Mobile Device Enrollment Checklist
An MDM enrollment checklist for company phones and BYOD: pick the enrollment type, apply passcode and app policies, set up work apps, test remote wipe.
- Typical schedule per device
- The checklist 5 sections, 17 items
- Variables
{{user_name}}{{device_type}}
Use this checklist when a phone or tablet starts accessing company email, chat or files. That includes company-owned devices and personal devices under a bring-your-own-device (BYOD) policy. The steps work with most MDM tools, such as Intune, Jamf, Kandji or Google endpoint management.
Who owns it
IT or whoever administers your MDM owns the run. The user does a few steps on the device, so walk through them together. For BYOD, someone has to decide what the company may and may not see on a personal phone, and write it in a short policy the user accepts.
Common pitfalls
- Full device management on a personal phone. Users rightly refuse to let the company wipe their photos. Use a work profile or user enrollment for BYOD. It separates work apps and data, and a wipe removes only those.
- Company phones set up with a personal Apple or Google account. Purchases and Activation Lock then belong to the person. Use automated enrollment and managed apps where you can.
- Email set up outside management. If people add their work account to the native mail app before enrollment, the data sits outside your policies. Require enrollment or app protection before access.
- The remote wipe was never tested. Find out whether it works before a phone is lost, not after.
- No lost-phone process. Users need to know whom to call and how quickly. Put it in the welcome message.
Keep one run per device. It shows when the device was enrolled and which policies were confirmed.
The checklist: Enroll {{device_type}} for {{user_name}}
Decide
-
Ownership confirmed: company-owned or personal (BYOD)
-
Enrollment type chosen to match: full management for company devices, work profile or user enrollment for BYOD
-
BYOD policy accepted by
{{user_name}}, stating what IT can see and wipe optional -
Device meets the minimum supported OS version
Enroll
-
Company device assigned in the enrollment programme optional
For example Apple Business Manager or Android zero-touch, so it enrolls on first boot.
-
Device enrolled in MDM and shown as compliant in the console
-
Company-owned device recorded against
{{user_name}}in the asset register optional
Policies
-
Passcode or biometric lock required, with auto-lock after a short timeout
-
Device encryption confirmed
-
OS update policy applied
-
App protection rules on: no copy and paste of work data into personal apps, where supported optional
Work apps
-
Email, calendar and contacts configured through the managed account
-
Chat, file storage and authenticator apps installed as managed apps
-
Wi-Fi and VPN profiles pushed optional
-
{{user_name}}signed in and enrolled MFA on the device
Before handover
-
Remote lock and wipe confirmed as available for this device in the console
-
{{user_name}}knows how to report a lost or stolen device and how fast to do it
Checklist as Markdown
Frequently asked questions
What is the difference between full MDM enrollment and BYOD enrollment?
Full enrollment gives the company control of the whole device, including a full wipe. It suits company-owned phones. BYOD options such as Android work profiles or Apple user enrollment manage only a separate work area. IT can wipe the work data without touching personal photos and apps.
What should a company phone setup checklist include?
Enrollment in your MDM, a passcode and encryption, an OS update policy, managed work apps and MFA, plus an entry in the asset register. Finish by confirming that remote lock and wipe work and that the user knows the lost-device process.
Can IT see my personal data on an enrolled phone?
It depends on the enrollment type and the MDM, so ask for the BYOD policy. With work profiles and user enrollment, IT generally manages only work apps and data, not personal messages or photos. With full device management on a company phone, IT has much wider control. Data protection rules differ by jurisdiction, so check the policy against local requirements.
Updated