Hi Kelly,
I'll try to keep this as concise as possible, but we should really break it down in to two answers: Those who are enrolled and those who have the app.
Those who have the app is easy enough - a search can be created in the MaaS360 "Advanced Search" option under Devices to look for devices enrolled that do (or do not) have the MaaS360 application installed.
Those who are enrolled is a bit more difficult, depending on the baseline you want to measure enrollment.
If that baseline is devices with email configured - if you are using Exchange/Office365, Traveler, or G Suite - MaaS360 can leverage our Cloud Extender and other tools to look for devices with mail configured and to block them if they are not enrolled.
If mail isn't really the metric you want to go by, there are other options - Cloud Identity for Single Sign On (included in MaaS360) may be leveraged with certain products to ensure that devices using the service are enrolled in MaaS360.
Likewise we also integrate with a number of network security products such as Cisco ISE to provide network access control - devices must be enrolled to join the network.
Simple inventory control may provide the answer as well - if your company is providing the devices you can simply export the inventory of enrolled devices from MaaS360 as a spreadsheet and compare it to what your employees have been provisioned to look for discrepancies.
There are different variations of the above that may work, so if you have any questions or would like clarification on any points above, feel free to ask
------------------------------
Matt Shaver
System Architect
IBM
mshaver@us.ibm.com------------------------------