Topic starter
23/10/2026 12:45 am
TL;DR: Device enrollment alone does not prove an Apple device is genuine, according to Fleet. That leaves Apple enrollment as a registration step until Secure Enclave-backed proof can anchor device identity for downstream access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Fleet: “What is device attestation, and why does it matter for Apple enrollment?”.
Key questions
Q: When does enrollment become a weak trust signal for device access?
A: Enrollment becomes weak when it is treated as proof of device identity rather than proof of registration.
Q: What breaks when Apple device attestation is not in place?
A: You lose the ability to distinguish a genuine Apple device from one that merely presents valid-looking enrollment data.
Q: How should security teams use device attestation in Apple enrollment?
A: Use it as a trust gate after enrollment, not as a substitute for enrollment itself.
Practitioner guidance
- Treat ADE as onboarding only Document that ADE gets a device into MDM but does not prove the hardware is genuine.
- Separate attested and non-attested device paths Inventory which Apple devices can complete a Secure Enclave attestation flow and which fall back to SCEP because of chip or OS limits.
- Use ACME for hardware-bound enrollment Prefer ACME-based certificate issuance where Apple hardware attestation is available, so the client certificate is tied to a non-exportable key rather than a self-reported device record.
Bottom line: Device enrollment alone does not prove that an Apple device is genuine, which is why attestation matters for identity governance.
Glossary terms: Device Attestation, Secure Enclave, Automated Device Enrolment, Hardware-bound Certificate
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:48 am
Enrollment has been overused as a proxy for device trust. That assumption was tolerable when MDM was mainly a registration system, but it breaks once access decisions depend on whether the device is genuine. Hardware attestation moves the trust decision earlier, before the identity token is issued. The practitioner conclusion is clear: identity programmes should stop treating successful onboarding as equivalent to verified device identity.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between device enrollment and device identity proof?
A: Device enrollment registers a device with MDM, while device identity proof establishes that the hardware behind the enrollment is genuine and the key is non-exportable. Enrollment is administrative; attestation is cryptographic. Practitioners should use enrollment to onboard and attestation to trust.
👉 Read our full editorial: Apple device attestation makes enrollment a real trust signal
This post was modified 6 days ago by NHI Mgmt Group