Cisco Systems MaaS360 manual Shows the flow of this process

Figure 16 Binding Policies to User Groups

With the example configuration shown above, users that belong to BYOD_Employee_Access will get Full_Access_policy pushed to their devices. User will see two profiles installed by ISE and two or three from the MDM. The server will install the MDM payload during the on-boarding process. After that profile has been installed, the device will be issued a check-in request via APNS or GCM. When the device responds to the push notice, it will connect to the MDM where any additional profiles are installed.

Figure 17 shows the flow of this process.

24Integrating Fiberlink MaaS360 with Cisco Identity Services Engine