UEM Foundations · Course F1Lesson 3 of 5
Enrollment concepts
8 min read- Compare manual, code-based, and program-based enrollment
- Explain supervision and factory-reset persistence
- Pick the enrollment class that fits a fleet's size and ownership
Enrollment is the moment a device stops being retail hardware and becomes part of a managed fleet. Every platform vendor has its own program names, but conceptually there are exactly three classes.
The three classes
Manual / self-service. The user installs an agent app or a management profile themselves and signs in or enters a code. No preparation, works on anything — and management is only as durable as the user's cooperation. This is the natural BYOD path.
Code-based. The admin generates an enrollment artifact — typically a QR code scanned during a factory-fresh device's setup, or an installer run on a desktop — and each device is touched once at provisioning time. No vendor-program registration needed; scales comfortably into the hundreds.
Program-based zero-touch. Devices purchased through authorized channels are registered to the organization at the platform vendor — Google and Samsung run such programs for Android, Apple's runs through its business portal, and Windows has its provisioning equivalents. On first boot the device phones home, discovers its assignment, and enrolls itself. Nobody touches anything, and — the property that makes this class special — a factory reset doesn't free the device: the assignment lives on vendor servers, so the next boot re-enrolls it.
Supervision: how deep management goes
Enrollment class also decides management depth. Corporate enrollment paths produce what platforms variously call supervised, device owner, or fully managed devices: the deepest restriction sets, and management the user cannot remove. Self-service paths produce lighter management — a profile or work container the user can abandon. Neither is "better"; they encode the ownership models from the previous lesson.
Choosing, in one table
| Fleet | Class |
|---|---|
| Thousands of channel-purchased corporate devices | Program-based zero-touch |
| Dozens-to-hundreds, bought retail or already in hand | Code-based |
| Employees' personal devices | Manual / self-service |
And the compound answer is normal: a real customer runs zero-touch for the new fleet, code-based for the odd batch, and self-service for BYOD — simultaneously, under one console. When you meet WeGuard's concrete versions of these — QR enrollment, Google Zero Touch, Samsung KME, Apple Business Manager, Windows installers — each will slot into a class you already understand.