I work for a large faceless corporation, and they're rolling out some new software for email. As part of the install, it's asking me to install a "Profile" which contains a "Device Enrollment Challenge".

enter image description here

My question is, should I be nervous about this? What privacy issues should I be concerned about, if any?


Apple is a little like Switzerland in this because it's giving the corporation deep control over your personal device. It also gives you very granular details on what any specific Device Enrollment Challenge will do on your device. (You get an overview of the capabilities before you opt in to trusting the enrollment - but you get the details once the profile is actually installed by inspecting in in the Settings app under Profiles).

You can make a back up of your phone and then install the profile. Once it's installed, you can inspect all the changes it can and has made and then decide to remove the profile / leave the profile / wipe the device and start from your backup.

If you are interested in testing out your own MDM, you can avail yourself of a free solution for 3 devices called Bushel.

n.b. I don't get any compensation from Bushel/JAMF - just a satisfied tester and now user of the cloud based service.

Once you set up Bushel, you can see the sorts of things that MDM does and make your own signed profiles to test things out before you decide to trust your IT department.

  • This should be a comment on the original question since it not an answer – William Entriken Mar 3 '18 at 20:10
  • Feel free to edit from my post in to another answer if you prefer @FullDecent - this is quite a bit too much information for a comment IMO. – bmike Mar 3 '18 at 22:22

Any requests to install a profile containing Device Enrollment will have come from your corporate MDM (mobile device management) server and so can be trusted if it's a corporate device. If it's a personal device you should ask the head tech about any restrictions which may be put in place on your device by the profile. Chances are there won't be any problems if the profiles have been well implemented but it's worth double checking anyway.

  • Thanks. This is a personal device, which is why I'm being careful. I'm specifically curious about the risks, though... what are the risks of installing the profile? – eykanal Jan 9 '15 at 16:50
  • Actually, anyone can send a profile challenge - via email, website, etc... So you should be aware that phishing is possible and be skeptical / check on profiles to be sure they are from your IT department before accepting them. I agree with your recommendation to check with IT and understand if they are testing a new profile or have been doing this for a while before risking any personal data / devices with an unknown (to you) profile. – bmike Jan 9 '15 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .