User Enrollment lets an organisation manage work accounts and work data on a personally owned iPhone or iPad, with a limited set of controls. IT cannot manage the person's personal accounts. If a team needs broader control, Apple points to account driven Device Enrollment, at some cost in user flexibility.
The idea behind it
Personal devices are the hard case for mobile security. The owner wants privacy. The company wants confidence that its data is protected. Apple's answer is to narrow what management can touch, so the two interests do not collide.
Apple's deployment documentation states that because the user owns the device, you can apply only a limited set of payloads and restrictions. The management scope is the organisation's accounts, settings and information that it provisions through a device management service.
What IT can do
- Manage organisation accounts, settings and information provisioned through the service.
- Work with accounts created in Apple's business or school tools, or with federated accounts linked to an identity provider such as Google Workspace or Microsoft Entra ID.
- Provide iCloud storage for work data tied to those organisational accounts.
After signing in, the user can see what is managed on the device and how much storage the organisation provides. That visibility is a design feature, not an accident.
What IT cannot do
The page is blunt on the headline limit: IT can never manage a user's personal account. It also cannot take full control of the device. The same documentation says an organisation that needs more control should use account driven Device Enrollment instead.
Apple's overview page does not spell out every capability, so do not assume answers it leaves open, such as exactly which device data a management service can read. Check the detailed enrollment and privacy pages, and ask your vendor for a list.
Choosing between lighter and heavier enrollment
| Need | Lean towards |
|---|---|
| Staff own the phone, privacy is a selling point | User Enrollment |
| Company owns the phone | Device Enrollment, with fuller control |
| Strict regulatory control on devices | Company owned and fully controlled |
If the answer to "can we accept a limited control set?" is no, the device probably should not be personal.
Writing the employee notice
Do not rely on the technology to persuade. Put on one page:
- What the company manages (work mail, work apps, work accounts).
- What it never touches (personal accounts).
- What happens at offboarding (work data removed).
- Who to ask.
Where this fits with your other controls
Light enrollment does not replace the basics: a strong passcode, current iOS, and phishing resistant sign in to work apps. It also does not help against a person who forwards work files by hand.
Safeguard's iOS app can be installed on an enrolled or unenrolled iPhone like any other App Store app. Management of the phone itself stays with your device management service.
Quick check
Does User Enrollment mean IT can wipe my whole phone?
Apple's overview does not say it can, and it describes control as limited to organisational accounts and data. Confirm the exact behaviour with your IT team and vendor.
Why not just use full enrollment for everyone?
On a personally owned phone, full control costs trust and may not be acceptable to staff. Company owned phones are a better fit for it.
Sources
Last reviewed: 19 October 2026.
