allenhouchins
commented
5 days ago A couple of things for us to think through. Our current BYOD solution is not really BYOD otherwise this would not be a problem. Our current BYOD solution is user-initiated enrollment with full MDM capabilities. This is supposed to be used for companies that have devices that aren't being automatically managed by ABM/DEP. The issue around admins have pervasive permissions and capabilities would be address if we supported User Enrollment (true BYOD). I am concerned that just hiding Wipe from the UI would not address the potential issue being raised since the profile being enrollment profile being installed in this method would still have the rights to wipe the device. We would likely have to change the rights management of the enrollment profile that gets installed to fully block wipe capabilities which would mean a re-enrollment of the device. It also means that the customers that want user-initiated enrollment with full MDM capabilities would lose this ability without creating some UI to have multiple user-initiated enrollment workflows.
noahtalerman
@noahtalerman: Eventually Fleet might present the IT admin the option to choose "BYOD" v. "Company-owned" (aka personal v. corporate) in the "Add hosts" modal experience. If they choose personal, then they'll be presented w/ a link that presents the end user w/ a download link. The download link gives the end user a profile that doesn't include wipe permissions.