Employee enrolment is the standard way to enrol a device: the employee installs the agent themselves from a link you send. It works on every supported platform and needs no prior infrastructure, which makes it the method to start with and the one to fall back on.
Overview
Use employee enrolment when you have no Apple Business or Autopilot setup yet, when a device was bought outside those channels, or when any other method has failed. It is supported on macOS, Windows, Linux, iOS, iPadOS and Android.
Two prerequisites:
- Employees must already exist as accounts before you can invite them.
- For iPhones and iPads, turn on IdP authentication first. Without it those devices arrive with no owner. See the section below.
How to use
Share the enrolment portal
Every organisation gets its own enrolment page. Share it however you normally reach people — Slack, email, intranet.
Invite by email
Go to Employees and use the Invite to MDM action:
- One person — open their profile and click Invite to MDM.
- A group — select the employees, then click Invite to MDM > Invite X selected employees.
- Everyone — click Invite to MDM > Invite matching employees.
Each invited employee is added to the invitation list and reminded every 7 days until they enrol a device or you switch the invitations off.
iPhones and iPads
iPhones and iPads do not get a personal installer. They enrol the way Android devices do: one enrolment page, served by Fleet, with a QR code the employee scans or a link they open on the device. The employee downloads the profile and installs it from Settings.
That link is identical for everyone, so the page itself cannot tell who is enrolling. The only thing that identifies the person is the sign-in Fleet puts in front of the profile — and that sign-in only appears when Require IdP authentication is switched on.
| IdP authentication | The employee | The result |
| On | Signs in with their work account, then installs the profile | The device arrives already assigned to that person |
| Off | Installs the profile straight away | The device arrives with no owner, marked To assign |
With the setting off you are not blocked, but every iPhone and iPad lands in a pile you have to sort out by hand or leave to Assignment suggestion. Turning it on removes that work entirely.
Turn on IdP authentication
- Go to MDM > Settings
- Under IdP authentication, choose Require IdP authentication
- Click Confirm
You do not configure anything in Identities & Access for this. The platform acts as the identity provider itself, so employees sign in with the work account they already have. If your company enforces two-factor authentication and someone has not set it up yet, they are asked to do so during this sign-in.
One side effect worth knowing: the same switch also inserts that sign-in into the zero-touch setup flow on Apple devices.
Tips and best practices
- Turn on IdP authentication before the first iPhone is enrolled, not after. Devices already enrolled without it stay unassigned — the setting does not fix them retroactively.
- Send the invitations after you have told people it is coming, not before. The automatic weekly reminder is effective, but only if the first email was expected.
- Use the bulk action, not one profile at a time. "Invite matching employees" covers a whole rollout in one click.
- Remember employees need administrator rights on their own machine. On a locked-down fleet this is the step that stalls a rollout, and it is worth checking before you send anything.
- Switch invitations off for people who should not be enrolled, rather than letting them receive a reminder every week.
Troubleshooting and FAQ
Troubleshooting
- An employee cannot be invited. They have no account yet. Accounts come first — create or sync the employee, then invite.
- The employee says they never got the email. The invitation repeats automatically every 7 days, so check whether they enrolled in the meantime. If not, send them the enrolment portal link directly instead of waiting for the next cycle.
- The employee cannot finish the installation. They almost certainly lack administrator rights on the device. That cannot be worked around from your side.
- An iPhone enrolled but shows no owner. IdP authentication was off when it enrolled, so nothing identified the person. Assign it by hand, then turn the setting on so the next ones arrive assigned.
-
An employee is stuck at a two-factor prompt on their phone. That prompt belongs to your company's own two-factor policy, not to enrolment. Once they finish setting it up, the enrolment continues.
FAQ
-
How often are people reminded?
Every 7 days, automatically, until they enrol or you deactivate their invitation.
-
Can someone enrol without an invitation email?
Yes. The enrolment portal link works on its own, which is useful for people who deleted the email.
-
Does this work on personal devices?
Yes, on every supported platform. On Android, employees can choose the work profile mode, which keeps their personal data out of your visibility.
-
Why do iPhones need a setting that laptops do not?
Laptops get an installer generated for one person. iPhones and iPads share a single enrolment page, so the sign-in is the only thing that can tell them apart.
-
Do we have to set up an app in Identities & Access for this sign-in?
No. The platform is the identity provider for it, so there is nothing to configure.