> it really kills me just how poorly the G Suite product team seems to understand enrollment and authorization workflows. > No, I don't want to allow every dev

> it really kills me just how poorly the G Suite product team seems to understand enrollment and authorization workflows. > No, I don't want to allow every device to register itself into the device list. If I'm managing installations of organization-owned devices, then I want to pre-register the device into a device whitelist that I maintain before I allow that device unfettered access to protected resources. you have a best practice, but narrow vision. the very, very, very large majority of "enterprises" (certainly SMB) do not have an inventory of devices. even if they do, they have to onboard them into the G Suite inventory somehow. just like MDM solutions always have an "open enrollment" method, this is a way to jumpstart that process. by setting a point in time at which open enrollment is allowed, rolling it out, then closing said open enrollment, inventory collection is easily streamlined without needing any IT skill. you could then audit your inventory to make sure there is just 1 device per user. last step, you disable the auto enrollment option. https://support.google.com/a/answer/7543044?visit_id=637236989645921169-2120742192&rd=1 https://support.google.com/a/answer/7543044?visit_id=6372369...