Scenario C: Contractors & BYOD Users

Who this fits

Contractors and BYOD users on Macs that aren't enrolled in any MDM.

Architecture at a glance

Unlike Scenarios A and B, there's no Jamf Pro step here. Instead: the user installs Parallels Desktop via an invitation email (a license-key-based temporary activation code, sent from the Parallels Business Account), then activates it against your organization's sublicense. Once activated, the Management Portal automatically pushes the same Declarative Golden Image and policy it would to a managed Mac — the VM is sourced by the Portal, provisioned by the .ppkg, and enrolled in Intune, with no MDM involved on the Mac side.

Note: This page assumes the invitation-email flow results in the same automatic Golden Image/policy handoff as an MDM-managed install, once the Parallels Desktop installation is activated against the corporate sublicense. The current invitation-email reference page doesn't reflect this explicitly and may need an update — flagged separately.

Deployment method and why

Declarative. This scenario has no MDM requirement — the invitation email covers unmanaged Macs, while the VM itself still arrives through the same Portal-sourced, Declarative path as any other scenario.

Management Portal policy settings

Create a policy for the contractors/BYOD user group with a Golden Image set to Declarative / Windows Enterprise. Recommended settings for this group:

• Security Controls: Encrypt VMs and lock them to the company's Parallels license · Limit users to provisioned VMs only · Do not allow removing provisioned VMs.

• VM Settings: Clipboard and Drag-and-drop sharing set to Disconnect (mandatory for this scenario). Other VM isolation settings (shared folders, printers, external devices) are optional — evaluate case by case based on what the contractor's role actually needs access to.

See Stage 3: Management Portal & Remote Policy Setup for how to create the policy, and the full comparison across scenarios.

Role handoffs

• Portal Admin — creates the policy and Golden Image, assigns the contractor/BYOD group, applies the Security Controls above.

• License Admin — sends the invitation email from the Parallels Business Account dashboard and manages the license seat pool.

• Windows-Identity Admin — confirms the provisioning package enrolls the VM in Intune correctly for this group.

Verification

In the Management Portal, open the Golden Image card and confirm the contractor's VM shows as provisioned. Ask the contractor to confirm Windows completes first boot and signs in with their corporate account after activating Parallels Desktop with the emailed code.

Where to go next

Continue to Stage 1: Account, SSO & Licensing Configuration to set up the contractor group's sublicense and activation.