Device Management Guide - Apple

Revision history

Managing Devices

Enabling Server Name Lookup

Registering Devices

General management of devices

Apple device status attributes

Searching for Devices

Securing Devices

Distributing MDM Profiles with Apple Configurator

MDM profile distribution with Apple Configurator

Automatically matching Apple devices with serial numbers

Exporting an MDM profile from Ivanti EPMM 7.0.0.0 - 9.0.0.0

Using Apple Configurator to register an Apple device with Ivanti EPMM

Managing Devices Enrolled in Apple Device Enrollment

Apple Device Enrollment with Ivanti EPMM overview

Setting up Apple Device Enrollment with Ivanti EPMM

Creating an Apple Device Enrollment Profile

Managing Apple Device Enrollment accounts

Adding a custom Automated Device Enrollment web page

Beta Enrollment

Managing Apple Declarative Device Management

Software update enforcement policy

Support for WatchOS enrollment

Viewing device battery health status

Fleet component monitoring

Managing Apple School Manager Devices

Apple School Manager account management overview

Best practices for managing devices in Apple School Manager

Creating an Apple School Manager account

Adding school information to your Apple School Manager account

Editing Ivanti EPMM roles for Apple Education management

Configuring devices in bulk for Apple School Manager

Connecting Ivanti EPMM to Apple School Manager

Adding your enrolled devices to your MDM server

Creating a custom attribute to use with Apple School Manager

Enabling Apple Education in Ivanti EPMM

Configuring Shared Device Cart

Synchronizing Ivanti EPMM with Apple Education servers

Distributing apps to Apple School Manager devices

Disabling Apple Education in Ivanti EPMM

Checking Apple Education logs

Shared iPad delete user session

Retiring Shared iPad devices

Managing Apple Business Manager

Implementing User Enrollment with Apple Business Manager

Shared iPad devices with Apple Business Manager

Shared iPad delete user session

Best practices for managing devices in Apple Business Manager

Connecting Ivanti EPMM to Apple Business Manager

Apple access management

User Enrollment with iREG

User Enrollment with Apple Business Manager

Account-driven Apple User Enrollment

Account-driven Apple Device Enrollment

Multi-User Support

About multi-user support

Using Secure Sign-In and Sign-Out

Setting Secure Sign-In preferences

Setting unique restrictions for signed-out devices

Enabling Secure Sign-In

Customizing the multi-user secure sign-in web clip

Remote sign-out from a multi-user iOS device

Setting automatic sign-out for multi-user devices

Managing Custom Attributes

Custom Attributes

Assigning a custom attributes role

Adding custom attributes to users and/or devices

Viewing custom attributes available for users and/or devices

Viewing custom attributes assigned to users

Viewing custom attributes assigned to devices

Editing custom attributes for users and/or devices

Searching for custom attributes for users and/or devices

Exporting a log of the custom attributes for users and/or devices

Deleting custom attributes from users and/or devices

Setting custom attribute values for device or users

Viewing custom attribute changes

Pushing label attribute changes to devices and users

Managing Policies

Working with default policies

Importing and exporting policies

Viewing policy status and platform support

Enabling profile encryption

Enabling or disabling encryption on a macOS device

Storing and retrieving FileVault personal recovery keys in Ivanti EPMM (macOS)

Configuring a system policy managed setting

Configuring a system policy control setting

Configuring a system policy rule

Configuring iOS and macOS software updates

Managing the activation lock for iOS devices

Software Update Settings

Safari extensions

Ethernet Settings

safari settings

Whitelisting Wi-Fi networks

Configuring firewall settings for macOS devices

Sync policies and battery use

Global App Config Settings policy

App update schedule policy

Google BeyondCorp Configuration

MTD Anti-Phishing/Smishing Policy

Work Schedule policy

Country changes and alerts

iOS location-based wakeups interval and syncing with Ivanti EPMM

Single-app mode policies

Configuring a global HTTP proxy policy

Cellular policies

Configuring an eSIM refresh cellular plan policy

Wallpaper policies

Accessibility Settings Policy

Creating Default Applications Setting

Device name policies

Customizing a home screen layout

Customizing a lock screen message

Configuring notification settings

tvOS policy settings

Working with Windows Update policies

Notifications of changes to the privacy policy

Exporting the devices in the WatchList

Managing Scripts

Managing Device Settings with Configurations

Management of device settings with configurations

Configurations page

Default configurations

Editing default iOS MDM settings

Restoring system web clips (iOS)

Displaying configurations status

Adding new configurations

Editing configurations

Deleting configurations

Exporting configurations

Importing configurations

Applying configurations to labels

Impact of changing LDAP server variables

Creating DNS Proxy Configurations

Configuring encrypted DNS settings

Managing Compliance

Managing Wi-Fi Settings

Wi-Fi profiles and password caching

Wi-Fi authentication types

Configuring Email

Managing VPN Settings

VPN settings overview

Configuring new VPN settings

Check Point Capsule

Cisco AnyConnect (iOS only)

Cisco Legacy AnyConnect

IKEv2 (iOS Only)

IPSec (Blue Coat)

Ivanti Tunnel (iOS and macOS)

NetMotion Mobility VPN (iOS)

Palo Alto Networks GlobalProtect

Pulse Secure SSL

SonicWall Mobile Connect

Managing Certificates and Configuring Certificate Authorities

Certificates overview

Managing certificates issued by certificate enrollment configurations

Configuring certificate pinning for registered devices

Supported certificate scenarios

Ivanti EPMM as a certificate authority

Configuring Ivanti EPMM as an independent root CA (Self-Signed)

Configuring Ivanti EPMM as an intermediate CA

Mutual authentication between devices and Ivanti EPMM

Certificates settings

Certificate Enrollment settings

Configuring ACME Certificates

Configuring a client-provided certificate enrollment setting

Configuring an Entrust CA

Configuring a GlobalSign CA

Configuring Ivanti EPMM as the CA

Configuring OpenTrust CA

Certificate Revocation Checking Configuration

Configuring a single file identity certificate enrollment setting

Configuring SCEP

Enabling Kerberos Authentication between EPMM and the SCEP and LDAP servers

Configuring Symantec Managed PKI

Configuring Symantec Web Services Managed PKI

Configuring DigiCert One

Configuring a user-provided certificate enrollment setting

Certificate Transparency Payload

Configuring iOS and macOS settings and restrictions

iOS and macOS settings

Extensible Single Sign-On

Extensible Single Sign-On Kerberos

iOS / tvOS settings

iOS and macOS Ivanti EPMM settings differences

Using Ivanti Mobile@Work for iOS

Device management with the Ivanti Mobile@Work My Devices tab

Managing notifications in Ivanti Mobile@Work for iOS

Logging and enhanced logging for Ivanti Mobile@Work

Remote activation of enhanced logging for iOS Ivanti Mobile@Work

Auto-launching the Ivanti Mobile@Work for iOS in MTD and Non-MTD devices

Opening Ivanti Mobile@Work for iOS logs in other apps

Encrypting device logs with your own certificate

Screen orientation

Ivanti Mobile@Work Support Tab Policy

Additional Configurations Using KVP

Using Ivanti Mobile@Work for macOS

Running shell scripts on macOS devices

Working with Events

Managing events

Customizing Event Center messages

Viewing and Exporting Events

Troubleshooting Ivanti EPMM and devices

Pushing and removing device profiles

Troubleshooting configurations

About Ivanti EPMM logs

Audit log information

Audit Logs use cases

Certificate Management

Service Diagnostic tests

Pull client logs for client devices

Office 365 App Protection overview

Office 365 App Protection policies

Office 365 App Protection configurations

Office 365 App Protection user groups

Office 365 App Protection reports

Office 365 App Protection settings

Apply the Intune license to device users

Adding Ivanti EPMM as a compliance partner

Creating a conditional access policy in Microsoft Endpoint Manager

Connecting Microsoft Azure to Ivanti EPMM

Creating a partner device compliance policy

De-provisioning of the Azure tenant

Installing Ivanti Mobile@Work for iOS, macOS, and Android

Required client device user action and use cases

Help@Work for iOS

About Help@Work for iOS

How Help@Work for iOS works

Help@Work for iOS setup overview

Installing TeamViewer on your desktop

Requesting a TeamViewer account

Creating a TeamViewer app

Enabling Help@Work in Ivanti EPMM

Deploying the TeamViewer QuickSupport app

Starting a remote control session

Transitioning Help@Work to the Modern workflow for iOS

Enabling Help@Work in Ivanti EPMM

Language Support

Translated versions of client apps

Selecting languages for Ivanti EPMM messages

Setting the system default language

Changing language selection from the Admin Portal

Self-service User Portal

What is the self-service user portal?

Setting up the self-service user portal

Using the self-service user portal

Docs powered by Archbee

Using Ivanti Mobile@Work for macOS

0 min

This section addresses the management of Ivanti Mobile@Work for macOS.

Running shell scripts on macOS devices

Updated 27 Oct 2026

Additional Configurations Using KVP

Running shell scripts on macOS devices

Docs powered by Archbee

Docs powered by Archbee

Copyright © 2026, Ivanti, Inc. All rights reserved.

Privacy and Legal