fleetdm
Enroll personally owned BYOD iOS/iPadOS hosts using account-based (Apple) user enrollment
customer-flavia: Slack thread: https://fleetdm.slack.com/archives/C0389SEPLR3/p1729001707646059customer-numa: Slack thread TODOcustomer-eponym: In person off site (quote: can't do BYOD without this feature as they move to managed apple id's in q1)customer-preston: Gong snippet TODOcustomer-reedtimmer: Gong snippet TODOcustomer-pingali: Gong snippet TODO- community request: https://macadmins.slack.com/archives/C0214NELAE7/p1728670150649039
- @ddribeiro: There have been several Slack threads about Apple deprecating profile driven user enrollment in iOS 18. Folks are confusing this with profile driven device enrollment (not deprecated).
- @noahtalerman: I think let's add a sentence or two to clarify in this in the guide here: https://fleetdm.com/guides/enroll-byod-ios-ipados-hosts
- @noahtalerman: We can say account-based is coming soon.
- @noahtalerman: I think let's add a sentence or two to clarify in this in the guide here: https://fleetdm.com/guides/enroll-byod-ios-ipados-hosts
User stories
- #23233
- #27391
- #27390
Thanks for tracking this @ddribeiro.
enroll their personally owned devices (iOS/iPadOS) into Fleet using a Managed Apple ID
Do you know if customers attached to this issue provide Managed Apple IDs to their end users today?
I think customer-starchik is planning on rolling out Managed Apple IDs but hasn't started yet.
I think that's correct @noahtalerman these features can be aligned with the ability of customers to federate Apple IDs & reclaim domain-owned email addresses.
Hey @dherder, @ddribeiro, and @nonpunctual heads up, I'm closing this issue as a duplicate of #19448.
Apple ID enrolls, Data in harmony, peace. Fleet, the bridge, connects.
Reopening because this request did not end up getting covered in #19448. That ticket is still using profile driven device enrollment.
This ticket to support account driven user enrollment, which uses Managed Apple Accounts.
I would be very grateful if you could implement this feature promptly because we would like to switch from Intune and Jamf to you. However, there are over 350 Managed Apple IDs in our company, where the management has decided that they can now all use BYOD. Accordingly, this is currently a showstopper to switch to you. Let me know if you need anything as support or testing for the implementation
Support for account driven user enrollment would enable an organization to allow their employees to enroll their personally owned devices (iOS/iPadOS) into Fleet using a Managed Apple ID. User Enrollment provides several benefits to the employee and organization when enrolling personally owned devices:
- Organization data is cryptographically separated from personal data.
- Enrollment of personal devices is streamlined as there is a standardized flow built into iOS in Settings > General
- Some typical MDM capabilities for organization owned devices is not available (i.e. Erase Device), offering an employee peace of mind that their personal information cannot be erased when they enroll.
- Organization can see limited device details (i.e. Can only see a list of managed apps, not a full list).
Links: Apple Platform Deployment: User Enrollment and MDM Apple Platform Deployment: User Enrollment MDM Information
- @noahtalerman: I think let's add a sentence or two to clarify in this in the guide here: https://fleetdm.com/guides/enroll-byod-ios-ipados-hosts
- @noahtalerman: We can say account-based is coming soon.
Hey @spokanemac, can you please take this guide update? Thanks :)
@ambrusps @Patagonia121 we peeled a research story off of this request and brought it into the design sprint: #23233
This means that we think we won't ship a feature for it in 6 weeks. Instead, it might take an extra sprint (9 weeks).
Potential blocker for prospect-quantz. The "why" behind needing this: https://us-65885.app.gong.io/call?id=6106796065079746590&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A762%2C%22to%22%3A783%7D%5D
Good write up on state of BYOD enrollment https://jonbrown.org/blog/byo-with-me-in-2025-for-mac-ios-andriod-and-windows/
Is MacOS scoped into this? As it also supports account-driven device enrolment from 15.2 Monterey per Apple docs & the email above. Thanks!
Moving the old user stories list out of the issue description to below. User stories that contribute to this request now live in the "Sub-issues" section.
User stories
- #23233
- #27391
- #27390
Suggestion: Ensure conditional access via Entra ID works with account-drive user enrollment.
FYI @kc9wwh @Patagonia121 we shipped Account-driven User Enrollment for personal Apple devices (BYOD). A request for blondelet and pingali.
I think we can let the customer know that enrollment is ready to test but the management features aren't done yet. I'm leaving this request open.
What's left?
- Installing App Store (VPP) apps: https://github.com/fleetdm/fleet/issues/31138
- Default team: https://github.com/fleetdm/fleet/issues/30871
- Unenrolling (turning off MDM): https://github.com/fleetdm/fleet/issues/31584
cc @marko-lisica
Feedback from @allenhouchins:
- In addition to the gaps we've already identified, Allen noticed that Fleet isn't mapping the IdP info to hosts that enroll via account-driven user enrollment. @marko-lisica do we have a user story for the IdP mapping?
- To enable end user authentication via GitOps, we have to set
macos_setup.enable_end_user_authenticationtotrue. But, I'm doing this on the personal mobile devices team which only has iOS/iPadOS hosts.- @allenhouchins: I think having one
apple_setupcontrol works for this. - @noahtalerman: Captured this in a separate issue here: https://github.com/fleetdm/fleet/issues/33059
- @allenhouchins: I think having one
Allen noticed that Fleet isn't mapping the IdP info to hosts that enroll via account-driven user enrollment. @marko-lisica do we have a user story for the IdP mapping? To
@noahtalerman I thought that we implemented this but seems that we didn't design it in first iteration (probably to make scope smaller). I just filed story: #33097.
