Connecting Ivanti EPMM to Apple Business Manager

Check that your certificate is valid. If not valid, on the MDM page, select the Install MDM Certificate button. The MDM Certificate Generation dialog box opens.

Select Download Certificate Signing Request.

Select Upload MDM Certificate. The Upload MDM Certificate dialog box opens.

Browse to the certificate, select it and then select Upload Certificate.

Add the Server Token

Download the server token from Apple Business Manager.

Procedure

Select Settings > Apps and Books.

Download the server token for your location.

The VPP token field accepts tokens of lengths up to 1024 characters.

Create users to enable User Enrollment for local users and LDAP users

This section covers creating local and LDAP users and setting the User Enrollment for unsupervised Apple devices. User Enrollment will not work on supervised devices or devices enrolled in Apple's Device Enrollment Program.

Procedure

In the Admin Portal, go to Devices & Users > Users.

SelectAdd > Local New User. Enter the new user information. For more information on how to create a user, see "Add New User window" in the Getting Started with Ivanti EPMM.

Select a user and select Actions > Assign Roles. The Assign Roles dialog box opens.

Select Use Apple User Enrollment (For Apple unsupervised device only). A text field displays.

Enter the Managed Apple ID for the user.

Select Save.

Configure LDAP group members to inherit Apple User Enrollment Roles

You can configure LDAP group members to inherit Apple User Enrollment roles. This gives all the users in that group the Apple User Enrollment setting.

Before you begin

Create your LDAP groups. For instructions, see "Configuring the set of LDAP groups" in Getting Started with Ivanti EPMM.

Procedure

In the Devices & Users > Users page, set the search criteria in the To field to: LDAP Entries and the Category field to: Authorized LDAP Groups. You can also choose different categories in your search.

The search results display in the Users page.

Select a group and select Actions > Assign Role(s). The Assign Roles dialog box opens.

Select Use Apple User Enrollment (For Apple unsupervised device only) and add the email address for User Enrollment and Managed Apple ID. You can also use standard substitution variables, for example: [email protected]. See the table below, Supported Substitution Variables for User Enrollment, for accepted options.

Substitution variables are allowed for use with LDAP Groups only and not for LDAP Users.

Select Save.

Table 19. Supported substitution variables for User Enrollment

Substitution variable	More information	Sample of substituted value
$USERID$	Login ID (email address format)	[email protected]
$EMAIL$	Email address	[email protected]
$EMAIL_DOMAIN$	The domain part of the email address (part after the ‘@’)	myCompany.com
$EMAIL_LOCAL$	The local part of the email address (part before the ‘@’)	jdoe
$FIRST_NAME$	First name	Jane
$LAST_NAME$	Last name	Doe
$DISPLAY_NAME$	Display name	Jane Doe, CEO
$USER_DN$	Distinguished Name	CN=Jane Doe, OU=NA,OU=Users, OU=XY, DC=myCompany, DC=com
$USER_UPN$	The Microsoft userPrincipalName attribute	[email protected]
$USER_LOCALE$	Locale	en_US
$USER_CUSTOM1$	Custom field defined for LDAP	The value of the variable as defined in LDAP settings.
$USER_CUSTOM2$	Custom field defined for LDAP	The value of the variable as defined in LDAP settings.
$USER_CUSTOM3$	Custom field defined for LDAP	The value of the variable as defined in LDAP settings.
$USER_CUSTOM4$	Custom field defined for LDAP	The value of the variable as defined in LDAP settings.
$CN$	Common Name (CN) attribute extracted from the distinguished name	Jane Doe
$OU$	Organizational Unit (OU) attribute extracted from the distinquished name	XY
$SAM_ACCOUNT_NAME$	The Microsoft sAMAccountName attribute	jdoe
$REALM$	The domain component of an LDAP entry	mycompany.com

Managing users that belong to multiple groups

If a device user belongs to multiple groups (or nested groups) and is assigned a managed Apple ID substitution variable for various groups, this means there are more than one option available for each user. Ivanti EPMM cannot determine which option to use. This results in Ivanti EPMM creating an audit log entry (Logs > Audit Logs > filter by Managed Apple ID) with the error message: “More than one LDAP Group managed Apple ID option.”

To resolve this, assign the concrete Managed Apple ID for the specific LDAP user by using the following instructions.

Procedure

Go to Devices & Users > Users page, set the following parameters:

To: LDAP Entities

Category: LDAP users

search for: your LDAP user

Select a user, select Actions > Assign Role(s). The Assign Roles dialog box opens.

Select Use Apple User Enrollment (For Apple unsupervised device only) and add a unique email address for User Enrollment and Managed Apple ID.

Apple ID substitution variables are not valid for individual users or local users. Use a valid, managed Apple ID, for example, [email protected].

Select Save.

Match the Location and the Account

In order for the User Enrollment to work in Ivanti EPMM, the Apple App License Account needs to be part of the same Apple Business Manager account. Within Apple Business Manager, if you have an account listed in Locations, you need to have an Apps and Books matched to the same location. You may need to add a new location (EXAMPLE: West Coast.)

Apple may change their Apple Business Manager software without notice.

Procedure

If you have an Apple license account (VPP from Apple Business Manager) that is in the same Apple Business Manager account as the Managed Apple IDs that you will be using, you can skip steps 2 and 3.

Go to Apple Business Manager and log in.

In Apple Business Manager, go to Settings > Apps and Books.

Add a New Location, enter in the information and then select Save.

It may take several minutes for the new location to display.

Go to Accounts and search for the user name.

Select the user and select Edit.

Give the user Content Manager permissions for the (new) location, for example, West Coast.)

Sign out of Apple Business Manager to allow the permissions to take effect. It is recommended you wait several minutes before going to the next step.

Log into Apple Business Manager.

Go to Locations and confirm the new location is displaying.

Apple Apps and Books API Settings

EPMM now supports Apps and Books Org V2 iTunes APIs as V1 Itunes APIs is now deprecated by Apple.

Switching the Apps and Books V2 or back to V1 will perform a full sync of all the Apps and Books accounts.

The admin is now directly migrated to VPP V2 version in the Apps and Books.

V1 to V2: In Apple VPP V2 flow, EPMM will provide a callback URL to Apple and Apple will perform a handshake with that URL. After successful handshake only, the VPP License managements is accepted by Apple.

If you want to use the toggle option to switch between the VPP versions, contact the Ivanti support team to enable the toggle feature. Toggle between Apps and Books version is asynchronous. The admin needs to monitor the audit logs to know the status of the switch between the two versions.

The Apple VPP V2 token cant be shared between two EPMM instances.

To route VPP traffic via EPMM instead of App Manager Gateway Service.

Procedure

In the Admin Portal, go to Settings > System Settings > iOS > MDM > Apple Apps and Books API Settings section.

Select the Route VPP V2 Traffice via AppManager Gateway Service option

To perform handshake directly with Apple, Enable the firewall for Apple:

For IPv4, you can allow outbound connections to 17.0.0.0/8.

For IPv6, you can allow outbound connections to these network ranges:

2403🕒:/32

2620:149::/32

2a01:b740::/32 For more information, see https://support.apple.com/en-in/101555

Apps And Books iTunes API Version

The EPMM Apps and Books iTunes V2 API version is upgraded, and the V2 iTunes API is now enabled by default. New Toggle Apple Apps and Books itunes Api Versions option is added in Settings > System Settings > iOS > MDM > Apple Apps and Books API Settings section to switch between VPP V2 iTunes API to V1 iTunes API option.

Ivanti EPMM does not import apps that are not supported on iOS or macOS devices. This is applicable when the Apple Apps and Books API Settings V2 option is enabled.

Distribute apps to Apple Business Manager devices

You can search for iOS apps on the Apple App Store and add them to the App Catalog for distribution to Apple Business Manager devices. You can also add your own in-house apps for iOS and macOS.

For more information, see "Importing licensed apps from Apple Licenses account" in the Ivanti EPMM Apps@Work Guide.

Apple User Enrolled devices will not report un-managed apps and are unable to convert an unmanaged app to a managed app. Please adjust compliance actions accordingly.

Prerequisite

Purchase your apps in Apple Business Manager.

Now you need to import the apps you just purchased into Ivanti EPMM.

Procedure

In the Admin Portal, go to Apps > Apple Licenses.

Select the account name and then select Actions > Update licenses. The Update licenses dialog box opens.

Select the applications you wish to import into Ivanti EPMM and then select Import. It may take a few minutes to import into Ivanti EPMM.

Go to Apps > App Catalog and import the apps.

Select a newly-imported app, for example, Ivanti Mobile@Work , and then select Actions > Manage Licenses. The License Summary page displays.

Select on the link of the license. The detailed license page displays.

In the License Label management section, select Apply To labels. The Apply to Labels dialog box opens.

Select the desired label and select Apply.

For License Type, it does not matter which option you select (user-based or device-based), it will always be a user-based license when the device was registered with Apple User Enrollment. If this app is shared with other types of enrollment, device-based would be the suggested setting so that your device user will not need to enter their iTunes/Apple credentials before installing the app.

As recommended by Apple, in case VPP v2 is enabled the same license should not be shared across multiple EPMM.

From here, you can take optional actions:

Install apps - see "Using the wizard to import iOS apps from the Apple App Store" in the Ivanti EPMM Apps@Work Guide.

Apply labels - see "Managing Labels" in Getting Started with Ivanti EPMM.

Configuration settings for Apple Business Manager User Enrollment

This section covers additional configuration settings required for Apple Business Manager User Enrollment: VPN and Wi-Fi.

VPN for User-enrolled devices

User Enrolled devices can only have Per-App VPNs and can no longer have VPNs configured for the whole device. It is recommended that you create one or more VPN configurations specifically for User Enrollment. Now whenever the app is installed, the appropriate VPN configuration will also be installed automatically.

It is recommended that when assigning labels to VPN configurations, the labels should not include devices that are User Enrolled. Using a filter label, you can filter out user enrolled devices by setting in the filter:

"ios.apple_user_enrolled_device"= false

The below steps ensure when the app is installed on the user device, the appropriate VPN configuration will also be automatically installed.

Procedure

Follow the instructions in Managing VPN Settings to setup a new VPN. Be sure to select Per App VPN as part of your configuration.

Go to Apps > App Catalog.

Select the link of an app and then select Edit.

In the Per-App VPN Settings section, select the newly-created VPN and move it to the panel on the right.

Select Save.

From here, you can optionally apply a label to your Apple license. See "Applying an Apple license label to an app" in the Ivanti EPMM Apps@Work Guide.

Ivanti, Inc recommends that administrators modify labels for VPN configurations to exclude User Enrolled Devices if the VPN is not supported on User Enrollment. This can be done using the device detail "ios.apple_user_enrolled_device" and including it in the label definition, e.g.: AND "ios.apple_user_enrolled_device" = true

Wi-Fi Policy for user-enrolled devices

You need a Wi-Fi policy specifically for user-enrolled devices.

Procedure

In the Admin Portal, go to Policies & Configs > Policies.

Select Add New > Wi-Fi. The New Wi-Fi Setting dialog box opens.

Enter the information. In the Proxy Type field, select Auto. This is the only proxy type that can be used for user-enrolled devices. For more information about Wi-Fi, see Wi-Fi settings.

Device user instructions for registering using User Enrollment

This section addresses the actions the device user needs to take for registering Apple User Enrollment. The below steps will work with any app your company purchased - the example app used is the client app, Ivanti Mobile@Work .

Procedure

On the iOS device, open Safari (never Chrome) and type in the URL for Ivanti Mobile@Work : registrations.company.com/go.

The Ivanti Mobile@Work login displays. The device user is to log in using their local user or LDAP credentials. The registration page displays with a message saying the profile was downloaded.

You must complete registration within 10 minutes or you will have to start registration process over.

Tap Settings. The Settings page displays.

Tap Enroll in [Your Company Name].

The User Enrollment page displays.

Tap Enroll My iPhone. If you tap Cancel and Delete Profile, you will have to start the registration process all over again.

You will be presented with a login for either Apple or your Federated account. Enter the password for your Managed Apple ID. (The Managed Apple ID will be listed at the top of your login page.)

You may be presented with the option to stay signed in, make a selection.

The "Enrollment is Successful” page is displayed.

Using Logs for Troubleshooting

To troubleshoot errors or issues for a User Enrolled device, start by reviewing the device MDM logs.

Procedure

In the Admin Portal, go to Devices & Users > Devices.

Select the device to open up the Device Details page.

Select the Logs tab. A list of available logs display.

Select the MDM Activity link to display the list of MDM actions performed on the device.

From the MDM Activity page, you can filter the actions based on a date range, the state of the action (for example, Error) or the action itself (for example, Install Managed Application.) If the action is in the Error state, a View Error link displays. Select this link to see more details about the error.

View reports on devices

You can see a report on devices by selecting the device , selecting the Log tab and then selecting the MDM Activity link.

Activation Error

Errors occur when the device is supervised. Users cannot use a supervised device for User Enrollment. There is no remedy for this as supervised devices cannot be used with User Enrollment.

App fails to install (AppAlreadyInstalled)

The most common Install Managed Application error is AppAlreadyInstalled. This error occurs when the device has the app installed in the private space. Since the MDM service is unable to see private apps and is unable to convert the app to managed, an Install Managed Application command sent for an already-installed app will get this error message.

Procedure

Instruct the device user to remove the app from the device.

Instruct the device user to tap “Install” for the app within Ivanti Mobile@Work .

Procedure (Alternate)

Alternatively, you can send a new installation request to the device for that application.

Navigate to Apps > App Catalog.

Select the check box next to the app.

Select Actions and select Send Installation Request.

Select the option to Send request for new installations.

Under Actions, choose Select devices to send message and then select Apply.

Search for the device, select the check box and then select Send.