# How to choose enrollment techniques for your organization? Last updated: July 24, 2026 This guide helps administrators choose the right enrollment technique based on device ownership and management mode: Fully Managed, Fully Managed with Work Profile, or Personally Owned. It outlines Android options such as Zero-touch, Knox Mobile Enrollment, QR code, and NFC, and Apple options such as Automated Device Enrollment and Apple Configurator, so organizations can match the enrollment method to their deployment scenario. Device enrollment can be chosen based on device ownership, the required management mode, and specific deployment scenarios. This document explains the different ownership types, management modes, their use cases, and the enrollment methods applicable to each management mode. ## Device Ownership Devices can either be company-owned or personally owned, and this distinction plays a crucial role in determining the appropriate enrollment method. ## Management Mode Management Modes are classified into three types based on the device ownership. If Company-owned devices, management can be implemented in two ways: Fully Managed or Fully Managed with a work profile. In case of personal devices, management is done using a Work Profile, and such devices are refereed to as Profile Owner devices. ### Fully Managed Devices Fully Managed mode is used for company-owned devices that are entirely controlled by the organization. These devices are provisioned and configured by IT admins to ensure full compliance with corporate policies. **Use Cases:** - **Corporate-only devices:** Used exclusively for business purposes with restricted access to personal apps or accounts. - **Kiosk or dedicated devices:** Locked down to a single app or a set of work apps. - **Shared devices:** Configured for multiple users (e.g., in hospitals or warehouses) with limited functionality and user switching enabled. - **High-security environments:** Devices requiring strict policy enforcement, remote wipe, and compliance monitoring. ### Enrollment Methods for Fully Managed Devices #### Android - **[Zero-touch Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/android_zero_touch_enrollment.html):** Ideal for large-scale deployments; devices are automatically enrolled during initial setup. - **[Knox Mobile Enrollment (KME)](https://www.manageengine.com/mobile-device-management/help/enrollment/knox_mobile_device_management.html):** Used for Samsung devices to streamline provisioning. - **[QR Code (EMM Token) Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_android_qr_code_enrollment.html):** Allows quick enrollment by scanning a QR code during device setup. - **[NFC Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/enroll_android_devices_using_admin_enrollment_tool.html):** Used to enroll devices by tapping an NFC tag containing the enrollment details. - **[ADB Enrollment](https://www.manageengine.com/mobile-device-management/help/android_for_work/mdm_device_owner_provisioning_adb.html):** Suitable for testing or small-scale setups where devices are connected via USB for manual enrollment. #### Apple - **[Automated Device Enrollment (ABM/ASM)](https://www.manageengine.com/mobile-device-management/help/enrollment/automated_device_enrollment.html):** Seamlessly enrols company-owned devices purchased through Apple or authorized resellers. - **[Apple Configurator App (on iPhone or Mac)](https://www.manageengine.com/mobile-device-management/help/enrollment/enroll_ios_devices_using_apple_configurator.html):** Used to manually add and supervise devices for enrollment. ### Fully Managed with a Work Profile This mode is used for company-owned devices where both work and personal profiles are created, allowing employees to use a single device for professional and personal purposes. The organization manages and secures only the work profile, while the personal space remains private and unmanaged. **Use Cases:** - **Corporate-owned, personally enabled (COPE) devices:** Employees can use the same device for both business and personal needs. - **Data separation and privacy:** Ensures corporate data stays within the work profile while personal data remains unaffected by IT controls. - **Security compliance:** IT can enforce policies, deploy apps, and perform remote actions only within the work profile. ### Enrollment Methods for Fully Managed with a Work Profile #### Android - **[Zero-touch Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/android_zero_touch_enrollment.html) and [Knox Mobile Enrollment (KME)](https://www.manageengine.com/mobile-device-management/help/enrollment/knox_mobile_device_management.html):** Enable automatic setup of both work and personal profiles on company-owned devices. - **[QR Code (EMM Token) Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_android_qr_code_enrollment.html):** Simplifies provisioning by creating separate work and personal profiles during setup. #### Apple Not applicable — Apple devices do not support a “Work Profile” equivalent. Instead, use standard management or User Enrollment for BYOD scenarios. ### Personally owned Devices This mode is used for employee-owned devices (BYOD), where a secure work container is created to manage corporate apps and data without affecting personal content. IT admins can manage only the work profile, ensuring data protection while maintaining user privacy. **Use Cases:** - **Bring Your Own Device (BYOD) programs:** Employees can access corporate apps and resources securely on their personal devices. - **Enhanced data protection:** Work apps and data are contained within a managed profile, preventing data sharing with personal apps. - **Privacy assurance:** IT has no access to personal files, apps, or usage information. - **Lightweight management:** Ideal for organizations promoting flexibility without owning or controlling employee devices. ### Enrollment Methods for Personally Owned Devices #### Android - **[QR Code or Enrollment Link](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_android_qr_code_enrollment.html):** Employees can scan a QR code or use an enrollment link shared by the IT admin to set up the work profile. - **[Self Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_byod.html):** Users manually enroll their devices through the ManageEngine MDM Self Service app (previously ManageEngine MDM app) or portal. - **[User Invitations](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_enrollment_by_email_invite.html):** Enrollment initiated via email or SMS invitation containing the enrollment details. #### Apple - **[Apple User Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_apple_user_enrollment.html):** Designed specifically for BYOD scenarios, offering a clear separation between personal and corporate data while preserving user privacy. - **[QR Code or Enrollment Link](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_enrollment_by_email_invite.html):** Enables quick setup by accessing the enrollment URL or scanning a QR code. - **[Self Enrollment / User Invitations](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_byod.html):** Users can enroll through an invitation link sent by the administrator. For detailed information on Device Enrollment, visit our [Device Enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/device_enrollment.html) Guide and for managing Android and Apple devices, visit our [Android Device Management](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_android_device_management.html) and [Apple Device Management](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_ios_device_management.html) Guide. ## Frequently asked questions ### Which enrollment method should I use for company-owned devices with no personal use? Use Fully Managed mode, enrolled via Zero-touch Enrollment, Knox Mobile Enrollment (KME), QR Code (EMM Token) Enrollment, NFC Enrollment, or ADB Enrollment on Android, or Automated Device Enrollment (ABM/ASM) or the Apple Configurator app on Apple devices. ### Can employees use a company-owned device for personal apps too? Yes, use Fully Managed with a Work Profile on Android (via Zero-touch Enrollment, Knox Mobile Enrollment, or QR Code Enrollment), which manages only the work profile while the personal space stays unmanaged. Apple devices don't support an equivalent Work Profile mode, so use standard management or User Enrollment for BYOD instead. ### How do I enroll a personally owned (BYOD) device? On Android, use a QR code or enrollment link, Self Enrollment, or User Invitations. On Apple, use Apple User Enrollment, a QR code or enrollment link, or Self Enrollment/User Invitations — all of which manage only the work profile without accessing personal apps or data.