But would you want an unenrolled user enrolling from a location outside of your trusted network(s)?
We deny unenrolled users from enrolling should they attempt anywhere but our trusted networks. The only way they can access protected assets remotely is after they complete the enrollment process. Theoretically if their credentials were compromised, there would be no way to ascertain the enrollment was from an unknown actor until after the fact.
Just something to think about.
