Apple User Enrollment quickstart

In your device fleet, Knox Manage supports enrolling BYOD (personally-owned) iPhones and iPads, an activity called User Enrollment. Unlike company-owned devices, BYODs can’t be supervised.

Knox Manage implements User Enrollment by mapping a user’s Managed Apple ID from your Apple Business Manager to their EMM user account in your Knox Manage tenant. When the personally-owned device then requests enrollment, Knox Manage is able to enroll it on behalf of your organization.

Supported devices

You can enroll the following personally-owned devices:

• iPhones running iOS 15 through 17
• iPads running iPadOS 15 through 17

Supported management features

Personally-owned iOS devices are subject the following conditions and limitations in Knox Manage:

• They can have Apple Volume Purchase Program apps assigned to them.

• They support the online sign-in and QR code enrollment methods. The sign-in method requires entering a long URL, so the QR method is more convenient for users.

• Knox Manage can’t collect any identifying information about the device, such as its IMEI, serial number, phone number, and network information.

• The device name format is the user’s Managed Apple ID, followed by iOS, followed by the serialized personal device number in your tenant (not the Apple serial number).

  For example: alex@appleid.example.com_iOS_27

• They support a subset of the total iOS policies and device commands. To see which are compatible, check the Supported system column in the iOS policy and iOS device command references.

Prepare your tenant for User Enrollment

Before you can enroll your users’ personal iPhones and iPads, you must turn it on for your Knox Manage tenant:

1. On the Knox Manage console, go to Setting > Configuration > Basic Configuration, then open the Device tab.
2. Set User Enrollment for iOS to Allow.
3. Save your changes.

Enroll a personally-owned device

First, prepare the user’s Knox Manage account and send an enrollment request:

1. On Apple Business Manager, copy the user’s Managed Apple ID.

2. On the Knox Manage console, go to User.

3. If you haven’t already set up an account for the user in Knox Manage, create a new account for them. If they have an account, select it and click Modify.

4. In the user details, enter the Managed Apple ID you copied earlier.

5. If you’d like to enroll the device immediately:

   1. Click Save & Request Enrollment.
   2. When asked for the request format, select Send email with installation guide and confirm.

6. If you’d like to enroll the device later:

   1. Click Save.
   2. At a later time, go to User.
   3. Select the user and click Request Enrollment.
   4. When asked for the request format, select Send email with installation guide and confirm.

Knox Manage sends an enrollment request to the device user’s email address.

Next, to complete enrollment, the device user must:

1. On their personal device, scan the QR code sent in the enrollment request. The Knox Manage sign-in page opens in a web browser.

   

2. Sign in with their Knox Manage account credentials. Knox Manage enrolls the device.

3. Open Settings and look for an EMM profile to verify that enrollment was successful.

   

Assign apps to a personally-owned device

To assign an Volume Purchase Program (VPP) app to the device:

1. On the Knox Manage console, start assigning a VPP app to the device.
2. Set Assignment Type to User.
3. Finish assigning the app to the device.

Once the app is assigned, the device user can manually install the app.