Enrollment methods
This page lists the ways a device can enroll in Outpost mobile device management, by platform and by who owns the device. The method you choose decides whether the enrollment is corporate or personal (BYOD), and that decides what Outpost can manage on the device.
Methods by platform and ownership
Section titled “Methods by platform and ownership”| Platform | Corporate | Personal (BYOD) |
|---|---|---|
| Apple (iOS, iPadOS, macOS, tvOS) | Automated Device Enrollment through Apple Business Manager (supervised). Account-driven device enrollment. Manual profile installation. | Account-driven User Enrollment |
| Android | Fully managed. Dedicated (kiosk). | Work profile |
| Windows | Microsoft Entra join, including Windows Autopilot. Enrollment started by the Outpost agent. | Work account added to Windows |
ChromeOS is not supported.
Corporate and personal enrollments
Section titled “Corporate and personal enrollments”| Area | Corporate | Personal (BYOD) |
|---|---|---|
| What Outpost manages | The whole device | The work side only: work apps, work accounts, and their data |
| Erase | Erases the whole device | Removes the work data and unenrolls. The person’s own data stays. |
| Locate and lost mode | Available | Refused |
| Supervision-only settings (Apple) | Available on supervised devices | Refused |
A personal enrollment always needs sign-in through an identity provider, so that the device is tied to a named person, and it shows the person a privacy page before the device enrolls. See What IT can see on enrolled devices.
Sign-in through your identity provider
Section titled “Sign-in through your identity provider”Enrollments that start with the user signing in go through the identity provider you connect for each client:
| Identity provider | Protocol |
|---|---|
| Microsoft Entra ID | OpenID Connect |
| Google Workspace | OpenID Connect |
| Okta | OpenID Connect |
The user signs in with their work account. Outpost matches the account to a person already known to that client, and does not create one unless you turn that on for the connection. A successful sign-in issues a single-use enrollment ticket that expires after 15 minutes.
Enrollment links and QR codes
Section titled “Enrollment links and QR codes”An enrollment link starts an enrollment for one purpose and one ownership model. You can tie a link to a site and to an identity provider, set an expiry, and limit how many times it can be used. A link for personal devices must use an identity provider. A link with no identity provider must have an expiry. Each link is also available as a QR code for the device to scan.
Devices that already run the agent
Section titled “Devices that already run the agent”A Mac or PC that runs the Outpost agent can also enroll in MDM. Outpost keeps
one record for the device. It joins the agent record and the MDM enrollment
only when the serial number and the hardware UUID both match exactly. When
only one matches, or more than one record matches, the enrollment waits for a
technician with mdm:enroll to accept or reject the match.
On Windows, the agent can start the MDM enrollment itself, using a single-use token that expires after 10 minutes. See Windows MDM enrollment.
Plan limits
Section titled “Plan limits”Home Lab is planned to allow up to 15 mobile devices. An enrollment past the cap is refused. See Plans and limits.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.