Skip to main content

Set up and manage iOS devices with MDM

A step-by-step guide for IT admins to enroll, configure, and secure iOS devices using DEP and MDM.

M
Written by Mathieu Marcotte

Before you start

  • Platform: iPhone and iPad devices running iOS or iPadOS that run the app.

  • Who can use this: IT administrators responsible for purchasing, deploying, and securing your organization's Apple devices.

  • Important: A Mobile Device Management (MDM) solution is not part of the app and is not required to run it. It is the recommended way to deploy, update, and secure iOS devices at scale, and the steps below explain how to set one up.

Overview

This article explains how to set up and manage iPhone and iPad devices with Mobile Device Management (MDM) so the app stays updated and secure across your organization. MDM lets you deploy devices over the air, push the app and its updates automatically, enforce security policies such as encryption and passcodes, and manage devices throughout their lifecycle. Deploying iOS devices this way reduces manual setup, keeps every device on a consistent configuration, and frees your IT team to focus on higher-value work.

Read Apple's iOS and iPadOS deployment overview for the full picture of Apple's deployment model.

Key concepts

Before you choose and configure devices, it helps to understand the main building blocks of Apple device management. The terms below appear throughout the rest of this article.

Apple Business Manager

Apple Business Manager (ABM) is the free web portal where you enroll devices, assign them to your MDM, and buy and distribute apps. In 2019, Apple combined two older programs into Apple Business Manager: the Device Enrollment Program (DEP) and the Volume Purchase Program (VPP). If you read older documentation that refers to DEP or VPP as separate portals, those functions now live inside Apple Business Manager.

Automated Device Enrollment

Automated Device Enrollment (ADE) is the part of Apple Business Manager that automatically enrolls company-owned devices into your MDM the first time they are turned on, with no manual setup. Automated Device Enrollment was previously called the Device Enrollment Program (DEP). Devices enrolled this way are placed in supervised mode and the MDM enrollment cannot be removed by the user.

Apps and Books (Volume Purchase)

Apps and Books is the section of Apple Business Manager you use to buy app licenses in volume and distribute them to your devices through your MDM. This capability was previously known as the Volume Purchase Program (VPP).

Mobile Device Management

A Mobile Device Management (MDM) solution provides over-the-air management of your devices: zero-touch setup, automatic app deployment, configuration, monitoring, and security policy enforcement. MDM solutions are available as cloud services or as software you host yourself.

Supervised vs. unsupervised devices

A device is supervised when it is prepared for deployment through Automated Device Enrollment and an MDM, or with Apple Configurator. Supervised mode gives you ongoing control over the device's configuration and access to management restrictions that are not available on unsupervised devices. When a device is supervised through Automated Device Enrollment, the user cannot remove the MDM enrollment.

Device ownership models

How you manage a device depends on who owns it and how it is used:

  • Personalized company-owned device: Owned by the organization and assigned to one employee. The employee can add personal apps and data, which stay separate from apps managed by the MDM, and typically signs in with their own Apple Account. These devices should be supervised and enrolled through Automated Device Enrollment.

  • Shared company-owned device: Owned by the organization and shared by several employees. The device runs only apps managed by the MDM, with no personalization or personal data, and does not require an Apple Account because apps are installed through device assignment. These devices should be supervised and enrolled through Automated Device Enrollment.

  • Bring Your Own Device (BYOD): Owned by the employee and configured with a personal Apple Account. To reach corporate resources or managed apps, the employee enrolls the device with your MDM. Employee-owned devices are not purchased through Apple Business Manager and are not supervised.

Step 1: Choose devices registered for Automated Device Enrollment

Buy devices that are registered for Automated Device Enrollment whenever possible. Registration links each device to your organization in Apple Business Manager, so the device enrolls in your MDM automatically the first time it is turned on and is placed in supervised mode. Without it, your deployment and management options are more limited.

Tip: Register devices for Automated Device Enrollment even if you don't plan to manage them right away. If you adopt an MDM later, the devices are already set up to enroll automatically, and you keep the flexibility without re-handling each one.

Step 2: Decide where to buy your devices

There are two ways to buy devices that are registered for Automated Device Enrollment.

Buy directly from Apple

Contact your Apple Business Team to set up a business account. Your organization receives an Apple Customer Number that identifies the devices you buy directly from Apple and links them to your Apple Business Manager account automatically.

Buy from a participating Apple Authorized Reseller

You can also buy devices from an Apple Authorized Reseller that participates in Apple's device enrollment. Confirm that the reseller participates, give them your organization's information, and ask them to add the devices you buy to your account so they appear in Apple Business Manager. You will need the reseller's Reseller ID to authorize the transfer.

If you bought your devices elsewhere

If you bought devices from a source that doesn't support automated enrollment, you can still add them manually with Apple Configurator. Connect each device by USB to a Mac running Apple Configurator and prepare it for your MDM. Learn more about Apple Configurator.

Devices added manually with Apple Configurator can be supervised, but users can remove the MDM enrollment. Only devices enrolled through Automated Device Enrollment have a non-removable enrollment.

Step 3: Set up Apple Business Manager and enroll your devices

Apple Business Manager is where you connect your devices to your MDM and manage them going forward. Sign in or enroll your organization at business.apple.com, link your MDM server, and assign your devices to it. Plan how much control you want over each group of devices before you assign them, because supervised company-owned devices and employee-owned devices are managed differently.

For full guidance, see the Apple Business Manager User Guide and the Apple Platform Deployment guide.

Step 4: Manage your devices with an MDM

Use a Mobile Device Management (MDM) solution to update, secure, track, and configure all your iOS devices from one place. With an MDM you can push the app and its updates automatically, keep iOS up to date, and enforce security policies.

The app uses Apple's standard managed app configuration, so any MDM that supports Apple Business Manager and managed app configuration works with it. You can use whichever MDM your organization already has, and no specific vendor is required. Compatible solutions include:

If you don't use an MDM

If you manage only a small number of devices and prefer not to use a full MDM, you can use Apple Configurator instead. Apple Configurator is free, runs on a Mac, and lets you configure devices over USB, though it offers fewer capabilities than an MDM and requires you to handle each device by hand. An MDM is still recommended for most deployments. Learn more about Apple Configurator.

(Optional) Step 5 - Automatically link the instance URL.

You can configure your MDM to automatically link the app to your instance using managed app configuration. That way you don't have to scan the QR code for your instance on every new iOS device — your MDM adds the link automatically, and the device skips the registration screen so end users don't set anything up manually.

This works with any MDM that supports Apple's standard managed app configuration, including Microsoft Intune, Jamf Pro, VMware Workspace ONE, and Citrix Endpoint Management. Most MDMs let you enter the configuration either as key/value pairs in their interface or by importing a plist file — use whichever your MDM supports.

App Bundle ID

You need the app's Bundle ID to target the right app when you create the managed app configuration. The Bundle ID depends on which build you use:

Build

Bundle ID

Standard release

com.poka.Poka.ios

Aveva / Teamwork

com.aveva.connect.teamwork.ios

Note: Some specialized builds use their own Bundle ID. If you're not sure which build your devices run, contact support.

Option 1 — Enter key/value

Enter the following managed configuration:

  • Key: APIBaseURL

  • Value: the base URL of your instance (if a value type is required, select String)

Your instance URL depends on your environment:

  • Standard: https://[instance_code].poka.io (for example, https://acme.poka.io)

  • Aveva / Teamwork: https://[instance_code].teamwork.poka.io (for example, https://acme.teamwork.poka.io)

When APIBaseURL is set through your MDM, the device links directly to that instance and skips the registration screen.

Option 2 — Import a plist file

Copy this plist into your MDM and replace the URL with your instance URL (add the teamwork segment if you're on the Aveva/Teamwork build):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
 <key>APIBaseURL</key>
 <string>https://[name_of_instance].poka.io</string>
</dict>
</plist>

For Intune — When creating your app configuration policy, use the Bundle ID for your build (see the table above) to target the app, then apply the key/value or plist above. Add app configuration policies for managed iOS/iPadOS devices

For JAMF — When creating a Managed Configuration for the app, use the Bundle ID for your build (see the table above) to identify the app, then apply the configuration above. Creating Managed Congifurations for Apps

Did this answer your question?