Enroll BYOD iOS/iPadOS hosts

[noahtalerman]

Goal

User story
As an IT admin,
I want to invite BYOD (iPhones and iPads) enroll
so that I can install software and enforce settings on end user devices that can access organization resources/tools.

Context

• Product designer: @randy-fleet

Changes

• Introduce BYOD enrollment page that includes instructions for downloading and installing on device

Product

• UI changes: Figma designs.
• REST API changes: API design - Enroll BYOD iOS/iPadOS hosts #22312
• Outdated documentation changes: Guide is here: Article: Guide BYOD enroll iOS iPadOS #22281
• Changes to paid features or tiers: Available in Fleet Free and Premium
  • Pricing page changes: Pricing page: BYOD iOS/iPadOS #22428

Engineering

• Test BYOD redelivering the enrollment profile to an already enrolled iOS/iPadOS host w/ a change in AccessRights (less rights to more and more rights to less). Does the end user get notified?
• Database schema migrations: TODO
• Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming successful completion of QA.
2. QA (@____): Added comment to user story confirming successful completion of QA.

[marko-lisica]

@Patagonia121 This one didn't make to estimation. We plan to prioritize this in the next design sprint.

[dherder]

Adding @ddribeiro's helpful information from the older, closed issue:
Support for account driven user enrollment would enable an organization to allow their employees to enroll their personally owned devices (iOS/iPadOS) into Fleet using a Managed Apple ID. User Enrollment provides several benefits to the employee and organization when enrolling personally owned devices:

Organization data is cryptographically separated from personal data.
Enrollment of personal devices is streamlined as there is a standardized flow built into iOS in Settings > General
Some typical MDM capabilities for organization owned devices is not available (i.e. Erase Device), offering an employee peace of mind that their personal information cannot be erased when they enroll.
Organization can see limited device details (i.e. Can only see a list of managed apps, not a full list).
Links:
Apple Platform Deployment: User Enrollment and MDM
Apple Platform Deployment: User Enrollment MDM Information

[noahtalerman]

@randy-fleet, I thought about this more. If we commit to adding Mac screenshots, we're committing to maintaining screenshots and this flow for macOS.

So, I think it would be easier now and in the short term to show some "Open this page on your iPhones or iPads" screen/state if we detect that the end user isn't on an iPhone or iPad.

Can you please help prepare that screen for the next design review?

@nonpunctual makes a good point we don't have customers asking for this flow on macOS. Note that we already support BYOD enrollment for macOS. fleetd gets installed first.

[noahtalerman]

@randy-fleet FYI I followed up to your questions here (before we decided to not support macOS)

I'm assuming macOS experience would be exactly the same as iOS/iPadOS, with profile download, etc. Is that correct?

I think it's very similar. The steps the end user takes and where they click to find the enrollment profile will be slightly different. For example, on a Mac, the user will see a macOS notification and go to System Settings in the top menu bar, etc.

If we are going to expand this experience to also support macOS, is there a reason why we wouldn't do the same for Windows, Linux, and Chrome?

Yes.

The enrollment profile download/install is specific to the Apple's MDM protocol (macOS, iOS, iPadOS). Windows, Linux, and Chrome don't support enrollment via this flow.

[randy-fleet]

@noahtalerman I've updated the Figma to incorporate macOS as well. https://www.figma.com/design/zMNFxTLMS4yYZjylJMQ5uv/%2319448-Enroll-BYOD-iOS%2FiPadOS-hosts?node-id=5493-17247&t=FMt11fj07eQaQSTF-4
Please let me know if you have any questions.

[noahtalerman]

Thanks @randy-fleet!

I think at this point it makes sense to address macOS behavior in a later iteration. We have an issue for this tracked here. I moved your Figma wires to scratchpad here for safekeeping.

That said, I think it’s worth making the copy more explicit in this iteration.

As an IT admin and end user, how do I know that the best practice is to follow instructions on my iPhone and iPad? What if I pull up this page on my Mac?

Here's what I'm thining...

Fleet detects iOS:

Fleet detects iPadOS:

Fleet detects neither iOS nor iPadOS:

I updated Figma w/ the above^

@roperzh and @georgekarrv, is that something we can fit into this iteration?

cc @ghernandez345

[roperzh]

@marko-lisica @noahtalerman In regards to:

Test BYOD redelivering the enrollment profile to an already enrolled iOS/iPadOS host w/ a change in AccessRights (less rights to more and more rights to less). Does the end user get notified?

I prepared two enrollment profiles, each with different access rights:

• 8179 all access rights except lock & erase
• 8191 all access rights

Findings:

• If the user enrolls with 8179, and you send an InstallProfile command with an enrollment profile with 8191, you get an error from the device and the profile is not installed. Error is: The new MDM payload contains more access rights than the old payload.
• If the user enrolls with 8191, and you send an InstallProfile command with an enrollment profile with 8179, the profile is installed, and the access rights are updated. If you try to go back to 8191, you get an error.

[marko-lisica]

Thanks for investigation @roperzh! I think that's what I mentioned @noahtalerman, we can easily cut permissions in the next iteration if we need to, without end-user action.

[noahtalerman]

Thanks @roperzh! That report is awesome sauce.

[noahtalerman]

TODO @noahtalerman: using other MDM solutions, do end user's see red text when they open the enrollment profile?

[roperzh]

note that a demo and the decision to go with the red text was discussed in the sibling issue: #21019 (comment)

[PezHub]

QA Notes:

Only iPadOS and iOS was tested, macOS will come later

• Confirmed enrollment URL works, download/install enrollment profile succeeds
• Confirm instructions (copy & screenshots) change dynamically based on device type
• Errors if enrollment secret is wrong
• Tested removing downloaded profile from device

Loom video walking thru workflow on an iPad
https://www.loom.com/share/7a28226a89374db68f94f2c4442a88e6

[noahtalerman]

@zayhanlon, heads up that this user story was shipped in 4.57

[fleet-release]

Enrollment page shines,
BYOD iOS hosts align,
In cloud city's design.