Enroll personally owned BYOD iOS/iPadOS hosts using account-based user enrollment

[ddribeiro]

• customer-flavia: Slack thread: https://fleetdm.slack.com/archives/C0389SEPLR3/p1729001707646059
• customer-numa: Slack thread TODO
• customer-eponym: In person off site (quote: can't do BYOD without this feature as they move to managed apple id's in q1)
• customer-preston: Gong snippet TODO
• customer-reedtimmer: Gong snippet TODO
• customer-pingali: Gong snippet TODO
• community request: https://macadmins.slack.com/archives/C0214NELAE7/p1728670150649039
• @ddribeiro: There have been several Slack threads about Apple deprecating profile driven user enrollment in iOS 18. Folks are confusing this with profile driven device enrollment (not deprecated).
  • @noahtalerman: I think let's add a sentence or two to clarify in this in the guide here: https://fleetdm.com/guides/enroll-byod-ios-ipados-hosts
    • @noahtalerman: We can say account-based is coming soon.

---

User stories

• 🎸 Research: End user and IT UX for account-based user enrollment #23233

[nonpunctual]

related to #18119

[noahtalerman]

Thanks for tracking this @ddribeiro.

enroll their personally owned devices (iOS/iPadOS) into Fleet using a Managed Apple ID

Do you know if customers attached to this issue provide Managed Apple IDs to their end users today?

I think customer-starchik is planning on rolling out Managed Apple IDs but hasn't started yet.

[nonpunctual]

I think that's correct @noahtalerman these features can be aligned with the ability of customers to federate Apple IDs & reclaim domain-owned email addresses.

[noahtalerman]

Hey @dherder, @ddribeiro, and @nonpunctual heads up, I'm closing this issue as a duplicate of #19448.

[fleet-release]

Apple ID enrolls,
Data in harmony, peace.
Fleet, the bridge, connects.

[ddribeiro]

Reopening because this request did not end up getting covered in #19448. That ticket is still using profile driven device enrollment.

This ticket to support account driven user enrollment, which uses Managed Apple Accounts.

[MalteKiefer]

I would be very grateful if you could implement this feature promptly because we would like to switch from Intune and Jamf to you.
However, there are over 350 Managed Apple IDs in our company, where the management has decided that they can now all use BYOD.
Accordingly, this is currently a showstopper to switch to you.
Let me know if you need anything as support or testing for the implementation

[noahtalerman]

Support for account driven user enrollment would enable an organization to allow their employees to enroll their personally owned devices (iOS/iPadOS) into Fleet using a Managed Apple ID. User Enrollment provides several benefits to the employee and organization when enrolling personally owned devices:

1. Organization data is cryptographically separated from personal data.
2. Enrollment of personal devices is streamlined as there is a standardized flow built into iOS in Settings > General
3. Some typical MDM capabilities for organization owned devices is not available (i.e. Erase Device), offering an employee peace of mind that their personal information cannot be erased when they enroll.
4. Organization can see limited device details (i.e. Can only see a list of managed apps, not a full list).

Links:
Apple Platform Deployment: User Enrollment and MDM
Apple Platform Deployment: User Enrollment MDM Information

[noahtalerman]

• @noahtalerman: I think let's add a sentence or two to clarify in this in the guide here: https://fleetdm.com/guides/enroll-byod-ios-ipados-hosts
• @noahtalerman: We can say account-based is coming soon.

Hey @spokanemac, can you please take this guide update? Thanks :)

[noahtalerman]

@ambrusps @Patagonia121 we peeled a research story off of this request and brought it into the design sprint: #23233

This means that we think we won't ship a feature for it in 6 weeks. Instead, it might take an extra sprint (9 weeks).

[nonpunctual]

latest from Apple on account-driven enrollment: