{"id":10649,"date":"2021-06-11T15:44:15","date_gmt":"2021-06-11T10:14:15","guid":{"rendered":"https:\/\/www.hexnode.com\/blogs\/?p=10649"},"modified":"2022-09-16T08:22:35","modified_gmt":"2022-09-16T02:52:35","slug":"wwdc-2021-highlights-account-driven-user-enrollment","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/","title":{"rendered":"WWDC 2021 highlights: Account-driven user enrollment"},"content":{"rendered":"

We look forward to what Apple brings to the device management table every year at its midyear event: Worldwide User Conference (WWDC). Without a doubt, the “What’s new in managing Apple devices” session is one of the most exciting sessions that we anticipate, and Apple never disappoints. This time, we saw other detailed sessions on important device management features. One of these deep-dive sessions covered the new account-driven user enrollment. Apple is obsessed with security and we can see how it is reflected in their announcements this year.<\/span>\u00a0<\/span><\/p>\n

User\u00a0enrollment\u00a0is a device management option for BYOD deployments, where the devices\u00a0to be managed are owned by the user and not the organization.\u00a0\u00a0It helps to assure both the user and the organization that their respective data is secured.\u00a0<\/span>\u00a0<\/span><\/p>\n

Three components of User-Enrollment<\/span>\u00a0<\/span><\/h2>\n

\"Three<\/a><\/center>
Image source: Apple WWDC 2021<\/em><\/center> <\/p>\n
    \n
  1. Managed Apple ID: Managed Apple IDs are owned by the organization. The organization should have an Apple Business Manager or Apple School Manager account. The Managed Apple IDs are used to provide access to the users to Apple services such as iCloud.<\/span>\u00a0<\/span><\/li>\n
  2. Data Separation:\u00a0At the time of\u00a0enrollment, a separate container is created to store the managed apps, accounts and data. This\u00a0secures the corporate data and\u00a0helps to separate work and personal data.<\/span>\u00a0<\/span><\/li>\n
  3. Management capabilities:\u00a0The management capabilities should be limited to those who are authorized to do so. With\u00a0User\u00a0Enrollment,\u00a0the admin has full control over the managed content but limited to no access to personal data and settings of the user.\u00a0System-wide operations such as remote wipe are also unavailable to the MDM server, ensuring complete privacy and security for the users.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

    Newly announced: Account-driven user enrollment\u00a0<\/span><\/h2>\n

    1. New way to access Managed Account in Settings<\/span>\u00a0<\/span><\/h3>\n

    \"Managed<\/a><\/center>
    Managed account to be displayed on top of settings<\/em><\/center>
    Image source: Apple WWDC 2021<\/em><\/center>
    \nIf the device user enrolled, the account will be displayed at the top of the device settings. The user can easily view the parts of the system that are managed by the organization and the parts that are not. This is an important feature as it clearly\u00a0separates the organizational content from the personal data and accounts of the user in a visible manner.\u00a0<\/span>\u00a0<\/span><\/p>\n

    2. iCloud Drive for Managed Apple IDs<\/span>\u00a0<\/span><\/h3>\n

    Apple has announced that Managed Apple IDs will support iCloud Drive in iOS 15 and macOS Monterey. iCloud Drive would also follow the Managed Open-In restrictions for managed app and data access.\u00a0<\/span>\u00a0<\/span><\/p>\n

    \"iCloud<\/a><\/center>
    iCloud Drive for managed account in iOS<\/em><\/center>
    Image source: Apple WWDC 2021<\/em><\/center>
    <\/center> <\/p>\n

    \"iCloud<\/a><\/center>
    iCloud Drive as an additional folder in macOS<\/em><\/center>
    Image source: Apple WWDC 2021<\/em><\/center> <\/p>\n

    \"iCloud<\/a><\/center>
    iCloud Drive for Document Browser-based apps<\/em><\/center>
    Image source: Apple WWDC 2021<\/em><\/center><\/p>\n

    3. Remove managed app when a user-enrolled Mac computer disenrolls<\/span>\u00a0<\/span><\/h3>\n

    In macOS Monterey,\u00a0Macs enrolled with user\u00a0enrollment\u00a0would remove the managed apps with an MDM command or when the devices are disenrolled from the MDM.\u00a0Just like in iOS, the managed app data is stored on a different volume.\u00a0<\/span>\u00a0<\/span><\/p>\n

    4. Managed Pasteboard and Required App<\/span>\u00a0<\/span><\/h3>\n

    Managed Open-In has now expanded to include Copy & Paste.\u00a0Organizations can control the data being pasted across the managed and unmanaged apps. Apple has also introduced Required App<\/a> for\u00a0unsupervised devices which allows the admin to install one pre-approved app silently without prompting the user.\u00a0<\/span>\u00a0<\/span><\/p>\n

    5. An additional layer of security in user enrollment<\/span>\u00a0<\/span><\/h3>\n

    The onboarding for user\u00a0enrollment\u00a0in iOS devices used to be initiated and controlled by an MDM\u00a0enrollment\u00a0profile. The new\u00a0user\u00a0enrollment\u00a0establishes the organization\u2019s identity as the entry point.\u00a0An additional layer of security is established during the\u00a0enrollment\u00a0flow. The MDM server can now verify the user even before the MDM profile is downloaded to\u00a0the device. How does it work?<\/span>\u00a0<\/span><\/p>\n

    \"Four<\/a><\/center>
    Four components of the new user enrollment onboarding flow<\/em><\/center>
    Image source: Apple WWDC 2021<\/em><\/center>
    \nThere are four core components in the new account-driven user enrollment onboarding flow:<\/span>\u00a0<\/span><\/p>\n
      \n
    1. Service discovery\u00a0\u2013 User identifies the organization\u2019s MDM server.<\/span>\u00a0<\/span><\/li>\n
    2. User authentication\u00a0\u2013 Here, the MDM server validates the user.\u00a0<\/span>\u00a0<\/span><\/li>\n
    3. Issuing the session token\u00a0\u2013 Ongoing authentication is performed by issuing the session token.<\/span>\u00a0<\/span><\/li>\n
    4. Enrollment\u00a0\u2013 The device finally gets enrolled by installing the MDM payload to the device.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

      The user goes to the new VPN and Device management section in the\u00a0Settings\u00a0and taps the\u00a0new \u201cSign in to Work or School\u201d button.\u00a0There, the user has to enter their organizational ID which triggers the service discovery step.\u00a0After the authentication, the\u00a0assigned managed Apple ID is pre-populated in the next screen, where the user is expected to enter their password.\u00a0After this authentication also succeeds, the user then allows the management of their device. The user then has to enter the\u00a0device passcode to create a separate encrypted partition for enterprise data and to authorize the MDM\u00a0enrollment. The device is enrolled\u00a0in the MDM only after following all these steps.<\/span>\u00a0<\/span><\/p>\n

      6. Option to incorporate ongoing authentication <\/span>\u00a0<\/span><\/h3>\n

      In the onboarding flow that we discussed above, the server authenticates the user before sending\u00a0enrollment\u00a0data.\u00a0In iOS 15, Apple has also announced the option for organizations to re-authenticate the user at any point of time.\u00a0MDM server can now validate authorization on every request from the client and ask the user to re-authenticate\u00a0their identity credentials. If the user\u2019s authentication attempt fails, the server may no longer trust the device. The MDM server can then remove any sensitive data or apps from the device or completely disenroll the device.\u00a0<\/span>\u00a0<\/span><\/p>\n

      Our say<\/h2>\n

      Bringing and using personal devices for work is always a cause of security concerns within an organization. However, with focused features and updates like account-driven user enrollment, it is definitely going to be easier for administrators to manage Apple devices in a BYOD environment. Apple has announced many great and revolutionary features for device management this year. Read WWDC 2021: What\u2019s new in Apple Device Management<\/a> to learn what else is in store for you.<\/span>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

      We look forward to what Apple brings to the device management table every year at…<\/p>\n","protected":false},"author":24,"featured_media":10695,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4914],"tags":[4834],"class_list":["post-10649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-insights","tag-wwdc","tab_group-immersive-reads"],"acf":[],"yoast_head":"\nWWDC 2021 highlights: Account-driven user enrollment<\/title>\n<meta name=\"description\" content=\"Learn about the latest device management feature from Apple: Account-driven user enrollment for securing BYOD, announced Apple WWDC 2021.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WWDC 2021 highlights: Account-driven user enrollment\" \/>\n<meta property=\"og:description\" content=\"Learn about the latest device management feature from Apple: Account-driven user enrollment for securing BYOD, announced Apple WWDC 2021.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/\" \/>\n<meta property=\"og:site_name\" content=\"Hexnode Blogs\" \/>\n<meta property=\"article:published_time\" content=\"2021-06-11T10:14:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-09-16T02:52:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/23143542\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"1340\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Emily Brown\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Emily Brown\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/\",\"url\":\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/\",\"name\":\"WWDC 2021 highlights: Account-driven user enrollment\",\"isPartOf\":{\"@id\":\"https:\/\/www.hexnode.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg?format=webp\",\"datePublished\":\"2021-06-11T10:14:15+00:00\",\"dateModified\":\"2022-09-16T02:52:35+00:00\",\"author\":{\"@id\":\"https:\/\/www.hexnode.com\/blogs\/#\/schema\/person\/315e8095e4e7138b7c2ac368b6a41c1d\"},\"description\":\"Learn about the latest device management feature from Apple: Account-driven user enrollment for securing BYOD, announced Apple WWDC 2021.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#primaryimage\",\"url\":\"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg?format=webp\",\"contentUrl\":\"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg?format=webp\",\"width\":1340,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.hexnode.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WWDC 2021 highlights: Account-driven user enrollment\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.hexnode.com\/blogs\/#website\",\"url\":\"https:\/\/www.hexnode.com\/blogs\/\",\"name\":\"Hexnode Blogs\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.hexnode.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.hexnode.com\/blogs\/#\/schema\/person\/315e8095e4e7138b7c2ac368b6a41c1d\",\"name\":\"Emily Brown\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hexnode.com\/blogs\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d2eef116ae82476e6a416482dedf2276ed8be907f771b16c0858e020d524e507?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d2eef116ae82476e6a416482dedf2276ed8be907f771b16c0858e020d524e507?s=96&d=mm&r=g\",\"caption\":\"Emily Brown\"},\"description\":\"Reading is therapy and writing is healing...sincerely, a cool nerd.\",\"url\":\"https:\/\/www.hexnode.com\/blogs\/author\/anaswara\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WWDC 2021 highlights: Account-driven user enrollment","description":"Learn about the latest device management feature from Apple: Account-driven user enrollment for securing BYOD, announced Apple WWDC 2021.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/","og_locale":"en_US","og_type":"article","og_title":"WWDC 2021 highlights: Account-driven user enrollment","og_description":"Learn about the latest device management feature from Apple: Account-driven user enrollment for securing BYOD, announced Apple WWDC 2021.","og_url":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/","og_site_name":"Hexnode Blogs","article_published_time":"2021-06-11T10:14:15+00:00","article_modified_time":"2022-09-16T02:52:35+00:00","og_image":[{"width":1340,"height":720,"url":"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/23143542\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg","type":"image\/jpeg"}],"author":"Emily Brown","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Emily Brown","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/","url":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/","name":"WWDC 2021 highlights: Account-driven user enrollment","isPartOf":{"@id":"https:\/\/www.hexnode.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#primaryimage"},"image":{"@id":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg?format=webp","datePublished":"2021-06-11T10:14:15+00:00","dateModified":"2022-09-16T02:52:35+00:00","author":{"@id":"https:\/\/www.hexnode.com\/blogs\/#\/schema\/person\/315e8095e4e7138b7c2ac368b6a41c1d"},"description":"Learn about the latest device management feature from Apple: Account-driven user enrollment for securing BYOD, announced Apple WWDC 2021.","breadcrumb":{"@id":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#primaryimage","url":"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg?format=webp","contentUrl":"https:\/\/cdn.hexnode.com\/blogs\/wp-content\/uploads\/2021\/06\/Featured_image_for_blog_WWDC_2021_Highlights_Account-driven_user_enrollment_Mitsogo.jpeg?format=webp","width":1340,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/www.hexnode.com\/blogs\/wwdc-2021-highlights-account-driven-user-enrollment\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hexnode.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"WWDC 2021 highlights: Account-driven user enrollment"}]},{"@type":"WebSite","@id":"https:\/\/www.hexnode.com\/blogs\/#website","url":"https:\/\/www.hexnode.com\/blogs\/","name":"Hexnode Blogs","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hexnode.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.hexnode.com\/blogs\/#\/schema\/person\/315e8095e4e7138b7c2ac368b6a41c1d","name":"Emily Brown","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hexnode.com\/blogs\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d2eef116ae82476e6a416482dedf2276ed8be907f771b16c0858e020d524e507?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d2eef116ae82476e6a416482dedf2276ed8be907f771b16c0858e020d524e507?s=96&d=mm&r=g","caption":"Emily Brown"},"description":"Reading is therapy and writing is healing...sincerely, a cool nerd.","url":"https:\/\/www.hexnode.com\/blogs\/author\/anaswara\/"}]}},"_links":{"self":[{"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/posts\/10649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/comments?post=10649"}],"version-history":[{"count":8,"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/posts\/10649\/revisions"}],"predecessor-version":[{"id":21465,"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/posts\/10649\/revisions\/21465"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/media\/10695"}],"wp:attachment":[{"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/media?parent=10649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/categories?post=10649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexnode.com\/blogs\/wp-json\/wp\/v2\/tags?post=10649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}