Are You Configuring Any Additional Enrollment Restrictions?


Yes No (decision tree completed)


This is the final step in the device enrollment workflow. There are elements you need to consider before deciding.

Some of the additional restrictions you have access to are the following.

  • Enrollment Restrictions

    • Limit enrollment by device platform, model, operating system, ownership type, and enrollment type. Turn those limitations into an enrollment restriction policy by allowing only the prescribed devices (whitelisting) or blocking all the prescribed devices (blacklisting).
    • Set an unlimited number of enrolled devices per user or you can set a minimum and a maximum number of devices per user.
    • Set a maximum number of enrolled devices at the current Organization Group and below.
    • Restrict enrollment to known users and restrict enrollment to configured groups.
  • Grouping Restrictions
    • Configure how the group ID is assigned.
    • Determine the default device ownership level for newly enrolled devices.
    • Set the default role for Self-Service Portal access and new user accounts and determine what happens to the devices belonging to users who become inactive.
    • Map roles onto users based on what user group they belong to. You can even rank those assignments if a user belongs to more than one user group.
  • Optional Prompts
    • Configure seven different prompts and messages at enrollment time including a prompt for device ownership type, welcome message, MDM installation message, enrollment email prompt, device asset number prompt, enrollment transition message (Android only), and TLS mutual authentication (Windows only).

  • Customization
    • Include support information such as email and phone number which display during the enrollment process, giving the users a way to obtain assistance.
    • After enrollment is complete, you can display a landing page on the device's default web browser.
    • Subscribe to an App Group during the enrollment process. An App Group can be a list of accepted apps (whitelist), a list of forbidden apps (blacklist), or a list of required apps which will be used to determine device compliance. In other words, if a subscribed App Group is part of a device, and one of the apps in that group is not installed on the device, then that device will fail the compliance check and be subject to possibly prohibitive actions. For more information, see Compliance Policies Overview.


Would you like to start the device enrollment decision tree over again? Visit Device Enrollment Overview.