Last updated: July 24, 2026
This guide helps administrators choose the right enrollment technique based on device ownership and management mode: Fully Managed, Fully Managed with Work Profile, or Personally Owned. It outlines Android options such as Zero-touch, Knox Mobile Enrollment, QR code, and NFC, and Apple options such as Automated Device Enrollment and Apple Configurator, so organizations can match the enrollment method to their deployment scenario.
Device enrollment can be chosen based on device ownership, the required management mode, and specific deployment scenarios. This document explains the different ownership types, management modes, their use cases, and the enrollment methods applicable to each management mode.
Devices can either be company-owned or personally owned, and this distinction plays a crucial role in determining the appropriate enrollment method.
Management Modes are classified into three types based on the device ownership. If Company-owned devices, management can be implemented in two ways: Fully Managed or Fully Managed with a work profile. In case of personal devices, management is done using a Work Profile, and such devices are refereed to as Profile Owner devices.
Fully Managed mode is used for company-owned devices that are entirely controlled by the organization. These devices are provisioned and configured by IT admins to ensure full compliance with corporate policies.
Use Cases:
This mode is used for company-owned devices where both work and personal profiles are created, allowing employees to use a single device for professional and personal purposes. The organization manages and secures only the work profile, while the personal space remains private and unmanaged.
Use Cases:
Not applicable — Apple devices do not support a “Work Profile” equivalent. Instead, use standard management or User Enrollment for BYOD scenarios.
This mode is used for employee-owned devices (BYOD), where a secure work container is created to manage corporate apps and data without affecting personal content. IT admins can manage only the work profile, ensuring data protection while maintaining user privacy.
Use Cases:
For detailed information on Device Enrollment, visit our Device Enrollment Guide and for managing Android and Apple devices, visit our Android Device Management and Apple Device Management Guide.
Use Fully Managed mode, enrolled via Zero-touch Enrollment, Knox Mobile Enrollment (KME), QR Code (EMM Token) Enrollment, NFC Enrollment, or ADB Enrollment on Android, or Automated Device Enrollment (ABM/ASM) or the Apple Configurator app on Apple devices.
Yes, use Fully Managed with a Work Profile on Android (via Zero-touch Enrollment, Knox Mobile Enrollment, or QR Code Enrollment), which manages only the work profile while the personal space stays unmanaged. Apple devices don't support an equivalent Work Profile mode, so use standard management or User Enrollment for BYOD instead.
On Android, use a QR code or enrollment link, Self Enrollment, or User Invitations. On Apple, use Apple User Enrollment, a QR code or enrollment link, or Self Enrollment/User Invitations — all of which manage only the work profile without accessing personal apps or data.