Device enrollment

How it works

Enrollment establishes trust. The device proves who it is (serial number, sometimes a user login), the server proves who it is (certificate), and the OS installs a management channel bound to that server. On Apple platforms this is an MDM enrollment profile; on Android it's the device policy controller set as device owner or profile owner; on Windows it's an MDM enrollment tied to Entra ID.

There are four common routes. Manual: the user opens a link or scans a QR code and follows a few screens. Agent-based: the user installs the company app, which triggers enrollment. Automated: Apple Business Manager, Android zero-touch, Samsung Knox Mobile Enrollment or Windows Autopilot enroll the device before the setup wizard finishes. And on Android, an afw# token or NFC bump at factory reset for fully managed mode.

Which route you can use depends on ownership and purchase channel.

Why it matters for a fleet

Enrollment is the moment you decide the device's mode for life. Work profile, fully managed, supervised, dedicated: most of these can't be changed later without a factory reset. Getting it wrong on 500 devices means 500 resets.

It's also the biggest time sink if done manually. Fifteen minutes per device, times 300 devices, is nearly two working weeks. Automated enrollment brings that down to the time it takes to unbox.

Since iOS 13 and Android 10, the OS enforces the split between personal and corporate enrollment more strictly, so you can no longer "upgrade" a lightly enrolled device to full management on the fly.

How Appaloosa handles it

Appaloosa supports automated enrollment through Apple Business Manager, Android zero-touch and Windows Autopilot, plus manual enrollment by QR code or link for devices bought outside those programs. Each device lands in the right mode (supervised, fully managed, work profile) with its security policies and apps applied at first boot. Enrollment options per platform are listed on the Mobile Device Management page.