Management and Security

Using Apple's Device Enrollment Program (DEP)

Configure > MDM configurations > Apple Device Enrollment Program

Ivanti® Mobility Manager works with Apple's Device Enrollment Program (DEP), allowing enrolled organizations to perform setup-free deployment of iOS, macOS, and tvOS devices. By using Apple's DEP, you can associate devices purchased through Apple and Apple resellers with Ivanti® Mobility Manager and automatically apply policies during the initial device setup.

CAUTION: You cannot apply DEP policies to devices purchased prior to completing this process. Only devices purchased after set up with the enrolled administrator Apple ID will function as intended.

DEP integration requirements

Ensure your CSA and mobility settings are fully configured. DEP requires the CSA, APNS, and iOS profile certificates to function. For information about configuring these, see Getting started with Apple mobile device management.

Enroll in the Apple Device Enrollment Program. You must enroll an Apple ID with Apple Business Manager to utilize Apple's DEP. To enroll, visit the Apple Device Enrollment Program site.

To enable DEP integration with Mobility Manager

ClosedAdd Mobility Manager as an MDM server. This process associates Mobility Manager as an MDM with the Apple DEP.

1.Navigate to Configure > MDM configurations > Apple Device Enrollment Program.

2.Click Add.

3.Enter a DEP Token Alias. (For example, MDMServer.)

4.Click the Create Public Key button and name your public key file.

5.Click the button to go to either Apple Business or Apple Deployment, depending on what kind of account you have.

6.Click Device Enrollment Program > Manage Servers.

7.Click Add MDM Server.

8.Enter a name for the server.

9.Click Choose File to upload the public key file you downloaded from Mobility Manager.

10.Download the newly generated server token, and then click Done.

11.In the Add Apple DEP Token window in the Management Console, click Browse to upload the server token you downloaded from Apple.

Enrollment is enabled and you can now configure DEP settings and assign devices to the Mobility Manager server from the Apple Deployment Programs console.

ClosedConfigure DEP settings. You can determine which steps of the first-time setup users will see on the device, as well as what level of management you will enforce.

1.Navigate to Configure > MDM configurations > Apple Device Enrollment Program.

2.Select an alias and click Edit.

3.For each OS, select any configuration options and setup items to skip during the initial device setup. Users will not encounter any screens selected in this window.

4.If you are managing macOS devices, you can create an administrator account on the device and select what type of account the user will create.

5.In the General section, you can enter the information for your support organization and select if the user will be required to provide credentials as part of enrollment.

6.Click OK to save the changes.

Any devices purchased with this Apple DEP token are automatically configured and enrolled using these settings.

ClosedAdd devices to the program. Devices must be purchased directly from Apple using a DEP enrolled administrator Apple ID. Once purchased, add them to the Apple Deployment web console to enable policy change distribution through Mobility Manager.

1.From the Apple DEP web page, click Manage Devices.

2.Select if you will add devices using serial numbers or order numbers.

3.Enter the serial numbers or order numbers for the devices.

4.Under Choose Action, select Assign to Server from the drop-down menu.

5.Select your MDM server.

6.Click OK.

All devices associated with the serial numbers or order numbers entered will perform the DEP setup as configured in Mobility Manager.

ClosedPre-configure devices Use Mobility Manager to assign devices profiles and software, which they will receive the first time they are started.

1.In the network view of the management console, click Configuration.

2.Right-click Automatic Enrollment Devices > Add Devices.

3.Select your server token. Any unconfigured devices associated with the token appear in the table.

4.(Optional) Select a naming template to apply to the devices or create a new one.

5.(Optional) Select a group to add the devices to.

6.Click OK.

The devices appear in the network view. You can schedule policy deployments to these devices.

ClosedPerform initial device setup. During initial setup, the user connects to a Wi-Fi network and enters corporate credentials to enable management by Mobility Manager. The device will skip any setup screens selected in Mobility Manager.

1.After powering on the device, begin the setup.

2.Select a nationality and language.

3.Connect to a Wi-Fi network. An alert appears to indicate that the device will be managed by Ivanti.

4.Log in using corporate credentials, such as those used for Active Directory.

5.Continue through the remaining setup. This will depend on which screens you selected to skip.

The device is enrolled with Mobility Manager and receives any policies associated with the user account or device.


Was this article useful?