Getting started with Apple mobile device management

Endpoint Manager MDM gives you access to additional management options for your mobile devices, such as settings and configurations, software distribution, and console actions. Some MDM enrolled devices can also be managed using the Ivanti Agent, enabling hybrid management that combines the capabilities of MDM and traditional agent-based management.

Configuring Endpoint Manager for Apple device management

1.Configure your CSA in the console. The Ivanti Cloud Services Appliance (CSA) provides secure communication and functionality over the internet. The CSA acts as a meeting place where internet or internal devices, MDM or agent-managed, can communicate with the Endpoint Manager core server. To configure your CSA, see Configuring the Ivanti Cloud Services Appliance (Management Gateway).

2.Select your CSA for MDM. To select the CSA you would like Endpoint Manager MDM to communicate with, navigate to Configure > MDM Configurations > Mobility.

3.Connect your core to your LDAP server. In addition to querying the core database, Endpoint Manager also provides the directory tool that lets you locate, access, and manage devices in other directories via LDAP. In most deployments, the LDAP configuration points to an Active Directory server. For information about configuring the connection to your LDAP server, see LDAP queries.

4.Set up credentials for using notification services. Endpoint Manager uses the Apple Push Notification Service (APNS) to communicate with Apple devices, which requires you to have an APNS certificate. For information about obtaining a certificate and enabling APNS, see Setting up notification services.

5.(Recommended) Get a certificate from a certificate authority for signing iOS profiles. If you don't sign the profiles with a certificate from a certificate authority, the user is warned that the profile is not trusted when he attempts to enroll his device. For information on setting up a certificate to sign iOS profiles, see Setting up Apple profile certificates.

6.(Recommended) Add DNS TXT records to allow iOS devices to resolve the address of the CSA. We recommend that you add DNS TXT records to allow iOS devices to resolve the address of the CSA. This makes the enrollment process much easier for users and removes the possibility for errors. For more information, see Adding DNS TXT records.

Enrolling Apple devices

Enroll DEP devices. Endpoint Manager works with Apple's Device Enrollment Program (DEP), allowing you to perform setup-free deployment of iOS, macOS, and tvOS devices. For information about enrolling in and enabling DEP, see Using Apple's Device Enrollment Program (DEP).

Enroll macOS devices. For information about enrolling macOS devices, see Enrolling Mac devices.

MacOS devices can also be concurrently managed using the Ivanti Agent. Hybrid management using both the Ivanti Agent and MDM enables extensive device management, combining agent-based management with MDM configuration enhancements. For more information, see Installing the Agent for hybrid management.

Enroll iOS devices. For information about enrolling iOS devices, see Enrolling iOS devices.

Enroll tvOS devices. Use DEP to enroll tvOS devices. For more information, see Using Apple's Device Enrollment Program (DEP).

Managing enrolled devices

Create agent settings to configure devices. Agent settings for mobile devices allow you to configure device settings and restrictions from the Endpoint Manager console. For more information about the available settings, see MDM agent settings.

Create software packages for devices. Create packages to distribute apps from the the Apple App Store or distribute .plist and .ipa files. For information on creating and distributing software packages, see Distributing content to MDM managed devices. Apple devices can also receive software purchased through Apple's Volume Purchase Program (VPP). For information about distributing VPP software, see Using a VPP Account.

Perform actions from the console. After a device is enrolled, it appears in the inventory, and you can perform actions such as locking the device or viewing the device inventory. Most of these actions are performed by right-clicking on the device in the inventory. For information about available actions, see Managing Devices.