MDM device enrollment checklist for remote and hybrid teams

MDM device enrollment is the control point where security baseline meets employee experience. Remote and hybrid teams never walk through a corporate IT desk—devices ship to home addresses, personal machines join the fleet, and contractors appear in Slack before IT finishes provisioning. Without a repeatable enrollment checklist, new hires start productive on day one while encryption, screen lock, and firewall remain off.

This guide covers:

Why enrollment must complete before device handoff—not "when IT has time"
Pre-enrollment decisions for company-owned vs BYOD devices
Step-by-step enrollment for shipped laptops and in-office setups
Security baseline profiles that map to SecureSlate's five endpoint checks
Validation workflow to confirm 5/5 before closing onboarding tickets

Remote team collaboration and onboarding

GIF via GIPHY

Related guides:

Key takeaways

Enrollment is a compliance control, not IT busywork—unenrolled devices are audit gaps.
Complete MDM enrollment before the employee accesses company data—including remote hires receiving shipped hardware.
Baseline profiles should target 5/5 on SecureSlate Asset Management checks from day one.
HRIS-triggered workflows reduce race conditions between start date and IT provisioning.
Offboarding is enrollment in reverse—wipe, unenroll, and recover assets with the same rigor.

Why enrollment matters before day one

Every unenrolled device is a device auditors may sample that lacks provable encryption, screen lock, or firewall settings. Remote teams amplify the problem: there is no office network to force compliance at login.

Programs that delay enrollment "until week two" typically accumulate 10–30% shadow fleet—devices in use but missing from MDM and Asset Management. Those devices drag down fleet X/5 scores and become findings under CC6/CC7 sampling.

Treat enrollment as a hard gate: no corporate email, no SSO, no production access until MDM reports enrolled and baseline profiles applied.

Pre-enrollment checklist

Complete these steps before the device ships or the employee starts:

Step	Owner	Done when
Device procured or BYOD approved	IT / Procurement	Asset tag assigned; PO closed
HRIS hire record created	People Ops	Start date confirmed; manager listed
Enrollment method selected	IT	ABM/DEP, Autopilot, manual, or BYOD profile
Baseline MDM profile assigned	IT	Encryption, AV, password, screen lock, firewall
SecureSlate scope confirmed	GRC / IT	Device type in Asset Management inventory
Shipping / pickup scheduled	IT / People Ops	Tracking shared; receipt confirmation process
Employee comms sent	People Ops	Enrollment instructions + IT support channel

For BYOD scenarios, align with BYOD policy before sending enrollment links—container vs full-device management affects employee acceptance.

Enrollment steps by scenario

Company-owned laptop (shipped remote)

Stage in MDM — Assign to user in ABM/Autopilot or pre-stage profile before shipping.
Zero-touch where possible — macOS DEP and Windows Autopilot enroll on first boot.
Employee completes setup wizard — Connect Wi-Fi; MDM installs automatically.
Verify agent check-in — Device appears in MDM console within 24 hours of first boot.
Confirm SecureSlate sync — Asset Management shows device with X/5 score.
Grant access — Enable SSO, email, and Slack after enrollment confirmed.

Company-owned laptop (in-office or pickup)

IT enrolls manually or via DEP at bench.
Apply baseline profile; run encryption (FileVault/BitLocker) before handoff.
Employee signs acceptable use policy; receives device at 5/5 or documented exception.

BYOD (approved)

Send MDM enrollment link with clear scope explanation.
Employee installs management profile or work container app.
Validate only work container or managed partition meets baseline—document personal data boundary.
Confirm 5/5 within managed scope before granting production access.

Contractor (time-bound)

Shorter baseline profile set if scope limited—but encryption and screen lock still apply for data access.
Set enrollment expiry aligned with contract end date.
Calendar offboarding wipe for contract end + 1 day.

Security baseline at enrollment

Every enrolled device should receive MDM profiles targeting SecureSlate's five endpoint checks:

Check	Enrollment action	Profile reference
HD Encryption	Enable FileVault / BitLocker; escrow recovery key	Encryption payload
Anti-Virus	Deploy approved AV agent	Software deployment
Password Policy	Set minimum length/complexity via passcode payload	Password policy profile
Screen Policy	Idle lock ≤15 min; password on unlock	Screen lock guide
Firewall	Enable OS firewall on all profiles	Firewall guide

Bundle profiles into a single "Day One Baseline" assignment so new devices inherit all five at enrollment—not five separate manual steps.

Validate 5/5 before handoff

Do not close onboarding tickets until Asset Management confirms compliance:

Device appears in SecureSlate inventory with correct owner and serial.
X/5 score shows 5/5 (or documented exception with approver).
MDM last check-in within 24 hours.
Employee completed security awareness acknowledgement (if required).
ITSM onboarding ticket updated with enrollment timestamp and score screenshot/export.

Score at handoff	Action
5/5	Close ticket; grant full access
4/5	Fix failing check before access; document if time-critical
≤3/5	Do not grant production access; rebuild or re-profile

See how to pass 5/5 endpoint security checks for remediation by check type.

Offboarding and device recovery

Enrollment quality is undone by weak offboarding. Mirror enrollment rigor when someone leaves:

Step	Timing	Action
HRIS termination trigger	Day 0	Disable SSO; revoke sessions
MDM remote lock	Day 0	Prevent access while preserving evidence
Remote wipe (company-owned)	Day 0–1	Full wipe after data export if needed
Unenroll / remove BYOD profile	Day 0–1	Remove management; verify container deleted
Asset return	Per policy	Shipping label; confirm receipt in asset register
SecureSlate inventory update	Day 1	Mark device retired; remove from active X/5 fleet

HRIS integration with MDM prevents the classic gap: employee terminated in payroll but laptop still enrolled and syncing email.

Roles and handoffs

Role	Enrollment responsibilities
People Ops	Trigger provisioning on hire; send employee comms
IT / Endpoint	Stage device, assign profiles, confirm MDM check-in
Security / GRC	Define baseline; validate Asset Management evidence
Manager	Confirm employee received device; escalate non-compliance
Finance / Procurement	Asset tagging, lease return, insurance claims

Publish a RACI for enrollment so remote hires in different time zones do not wait on ambiguous ownership.

Common mistakes

Granting SSO before MDM check-in — Employee works unmonitored for days or weeks
Shipping without DEP/Autopilot staging — Manual enrollment fails when employee skips IT call
Different baselines for executives — Audit samples do not exclude leadership laptops
BYOD without written scope — Employees surprised by management profile; enrollment rejected
No 5/5 validation — Device "enrolled" but encryption still running or firewall off
Offboarding only disables email — Device remains encrypted but still has cached data and VPN access

Enrollment with SecureSlate MDM

SecureSlate MDM handles enrollment, baseline profile deployment, and Asset Management validation—so remote and hybrid teams start at 5/5 with audit-ready evidence from day one.

Get started for free · Free readiness score

FAQ: MDM device enrollment

How long should enrollment take for a remote hire?

Target same-day enrollment on first boot for DEP/Autopilot devices. Manual enrollment should complete within 24 hours of device receipt.

Can employees use the laptop before 5/5?

Restrict to enrollment wizard and IT support channels until Asset Management confirms baseline compliance—or document risk acceptance for time-critical executive scenarios.

What if a remote employee never completes BYOD enrollment?

Do not grant production access. Escalate to manager; treat as blocking onboarding task like I-9 or payroll setup.

Does enrollment differ for macOS vs Windows?

Steps differ (DEP vs Autopilot) but baseline profiles target the same five checks. Platform-specific guides: screen lock, firewall.

How do we prove enrollment for auditors?

Export MDM enrollment report plus SecureSlate Asset Management fleet status—see MDM vs manual screenshots.

Should contractors follow the same checklist?

Yes, with time-bound profiles and scheduled offboarding. Scope may limit applications but encryption and screen lock typically remain required.

What triggers enrollment in an automated workflow?

Ideal: HRIS hire event → IT ticket → staged ship → DEP enrollment → SecureSlate 5/5 → SSO enable. Manual triggers create gaps at scale.

Disclaimer (legal note)

SecureSlate is not a law firm, and this article does not constitute legal advice or create an attorney-client relationship. Security and compliance obligations vary by industry, contract, and jurisdiction—consult qualified counsel as needed.