[Environment]
SDS IAM & EMM

[Summary] 
When trying to enroll a device a user gets the error message, “Enrollment failure. You do not have permission to enroll devices. Please contact your system administrator"

[Cause]
Users do not have a policy assigned that would grant them the permission to enroll devices.

[Resolution]
This can be achieved in two ways: by updating an exiting policy associated with the user or via the Users > Invite Users option.

To give the enrollment permission by updating an existing policy applied to the user, enable the “Permit device enrollment” policy under Mobile Device Policies > Device Enrollment Settings.

If you are using the second option of Users > Invite Users, the system automatically will:
- create a policy named "Invited Users" with only this setting enabled: “Permit device enrollment” policy under Mobile Device Policies > Device Enrollment Settings.
- create a role named “Invite Users”
- add the invited user(s) to “Invite Users” role .