BYOD or company-owned Apple devices

Write down the apps and data that each role uses. For each app, check whether it works with managed accounts and whether IT can remove its work data without touching anything else on the device. Also check that it supports the enrolment method you plan to use. A personal phone that someone uses for email has different requirements from a handset that clinical staff share. The first holds one person's mailbox. The second passes from one person to the next.

So write the policy per role. One company can run personal and company-owned devices side by side, as long as everyone knows which access rules apply to them and who supports their device.

For devices your employees own, Apple provides account-driven User Enrollment. IT manages only the organisation's managed accounts, settings and data on the device. IT can't manage the employee's personal account through this enrolment method. It supports BYOD, and IT gets a smaller set of controls than on a company device.

Explain exactly which data and settings the organisation can see. People will want to know that before they put work apps on their own phone or Mac. The policy should also say which models and minimum software versions you support, whether the company pays anything towards the device, and what help people get if it breaks. Then test that work data really comes off the device when someone leaves.

When the company owns the device, IT can manage more of it. That includes Automated Device Enrollment and supervision, where the platform supports them. IT can give everyone the same apps, configure the security settings and decide in advance what happens when a device has to be recovered or replaced.

Owning the device doesn't apply any of those settings by itself. Someone has to configure them, so test the enrolment profile and check the security state on real devices. If you allow personal use, tell people which IT actions can affect their personal data. A full erase is one of them, and it removes their photos and messages along with the work data.

Add up hardware, licences, support and repairs. Count the time IT spends keeping different device configurations running, too. With BYOD, the employee buys the device. The company may still pay towards it, and supporting many different models can take more of IT's time.

Base the comparison on your own support records and supplier quotes. There's no reliable device count at which one ownership model becomes cheaper for every organisation.

When someone leaves, IT revokes their work access, removes the managed data and collects any company equipment. Check beforehand what the enrolment method and each app can remove. If an app keeps work data that IT can't remove, you need to know that before the person's last day. Agree how you'll handle devices that are offline, missing or broken, since a remote command may never reach them.

For privacy and compliance, look at the data you process in practice and the rules that apply where you operate. Neither ownership model makes you legally compliant by itself.

User Enrollment · Apple Platform Deployment