Not all enterprises allow BYOD.
AFAIK there is no enrollment restriction which would allow us to just enroll devices from our OEM or the ones we have registered intentionally.
This it would be great to add a enroll restriction that forbids to enroll any non-registered device
Strongly required here as well. We need to control who can enroll private devices
It would be great to see the pending app installs but also powershell scripts in some user interface, maybe the company portal ....