A user enrolled their personal iPhone in the organization's MDM solution. Which of these management capabilities does the organization's MDM solution have on the user's iPhone?

User Enrollment is a specific MDM enrollment mode for personally owned devices (BYOD) that prioritizes user privacy by separating managed corporate data from personal data. This is achieved by creating a separate, managed APFS volume on the device. The MDM solution can manage apps and accounts within this corporate volume. Configuring a Per-App VPN is a key capability, as it allows the organization to secure traffic for managed corporate apps without routing the user's personal traffic through the corporate network. This respects the privacy boundary central to the User Enrollment design. Other more invasive actions, such as a full device wipe or location tracking, are explicitly restricted to protect the user.

B. Accessing device location is a privacy-sensitive query that is explicitly disallowed for devices enrolled via User Enrollment to protect the user's personal privacy.
C. MDM cannot wipe the entire device in User Enrollment. It can only remove the managed APFS volume, which contains corporate apps and data, leaving personal data untouched.
D. Activation Lock is tied to the user's personal Apple ID. MDM cannot enable it. On supervised devices, MDM can bypass it, but this is not a User Enrollment scenario.

1. Apple Platform Deployment (January 15, 2024): "User Enrollment and MDM". This section details the separation of personal and organizational data. It states, "Because the device is personally owned, MDM has a limited set of queries and restrictions it can enforce on the device."

2. Apple Platform Deployment (January 15, 2024): "Per-App VPN MDM payload settings". This document confirms that a VPN payload can be configured and associated with managed apps, which is a core function for securing corporate data on BYOD devices.

3. Apple Platform Deployment (January 15, 2024): "MDM commands for Apple devices". The description for the EraseDevice command specifies that for User Enrollment, the command "removes the managed account and its data," not the entire device.

4. Apple Platform Deployment (January 15, 2024): "MDM queries for Apple devices". The documentation for the DeviceLocation query explicitly notes that it is "Not available for devices enrolled using User Enrollment."