User Enrollment limits MDM capabilities. The iOS Deployment Reference states, "With User Enrollment, MDM can install and configure apps, manage accounts, and apply restrictions to managed data, but it cannot access location, wipe the device, or enable Activation Lock." Reference:
iOS Deployment Reference, "User Enrollment" section.
Apple Platform Deployment Guide, "BYOD Management" section.