what is the meaning of enrolling? add a label to group or policy? The default Azure Information Protection policy is automatically assigned to all users in your tenant's Azure AD. If need to add any other settings it can be from PowerShell.
The first time the AIP client is loaded for a user, after install they are directed to https://portal.azurerms.com and are required to sign up for document tracking. Whilst we want the document tracking facility we had hoped we could do it without user intervention.