Apple Platform Deployment
- Welcome
- Intro to Apple platform deployment
- What’s new
-
-
- Accessibility payload settings
- Active Directory Certificate payload settings
- AirPlay payload settings
- AirPlay Security payload settings
- AirPrint payload settings
- App Lock payload settings
- Associated Domains payload settings
- Automated Certificate Management Environment (ACME) payload settings
- Autonomous Single App Mode payload settings
- Calendar payload settings
- Cellular payload settings
- Cellular Private Network payload settings
- Certificate Preference payload settings
- Certificate Revocation payload settings
- Certificate Transparency payload settings
- Certificates payload settings
- Conference Room Display payload settings
- Contacts payload settings
- Content Caching payload settings
- Directory Service payload settings
- DNS Proxy payload settings
- DNS Settings payload settings
- Dock payload settings
- Domains payload settings
- Energy Saver payload settings
- Exchange ActiveSync (EAS) payload settings
- Exchange Web Services (EWS) payload settings
- Extensible Single Sign-on payload settings
- Extensible Single Sign-on Kerberos payload settings
- Extensions payload settings
- FileVault payload settings
- Finder payload settings
- Firewall payload settings
- Fonts payload settings
- Global HTTP Proxy payload settings
- Google Accounts payload settings
- Home Screen Layout payload settings
- Identification payload settings
- Identity Preference payload settings
- Kernel Extension Policy payload settings
- LDAP payload settings
- Lights Out Management payload settings
- Lock Screen Message payload settings
- Login Window payload settings
- Managed Login Items payload settings
- Mail payload settings
- Network Usage Rules payload settings
- Notifications payload settings
- Parental Controls payload settings
- Passcode payload settings
- Printing payload settings
- Privacy Preferences Policy Control payload settings
- Relay payload settings
- SCEP payload settings
- Security payload settings
- Setup Assistant payload settings
- Single Sign-on payload settings
- Smart Card payload settings
- Subscribed Calendars payload settings
- System Extensions payload settings
- System Migration payload settings
- Time Machine payload settings
- TV Remote payload settings
- Web Clips payload settings
- Web Content Filter payload settings
- Xsan payload settings
-
- Declarative app configuration settings
- Authentication credentials and identity asset settings
- Calendar declarative settings
- Certificates declarative configuration
- Contacts declarative configuration
- Exchange declarative configuration
- Google Accounts declarative configuration
- LDAP declarative configuration
- Legacy interactive profile declarative configuration
- Legacy profile declarative configuration
- Mail declarative configuration
- Passcode declarative configuration
- Passkey Attestation declarative configuration
- Screen Sharing declarative configuration
- Service configuration files declarative configuration
- Software Update declarative configuration
- Subscribed Calendars declarative configuration
- Glossary
- Document revision history
- Copyright
Automated Device Enrollment is designed for all Apple devices owned by the organization. Automated Device Enrollment lets organizations configure and manage devices from the moment the devices are removed from the box. You can also use all the available payloads and restrictions defined by Apple, and you have the option to prevent the mobile device management (MDM) enrollment profile from being removed by the user.
For these devices, the following MDM enrollment options can be configured.
Option | Usage | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Prevent unenrollment | A supervised device can’t be unenrolled by the user. On Mac computers, this prevents unenrollment from System Settings for macOS 13 or later, or from System Preferences for macOS 12.0.1 or earlier, as well as from the | ||||||||||
Automatically advance through Setup Assistant | A supervised Mac computer using macOS 11 or later or Apple TV is automatically configured without any user intervention, provided no other Setup Assistant panes are enabled. | ||||||||||
Language | The language to set on the device if using Auto Advance. | ||||||||||
Region | The region to set on the device if using Auto Advance. | ||||||||||
Hold device in Setup Assistant | Holds the device in the Setup Assistant to allow MDM to apply any critical configurations or install critical apps. The device can then proceed through or exit Setup Assistant after instructed by the MDM solution. A similar option can be used for Shared iPad to hold the device in Setup Assistant after user authentication to ensure the device is ready to go when the user presented with the Home Screen. | ||||||||||
Configuration web URL | URL that the device should load in the Setup Assistant. This can be used for authentication, custom branding, consent text, or more. | ||||||||||
Setup Assistant panes to skip | Optional: Which panes should be skipped in the Setup Assistant to streamline the device setup process for the user. | ||||||||||
Enforce FileVault | An MDM solution can require a Mac computer running macOS 14 or later to turn on FileVault during Setup Assistant. This helps ensure that the internal storage is always encrypted before being used. An organization can then decide whether to show the recovery key and optionally escrow it to MDM. This functionality should be used in conjunction with holding the device in Setup Assistant to ensure that the MDM solution has all necessary information before proceeding. | ||||||||||
Configure as Shared iPad (Shared iPad only) | Enables Shared iPad. | ||||||||||
Number of Shared iPad users (Shared iPad only) | Enter the number of students who may potentially use this iPad. For best results, the number of students should be low. | ||||||||||
Auto Advance and Automated Device Enrollment (macOS)
Auto Advance is an additional option for Automated Device Enrollment that allows you to skip all Setup Assistant panes automatically with a Mac computer that is plugged into Ethernet. With Auto Advance configured in MDM, organizations can order Mac computers and, after they arrive, simply plug them into Ethernet and power them on. The Mac locates the assigned MDM solution and is automatically configured based on settings from the MDM solution, including skipping all Setup Assistant panes. The user then enters a known user name and password at the Login window. For a Mac to take advantage of Auto Advance, it must be using macOS 11 or later and meet all the following additional criteria:
The computer’s serial number must appear in Apple School Manager, Apple Business Manager, or Apple Business Essentials.
It must have Automated Device Enrollment settings, including the Auto Advance key applied to the Mac using an MDM solution.
It must be plugged into a power source (recommended but not required).
It must be plugged into an active Ethernet connection (initial configuration only).
It must be able to access the MDM solution through an internal network or the internet.
Enforcing a minimum version of iOS, iPadOS, and macOS
MDM solutions can enforce a minimum operating system version on enrolling devices when using Automated Device Enrollment. If the device doesn’t meet the minimum version expected by MDM, the user is guided through a software update or upgrade before they can continue with Setup Assistant. This ensures that devices owned by an organization are on the necessary version required before being put into production.
Enforcing Automated Device Enrollment
In macOS 14 or later, if a Mac that’s registered to Apple School Manager or Apple Business Manager doesn’t enroll into device management during the first setup, a full-screen setup experience is displayed.
The user can choose “Not now” once, which causes the screen to be dismissed for 8 hours. During those 8 hours, the user sees a follow-up option in System Settings to start the enrollment. After the time expires, an administrator must enroll the device.
This replaces the current notification experience and ensures that the device must be enrolled into device management in order to be used. Enforcing device enrollment results in fewer unmanaged organization-owned devices.
How Apple separates user data from organization data
The table below shows how Apple separates user data from the organization’s data with Automated Device Enrollment.
MDM can | MDM can’t |
|---|---|
View and set the device name | View personal mail, calendars, contacts |
Query the phone number | View SMS or iMessages |
Query the serial number | View Safari browser history |
Query the model name and number | View FaceTime or phone call logs |
View capacity and space available | View personal reminders and notes |
Query operating system version number | Collect the frequency of app usage |
Install Managed Apps | |
Configure all restrictions | |
Configure global HTTP proxy | |
Remotely erase all content and settings on the device | |
Manage Activation Lock | |
Access roaming status | |
Enable Lost Mode |
Thanks for your feedback.
