A user enrolled their personal iPhone in the organization's MDM solution.

In aUser Enrollmentscenario (BYOD), Apple ensures strict separation of work and personal data. MDM has limited authority and cannot track personal location, wipe the entire device, or alter Activation Lock. Instead, MDM can configure work-related features such asPer-App VPN(A). Apple Learning explains that this ensures organizational traffic from managed apps is routed securely without affecting personal app traffic. This preserves privacy while providing enterprise-level security. Location data and systemwide controls are unavailable to MDM on personally owned devices. Full wipe is restricted to organizationally owned devices under Automated Device Enrollment. Therefore, configuringPer-App VPNis the correct capability, as it balances enterprise data protection while respecting personal device use.