> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account-driven device enrollment

> Enroll iOS, iPadOS, and macOS devices using Account-driven Device Enrollment — a privacy-preserving method where employees sign in with their Managed Apple ID to enroll their device.

## Platform compatibility

| macOS       | Windows | Linux | iOS / iPadOS | Android |
| ----------- | ------- | ----- | ------------ | ------- |
| Coming soon | ❌       | ❌     | ✅ (`16+`)    | ❌       |

## Prerequisites

* **Apple Business account** — your organization must have an Apple Business account.
* **Identity provider federation** — your identity provider (Google Workspace or Microsoft Entra) must be federated with Apple Business so that employees can authenticate with their corporate credentials.

## How it works

<Steps>
  <Step title="Employee opens Settings on their iPhone or iPad">
    They tap **Sign in to work or school** (or go to **Settings > General > VPN & Device Management**) and enter their work email address.
  </Step>

  <Step title="Device contacts the enrollment server">
    The device performs a service discovery lookup on the email domain and contacts your organization's enrollment server.
  </Step>

  <Step title="Employee authenticates">
    They sign in with their corporate credentials via your federated identity provider (Google Workspace or Microsoft Entra).
  </Step>

  <Step title="Device enrolls automatically">
    A separate, cryptographically isolated **work partition** is created. Corporate apps and data live in this partition — personal apps and data remain invisible to the organization.
  </Step>
</Steps>

## Related articles

* [Enrollment methods](/mdm/rollout/enrollment-methods)
* [Set up Zero Touch for Apple](/mdm/zero-touch/zero-touch-macs)