOS, iPadOS, and visionOS
Configure Always On VPN
Configure a global HTTP proxy
Set the device name in iOS, iPadOS, and visionOS
Turn on Managed Lost Mode
Query the device location
Collect frequency of app usage
View personal calendars, contacts, mail, notes, reminders
View iMessage or SMS messages
View FaceTime or phone call logs
View Safari browser history

Helpful?

Apple Platform Deployment

Enrollment methods for Apple devices

How enrollment methods help to protect the user’s privacy