> For the complete documentation index, see [llms.txt](https://docs.parallels.com/landing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.parallels.com/landing/pd-ag/parallels-desktop-enterprise-quick-start-guide/scenario-based-quick-start-blueprints/scenario-c-contractors-and-byod-users.md).

# Scenario C: Contractors & BYOD Users

### Who this fits

Contractors and BYOD users on Macs that aren't enrolled in any MDM.

### Architecture at a glance

Unlike Scenarios A and B, there's no Jamf Pro step here. Instead: the user installs Parallels Desktop via an invitation email (a license-key-based temporary activation code, sent from the Parallels Business Account), then activates it against your organization's sublicense. Once activated, the Management Portal automatically pushes the same Declarative Golden Image and policy it would to a managed Mac — the VM is sourced by the Portal, provisioned by the `.ppkg`, and enrolled in Intune, with no MDM involved on the Mac side.

{% hint style="info" %}
**Note**: This page assumes the invitation-email flow results in the same automatic Golden Image/policy handoff as an MDM-managed install, once the Parallels Desktop installation is activated against the corporate sublicense. The current invitation-email reference page doesn't reflect this explicitly and may need an update — flagged separately.
{% endhint %}

### Deployment method and why

**Declarative**. This scenario has no MDM requirement — the invitation email covers unmanaged Macs, while the VM itself still arrives through the same Portal-sourced, Declarative path as any other scenario.

### Management Portal policy settings

Create a policy for the contractors/BYOD user group with a Golden Image set to **Declarative** / **Windows Enterprise**. Recommended settings for this group:

* **Security Controls**: Encrypt VMs and lock them to the company's Parallels license · Limit users to provisioned VMs only · Do not allow removing provisioned VMs.
* **VM Settings**: Clipboard and Drag-and-drop sharing set to **Disconnect** (mandatory for this scenario). Other VM isolation settings (shared folders, printers, external devices) are optional — evaluate case by case based on what the contractor's role actually needs access to.

See [Stage 3: Management Portal & Remote Policy Setup](/landing/pd-ag/parallels-desktop-enterprise-quick-start-guide/end-to-end-implementation-stages-technical-workflow/stage-3-management-portal-and-remote-policy-setup.md) for how to create the policy, and the full comparison across scenarios.

### Role handoffs

* **Portal Admin** — creates the policy and Golden Image, assigns the contractor/BYOD group, applies the Security Controls above.
* **License Admin** — sends the invitation email from the Parallels Business Account dashboard and manages the license seat pool.
* **Windows-Identity Admin** — confirms the provisioning package enrolls the VM in Intune correctly for this group.

### Verification

In the Management Portal, open the Golden Image card and confirm the contractor's VM shows as provisioned. Ask the contractor to confirm Windows completes first boot and signs in with their corporate account after activating Parallels Desktop with the emailed code.

### Where to go next

Continue to [Stage 1: Account, SSO & Licensing Configuration](https://github.com/Parallels-Corp/DI-OPS-prls-docs/tree/master/parallels-desktop/admin/end-to-end-implementation-stages-technical-workflow/stage-1-account-sso-and-licensing-configuration.md) to set up the contractor group's sublicense and activation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.parallels.com/landing/pd-ag/parallels-desktop-enterprise-quick-start-guide/scenario-based-quick-start-blueprints/scenario-c-contractors-and-byod-users.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.