Overview

This article lists every way to enroll devices in Swif, by platform: for company-owned and BYOD devices, which method suits which situation, and what users need to do.

Company-owned and BYOD methods

OS	Company-owned	BYOD
macOS	Application Installer. Learn more → Silent Installer. Learn more → Enrollment SSO. Learn more → Automated Device Enrollment (Apple Business). Learn more →	Application Installer. Learn more → Enrollment SSO. Learn more →
Windows	Application Installer. Learn more → Silent Installer. Learn more → Windows Autopilot. Learn more →	Application Installer. Learn more →
Linux	Application Installer. Learn more → Command Line Installer. Learn more → Package Manager. Learn more → NixOS. Learn more → Universal Blue. Learn more →	Application Installer. Learn more → Command Line Installer. Learn more →
iOS and iPadOS	QR code. Learn more → Enrollment SSO. Learn more → Automated Device Enrollment (Apple Business). Learn more →	Enrollment SSO. Learn more →
Android	QR code enrollment and zero-touch. Learn more →	QR code enrollment (work profile). Learn more →
ChromeOS	Google Workspace integration (import).	Not supported

Enrollment SSO for BYOD limits what Swif can manage. For BYOD devices, Enrollment SSO is Apple's account-driven User Enrollment. The Swif agent can't be installed, so many features don't work. For full management of personal Macs, use the Application or Silent Installer instead. See Set up Enrollment SSO for Apple Devices.

Choose an enrollment method

Platform	Use for	Method	Admin rights needed?	Learn more
macOS	Individual installs and pilots	Application Installer (`.dmg`)	Yes	Mac guide
	Mass rollouts and MDM migrations, such as from Jamf or Kandji	Silent Installer (`.pkg`)	Yes	Mac silent guide
	Zero-touch setup of new Macs	Automated Device Enrollment (Apple Business or Apple School Manager)	No	Link Apple Business with Swif
	Individual installs	Enrollment SSO (Managed Apple Account)	—	Set up Enrollment SSO
Windows	Individual installs and pilots	Application Installer (`.msix`)	Yes	Windows guide
	Mass rollouts and MDM migrations, such as from Intune	Silent Installer (`.msi`)	Yes	Windows silent guide
	Zero-touch setup of new Windows devices	Windows Autopilot	Yes	Set up Azure for Autopilot
Linux	Individual installs and pilots	Application Installer	Yes	Linux guide
	Developer workstations, servers, and CI	Command line	Yes	Linux guide
	Developer workstations, servers, and CI	Package manager	Yes	Installing Swif's Linux MDM via Package Manager
iOS and iPadOS	Company or shared iPhones and iPads	Automated Device Enrollment, or a user-installed MDM profile	No (Automated Device Enrollment), Yes (manual)	iOS & iPadOS MDM guide
	Individual installs	QR code	—	iOS and iPadOS enrollment guide
	Individual installs	Enrollment SSO (Managed Apple Account)	—	Set up Enrollment SSO
Android	BYOD and company-owned devices	QR code	—	Android enrollment guide
ChromeOS	Inventory of Chromebooks managed in Google Workspace	Chromebook integration with Google Workspace (read-only)	No. A Google Workspace Super Admin connects it once.	Chromebook guide

Admin rights needed? means whether the user must enter administrator or root credentials during installation.

Chromebooks

Chromebooks don't use a Swif installer or agent. Instead, Swif imports them from your Google Workspace account, using Google's read-only access to ChromeOS devices. Nothing is installed on the Chromebooks.

Connect the Chromebook integration

You can start from any of these places:

Download App window: select ChromeOS
Add Devices > Computer > ChromeOS
Settings > Integrations > Chromebook

Then:

Click Connect Integration, or Connect.
Sign in with a Google Workspace Super Admin account.
Approve the read-only permissions for ChromeOS devices.
Check that the integration shows Connected. In the enrollment window, the button changes to Chromebook Integration Connected.
Check that your Chromebooks appear in the Device Inventory.

For details, see Importing and Managing Chromebooks in Swif.

What happens if a standard (non-admin) user runs an installer?

Platform	Installer	What the user sees	If they can't enter admin credentials
macOS	Application Installer	A macOS window asking for an administrator's name and password, to add the Swif Admin account and grant a Secure Token	The installer stops. The Mac isn't enrolled, and no Secure Token is granted.
	Silent Installer (run with `sudo installer`)	1. Terminal asks for `sudo`.<br>2. Within 1 to 10 minutes, the Swif Desktop App asks for an administrator's credentials, to grant a Secure Token.	If the first prompt is cancelled, nothing is installed. If the Swif Desktop App prompt is cancelled, the agent installs without a Secure Token, so Swif can't manage FileVault or reset passwords.
Windows	Application Installer	Windows asks for an administrator's name and password (User Account Control). The installer itself doesn't ask for a password.	Nothing is installed. If the credentials are correct, Windows runs the installer as an administrator.
	Silent Installer (`msiexec /i … /quiet`)	Nothing. The command runs as the user.	Nothing is installed. The device doesn't appear in Swif.
Linux	Application Installer	At the password step, a message says the user doesn't have administrator permission.	The installer exits with an error, and no service is installed.
	Command line	Terminal asks for `sudo`.	Nothing is installed. The device doesn't appear in Swif.

Every Swif installer needs administrator rights at some point, through a password prompt or by running as root or SYSTEM. Without them, the device doesn't enroll on Windows or Linux, and enrolls without a Secure Token on macOS, which blocks FileVault and password reset features.

Chromebooks don't need this, since nothing is installed on them.

Moving a device to another Swif team

When you move an enrolled device from one Swif team to another:

Platform	What happens
macOS, iOS, iPadOS, Windows	The device is unenrolled from the previous team automatically, before it enrolls in the new one.
Android	If the device is erased, or its enrollment profile is removed (such as on BYOD devices), Swif can't detect it right away. The previous record is marked as unenrolled once the device enrolls again.
Linux	Running the Swif installer or enrollment command for the new team unenrolls the device from the previous team, and enrolls it in the new one. You don't need to unenroll it in the console first.
ChromeOS	Chromebooks are imported from Google Workspace, so they follow the Google Workspace account each Swif team is connected to.

Tips

Mixed fleets: start with silent installers for macOS and Windows, then move newly bought Apple devices to Automated Device Enrollment, for zero-touch setup.
Enrollment SSO: set it up once, so users enroll with their Managed Apple Account. See Enrollment SSO: device-side experience.
Chromebooks: there's no installer to deploy. Connect the Chromebook integration once, with a Google Workspace Super Admin account, and Swif imports your ChromeOS devices.
Team transfers: enrolling a device in a new Swif team automatically clears its previous team's registration.

Swif enrollment methods for all OSs