Apple Automated Device Enrollment

MCM and BigFix Mobile supports the Apple Automated Device Enrollment Program (DEP) — an online service to automate the enrollment and configuration of Apple devices.

Through Apple Automated Device Enrollment, you can enroll a large number of Apple devices effortlessly without user intervention. On the Apple Business Manager portal, BigFix administrators can preconfigure which devices can be assigned to which MDM Servers, so that as part of initial device setup, devices can automatically enroll in MCM and BigFix Mobile.

For more information on Apple Automated Device Enrollment such as how to qualify for the program and links for Apple Business Manager, see Apple support site.

All Apple devices, as part of initial configuration, reach out to Apple Business Manager to see if they have been preassigned to a specific MDM Server to get enrolled. If Apple Business Manager finds configuration for a device that maps to a specific profile, it sends that profile to the device. The device processes the enrollment info, make the required settings, and then reaches out to the defined MDM Server within the profile to do an MDM enrollment. If there is no specific device to Apple Automated Device Enrollment profile mapping, a device gets the Automated Device Enrollment profile assigned to the MDM Server that is marked as an auto-assigner.

For instructions on configuring ABM or MCM server for Automated Device Enrollment, see the BigFix Wiki page Apple Business Manager Quick Start Guide for DEP

Note: All the Automated Device Enrollment profile configuration files (.crt, .key, .enc, and .p7M ) are stored in the /var/opt/BESUEM/certs directory on the MDM server.

Once all these configurations are done, when a user powers up the Apple device for the initial OS setup and connects to Internet, Apple server receives a notification, recognizes the Automated Device Enrollment profile account, and redirects the device to the appropriate MDM server. The Setup Assistant on the Apple devices takes the users through the activation process.

After the devices are enrolled, you can manage MDM devices through WebUI.