Swif Enrollment Owned vs BYOD Matrix
OS | Company Owned (Account-Driven Device Enrollment) | BYOD |
macOS |
|
|
Windows |
|
|
Linux |
|
|
iOS/iPadOS |
|
|
Android |
|
|
Chrome Book |
|
|
Swif Enrollment & Authentication Matrix
Platform / Feature | Primary purpose | Recommended method(s) | Admin rights needed? | Learn more |
macOS (Desktop / Laptop) | Individual installs, pilots | Application installer (.dmg) | Yes | |
| Mass roll-out / MDM migrations | Silent PKG (Migrate from Jamf / Kandji) | Yes | |
| Zero-touch on new Macs | Apple Automated Device Enrolment (ABM/ASM) | No | |
| Individual installs | Enrollment SSO (Managed Apple ID) | — | |
Windows | Individual installs, pilots | Application installer (.msix) | Yes | |
| Mass roll-out / MDM migrations | Silent MSI (Migrate from Intune) | Yes | |
| Zero-touch on new Windows | Automated Device Enrolment | Yes | |
Linux | Individual installs, pilots | Application installer | Yes | |
| Dev-stations, servers, CI | Command Line | Yes | |
| Dev-stations, servers, CI | Package Manager | Yes | |
iOS / iPadOS | Corporate or shared iPads/iPhones | ABM-based Automated Device Enrolment or User-initiated MDM profile | No (ADE) / Yes (manual) | |
| Individual installs | QR Code | — | |
| Individual installs | Enrollment SSO (Managed Apple ID) | — | |
Android | BYOD & Company Owned | QR Code | — | |
Chromebook | ChromeOS fleet (coming soon) | Google Workspace Enterprise enrollment | — | Planned – follow progress on the roadmap |
* Admin-rights column refers to whether the end-user must supply admin/root credentials during the installation flow.
What happens if a standard (non-admin) user runs each installer?
Platform | Installer type | Prompt(s) shown to a non-admin user | Result if user can’t supply admin credentials |
macOS | Application installer | Native macOS dialog asking for Admin username + password (needed to add the Swif Admin account & Secure Token) | • Installer aborts → Device not enrolled • No Secure Token granted |
| Silent PKG ( | 1. Terminal asks for sudo (elevation) | • If the first prompt is cancelled, nothing is installed; the device never appears in Swif • If the Swif Desktop App prompt is cancelled, Swif agent installs without Secure Token → no FileVault / password-reset control |
Windows | Application installer | Application installer requiring an admin password to execute | Unlike macOS and Linux, the installer does not ask for a password on Windows. If the user is not an admin, a Windows prompt will pop up and ask for an admin username/password. If this information is correct, Windows will then run the app as Run As Admin. |
| Silent MSI ( | No prompt—command runs in user context | Nothing is installed; the device never appears in Swif |
Linux | Application installer | When entering the password, report that the current user doesn’t have admin permission at the password input step. | Exit code ≠ 0; no service installed |
| Command Line | Terminal asks for sudo (elevation) | Nothing is installed; the device never appears in Swif |
Key takeaway: Every Swif installer needs elevated privileges somewhere in the flow—either via an admin password (macOS dialog or Windows UAC) or by being executed in a root / SYSTEM context. If that elevation is missing or refused, the device will not enroll (Windows/Linux) or will enroll without a Secure Token (macOS), which blocks FileVault and password-reset features.
Device Re-Enrollment & Team Migration Behavior
When moving an already-enrolled device from one Swif organization/team to another:
macOS / iOS / iPadOS / Windows: Native platform MDM callbacks automatically notify and unenroll the device from the previous team before registering it with the new team.
Android: If a device is wiped or the enrollment profile is removed (such as on BYOD devices), unenrollment cannot be detected immediately. The previous record in Swif is automatically marked as unenrolled once the device is re-enrolled.
Linux: Because Linux does not have native Platform MDM callbacks, running the Swif installer or enrollment command for a new team automatically unenrolls the device from its previous team in the backend and registers it to the new workspace without requiring manual unenrollment from the console.
Quick tips
Mixed Fleet: Start with silent installers for macOS and Windows, then transition newly provisioned Apple devices to Automated Device Enrollment (ABM) for zero-touch setup.
Single Sign-On for macOS: Configure Enrollment SSO once to allow users to unlock devices, synchronize passwords, and access iCloud using their corporate-managed Apple accounts.
Team Transfers: Re-enrolling any supported OS (macOS, Windows, Linux, iOS, Android) to a new Swif team automatically clears the previous team registration and re-binds the device to the new workspace.