Swif Enrollment Owned vs BYOD Matrix
OS | Company Owned (Account-Driven Device Enrollment) | BYOD |
macOS |
|
|
Windows |
|
|
Linux |
|
|
iOS/iPadOS |
|
|
Android |
|
|
Chrome Book | Coming Soon | Coming Soon |
Swif Enrollment & Authentication Matrix
Platform / Feature | Primary purpose | Recommended method(s) | Admin rights needed? | Learn more |
macOS (Desktop / Laptop) | Individual installs, pilots | Application installer (.dmg) | Yes | |
| Mass roll-out / MDM migrations | Silent PKG (Migrate from Jamf / Kandji) | Yes | |
| Zero-touch on new Macs | Apple Automated Device Enrolment (ABM/ASM) | No | |
| Individual installs | Enrollment SSO (Managed Apple ID) | — | |
Windows | Individual installs, pilots | Application installer (.msix) | Yes | |
| Mass roll-out / MDM migrations | Silent MSI (Migrate from Intune) | Yes | |
| Zero-touch on new Windows | Automated Device Enrolment | Yes | |
Linux | Individual installs, pilots | Application installer | Yes | |
| Dev-stations, servers, CI | Command Line | Yes | |
| Dev-stations, servers, CI | Package Manager | Yes | |
iOS / iPadOS | Corporate or shared iPads/iPhones | ABM-based Automated Device Enrolment or User-initiated MDM profile | No (ADE) / Yes (manual) | |
| Individual installs | QR Code | — | |
| Individual installs | Enrollment SSO (Managed Apple ID) | — | |
Android | BYOD & Company Owned | QR Code | — | |
Chromebook | ChromeOS fleet (coming soon) | Google Workspace Enterprise enrolment | — | Planned – follow progress on the roadmap |
* Admin-rights column refers to whether the end-user must supply admin/root credentials during the installation flow.
What happens if a standard (non-admin) user runs each installer?
Platform | Installer type | Prompt(s) shown to a non-admin user | Result if user can’t supply admin credentials |
macOS | Application installer | Native macOS dialog asking for Admin username + password (needed to add the Swif Admin account & Secure Token) | • Installer aborts → Device not enrolled • No Secure Token granted |
| Silent PKG ( | 1. Terminal asks for sudo (elevation) | • If the first prompt is cancelled, nothing is installed; the device never appears in Swif • If the Swif Desktop App prompt is cancelled, Swif agent installs without Secure Token → no FileVault / password-reset control |
Windows | Application installer | Application installer requiring an admin password to execute | Unlike macOS and Linux, the installer does not ask for a password on Windows. If the user is not an admin, a Windows prompt will pop up and ask for an admin username/password. If this information is correct, Windows will then run the app as Run As Admin. |
| Silent MSI ( | No prompt—command runs in user context | Nothing is installed; the device never appears in Swif |
Linux | Application installer | When entering the password, report that the current user doesn’t have admin permission at the password input step. | Exit code ≠ 0; no service installed |
| Command Line | Terminal asks for sudo (elevation) | Nothing is installed; the device never appears in Swif |
Key takeaway: Every Swif installer needs elevated privileges somewhere in the flow—either via an admin password (macOS dialog or Windows UAC) or by being executed in a root / SYSTEM context. If that elevation is missing or refused, the device will not enroll (Windows/Linux) or will enroll without a Secure Token (macOS), which blocks FileVault and password-reset features.
Quick tips
Mixed fleet?
Start with silent installers for macOS & Windows, then move new Macs and iPhones to Automated Device Enrolment for true zero-touch.Want a single sign-in experience on Macs?
Configure Enrollment SSO once; users unlock, change passwords, and access iCloud with their corporate-managed Apple account.
Still deciding?
Use the tables above as a cheat sheet: pick the row that matches your OS and deployment style, then follow the “Learn more” link for step-by-step instructions.