Apple Device Enrollment with Ivanti EPMM overview
Apple Device Enrollment allows you to quickly and easily deploy a fleet of corporate-owned iOS, macOS, and tvOS devices. With Apple Device Enrollment, organizations such as universities and corporations can purchase, enroll, and manage Apple devices en masse. After purchasing Apple devices, administrators enroll devices and manage the devices using a Mobile Device Management (MDM) server such as Ivanti EPMM. Apple Device Enrollment and Ivanti EPMM are linked so that they can easily communicate and new devices assigned to the Apple Device Enrollment account can be synchronized with Ivanti EPMM.
Apple Device Enrollment is different from other methods of enrolling / registering devices, see Registration methods. See also iOS Apps@Work AppStore Features in the Ivanti EPMM Apps@Work Guide.
Bootstrap token endpoint authorization is implemented for iOS and macOS enrollments in DEP. With this capability macOS devices present a bootstrap token to EPMM at the time of enrollment.
For iOS devices, bootstrap token is presented to EPMM during DEP Enrollment only.
After enrollment the device requests EPMM to get bootstrap token for the following activities:
- Authorize installation of Software Updates.
- Silently authorize to “erase all content and settings MDM command”.
Changes in Device Enrollment
The original Apple Device Enrollment portal had three sections that represented device enrollment: MDM Servers, Device Assignments and Assignment History. These three are represented in Ivanti EPMM as "Apple Device Enrollment." There are two types of device enrollment programs that Ivanti EPMM manages: Apple Business Manager and Apple School Manager. Apple no longer allows new customers to sign up for the legacy Device Enrollment Program (DEP) portal at deploy.apple.com. New accounts with Apple Device Enrollment will be provisioned on Apple Business Manager.
Apple Business Manager
Apple Business Manager is a place for IT teams to automate device deployment, purchase and distribute content, and manage roles in their organizations. Working seamlessly with Ivanti EPMM, you can enroll devices, deploy content, and delegate administrative privileges.
The Device Enrollment Program (DEP) and the Volume Purchase Program (VPP) are now integrated into Apple Business Manager, so you can bring together everything needed to deploy iOS devices, Mac computers, and Apple TV into your organization. In Ivanti EPMM, the terms "Device Enrollment Program (DEP) is now renamed to "Apple Device Enrollment" and "Device Enrollment." "Volume Purchase Program" (VPP) has been renamed to "Apple Licenses."
- To enroll in Apple Business Manager, see the Apple Business Manager User Guide on the Apple website. A login is required.
- To enroll in User Enrollment, see User Enrollment with Apple Business Manager.
Apple School Manager
Apple School Manager is a simple, web-based portal for IT administrators to deploy iOS, macOS, and tvOS devices all from one place. When used with Ivanti EPMM, you can configure device settings and buy and distribute apps and books. Apple School Manager integrates with Student Information Systems (SISs) so you can quickly create accounts with school rosters and classes.
To enroll in Apple School Manager, see the Apple School Manager User Guide on the Apple website. A login is required..
Apple Device Enrollment features
Using Apple Device Enrollment for large-scale deployments, you can:
- Deploy devices without having to touch them
- Automate mobile device management (MDM) enrollment
- Enable device supervision, including restrictions
- Skip some Setup Assistant screens, allowing device users to use their devices immediately
Apple Device Enrollment setup
The main steps of setting up Apple Device Enrollment are:
- Enrolling in the Apple Business Manager or Apple School Manager programs.
- Linking to your MDM server, in this case, Ivanti EPMM.
- Assigning devices to Ivanti EPMM. For assigning multi-user devices, see Configuring devices in bulk for Apple School Manager.
- Applying MDM configurations, as desired.
The MDM server you are linking to is Ivanti EPMM. After setting up Apple Device Enrollment, you use Ivanti EPMM to secure and manage your devices, and apply MDM configurations.
If you configure your devices to be supervised, you can apply additional restrictions through Ivanti EPMM.
Best practices for managing devices in Apple Device Enrollment
Following are some best practices to keep in mind for managing enrolled devices in a Device Enrollment Program:
- You can enroll devices in an Apple Device Enrollment you previously registered in Ivanti EPMM, as long as you wipe and retire these devices first.
- Use Apple Device Enrollment to purchase a large group of devices, which you can more easily manage in Ivanti EPMM.
Related topics