In which ownership model can IT administrators restrict the installed apps and personal data on a device meant to be shared with multiple users?

The "Nonpersonalized, organization-owned" model refers to devices owned by an organization and configured for shared or single-purpose use, not assigned to a specific individual. This model, exemplified by features like Shared iPad or devices in kiosk mode, grants IT administrators the highest level of control. They can enforce strict policies to restrict which apps are installed, prevent users from storing personal data, and ensure the device remains in a standardized state for every user, which is essential for a shared environment.

A. BYOD, User Enrollment: This model is for personally owned devices. User Enrollment is designed to protect user privacy by separating work and personal data, giving IT limited control over the device.
B. BYOD, personally enabled: BYOD (Bring Your Own Device) inherently means the device is personally owned, not organization-owned. This model is unsuitable for a centrally managed, shared device scenario.
D. Personally enabled, organization-owned: This describes a device owned by the organization but assigned to a single user for both work and personal use. It is not a shared model and is designed to accommodate personal data.

1. Apple Platform Deployment Guide. (2024). Apple

Inc.

Section: "Choose a deployment model" -> "Organization-owned device deployment" -> "Shared deployment".

Content: This section explicitly details the "Shared iPad" and "Shared iPhone" models where organization-owned devices are shared among multiple users. It states

"Because the devices are organization-owned

you can configure them with the settings

apps

and services your users need

" which directly supports the concept of IT restricting apps and data in a non-personalized

shared context.

2. Stanford University IT. (2023). Mobile Device Management (MDM) at Stanford.

Section: "Device Ownership Models and Management Levels".

Content: The documentation distinguishes between personally-owned (BYOD) and university-owned devices. For university-owned devices

especially those in shared-use pools (e.g.

labs

loaner programs)

it describes a "fully managed" or "locked-down" state where administrators have complete control to restrict applications and data to comply with security and operational policies. This aligns with the "Nonpersonalized

organization-owned" model.

3. MIT Information Systems & Technology (IS&T). (2024). Mobile Device Management Service.

Section: "Device Enrollment Options".

Content: This resource outlines the differences in management capabilities based on device ownership. It clarifies that institutionally-owned devices enrolled through Apple Business Manager/School Manager can be fully supervised

allowing for comprehensive restrictions

which is a prerequisite for managing a shared

non-personalized device as described in the question.