Management and Security

Using Apple's Device Enrollment Program (DEP)

Configure > MDM configurations > Apple Device Enrollment Program

Ivanti® Mobility Manager works with Apple's Device Enrollment Program (DEP), allowing enrolled organizations to perform setup-free deployment of iOS, macOS, and tvOS devices. By using Apples DEP, you can associate devices purchased through Apple and Apple resellers with Ivanti® Mobility Manager and automatically apply policies during the initial device setup.

To participate in Apple DEP with Mobility Manager you need the following:

DEP-enrolled Apple IDs

iOS 8.0+ devices purchased directly through Apple

OSX 10.10+ Mac devices purchased directly through Apple

CAUTION: You cannot apply DEP policies to devices purchased prior to completing this process. Only devices purchased after set up with the enrolled administrator Apple ID will function as intended.

To enable DEP with Mobility Manager

1.Ensure your CSA and mobility settings are fully configured. DEP requires the CSA, Apple Push Notification Sevice, and iOS profile certificates to function. To configure your CSA, see Configuring the Ivanti Cloud Services Appliance (Management Gateway). To configure the Apple Push Notification Service, see Setting up notification services. To configure iOS profile certificates, see Setting up Apple profile certificates.

2.Enroll in the Apple Device Enrollment Program. You must enroll an Apple ID with Apple Business Manager to utilize Apple's DEP. Apple Business Manager is replacing Apple Deployment. If you already have an Apple Deployment account, you can migrate your account to Apple Business Manager. For more information, see Apple's migration guide.

3.Add Mobility Manager as an MDM server. This process associates Mobility Manager as an MDM with the Apple DEP.

4.Configure DEP settings. You can determine which steps of the first-time setup users will see on the device, as well as what level of management you will enforce.

5.Add devices to the program. Devices must be purchased directly from Apple using a DEP enrolled administrator Apple ID. Once purchased, add them to the Apple Deployment web console to enable policy change distribution through Mobility Manager.

6.Perform initial device setup. During initial setup, the user connects to a Wi-Fi network and enters corporate credentials to enable management by Mobility Manager. The device will skip any setup screens selected in Mobility Manager.

ClosedAdd Mobility Manager as an MDM server

To begin using DEP, you must have an account enrolled in Apple's Device Enrollment Program. After enrolling your account, you can add Mobility Manager as an approved MDM server.

1.Navigate to Configure > MDM configurations > Apple Device Enrollment Program.

2.Click Add.

3.Enter a DEP Token Alias. (For example, MDMServer.)

4.Click the Create Public Key button and name your public key file.

5.Click the button to go to either Apple Business or Apple Deployment, depending on what kind of account you have.

6.Click Device Enrollment Program > Manage Servers.

7.Click Add MDM Server.

8.Enter a name for the server.

9.Click Choose File to upload the public key file you downloaded from Mobility Manager.

10.Download the newly generated server token, and then click Done.

11.In the Add Apple DEP Token window in the Management Console, click Browse to upload the server token you downloaded from Apple.

Enrollment is enabled and you can now configure DEP settings and assign devices to the Mobility Manager server from the Apple Deployment Programs console.

ClosedConfigure DEP settings

After integrating Mobility Manager with Apple DEP, you can manage the initial setup of iOS, macOS, and tvOS devices. This allows you to skip the setup of key features, and allows you to enable supervisor mode to limit the capabilities of users.

1.Navigate to Configure > MDM configurations > Apple Device Enrollment Program.

2.Select an alias and click Edit.

3.For each OS, select any configuration options and setup items to skip during the initial device setup. Users will not encounter any screens selected in this window.

4.If you are managing macOS devices, you can create an administrator account on the device and select what type of account the user will create.

5.In the General section, you can enter the information for your support organization and select if the user will be required to provide credentials as part of enrollment.

6.Click OK to save the changes.

Any devices purchased with this Apple DEP token are automatically configured and enrolled using these settings.

ClosedAdd devices to manage

Use the Apple Deployment Programs console to add devices to the Mobility Manager server by serial number or order number.

1.From the Apple DEP web page, click Manage Devices.

2.Select if you will add devices using serial numbers or order numbers.

3.Enter the serial numbers or order numbers for the devices.

4.Under Choose Action, select Assign to Server from the drop-down menu.

5.Select your MDM server.

6.Click OK.

All devices associated with the serial numbers or order numbers entered will perform the DEP setup as configured in Mobility Manager.

ClosedSet up DEP devices

Devices configured with Apple DEP still require some individual setup during their initial launch. With DEP, this differs from the standard first-time launch of an iOS device where a user would set up the device as their own. These devices skip any setup screens you selected, and automatically enroll in Mobility Manager.

1.After powering on the device, begin the setup.

2.Select a nationality and language.

3.Connect to a Wi-Fi network.

An alert appears to indicate that the device will be managed by Ivanti.

4.Log in using corporate credentials, such as those used for Active Directory.

5.Continue through the remaining setup. This will depend on which screens you selected to skip.

The device is enrolled with Mobility Manager and receives any policies associated with the user account or device.

Was this article useful?    

The topic was:



Not what I expected