Intro to device management
A device management service lets your IT team securely and remotely configure devices by sending configurations, profiles, and commands to the device, whether the user or your organization owns it. Capabilities include updating software and device settings, monitoring compliance with organizational policies, and remotely wiping or locking devices. Users can enroll their own devices in a device management service, and organizations can automatically enroll organization-owned devices using Apple School Manager or Apple Business.
There are a few concepts to understand if you’re going to use a device management service, so read the following sections to understand how a device management service uses enrollment profiles, configurations, and supervision.
Supported Apple devices
The following Apple devices have a built-in framework that supports device management:
iPhone with iOS 4 or later
iPad with iPadOS 13.1 or later
Mac computers with OS X 10.7 or later
Apple TV with tvOS 9 or later
Apple Watch with watchOS 10 or later
Apple Vision Pro with visionOS 1.1 or later
How devices enroll
Enrollment in a device management service involves enrolling client certificate identities using protocols such as Automated Certificate Management Environment (ACME) (recommended) or Simple Certificate Enrollment Protocol (SCEP). Devices use these protocols to create unique identity certificates for authenticating an organization’s services.
Unless enrollment is automated, users decide whether to enroll their device, and they can disassociate their devices from the service at any time. Therefore, you want to consider incentives for users to remain managed. For example, you can require enrollment for Wi-Fi network access by using the device management service to automatically provide the wireless credentials. When a user leaves the service, their device attempts to notify the device management service that it can no longer be managed.
For devices your organization owns, you can use Apple School Manager or Apple Business to automatically enroll them in a device management service and supervise them wirelessly during initial setup; this enrollment process is known as Automated Device Enrollment.
Device management and Stolen Device Protection
When Stolen Device Protection is turned on, if the user is in an unfamiliar location, the operating system delays the following actions by an hour:
Manually enrolling their device in a device management service
Manually installing a passcode profile or configuration
Configuring a Microsoft Exchange account in Settings, or with a profile or configuration
Enrollment profiles
An enrollment profile is one of two main ways users can enroll a device in a device management service (the other way is to use account-driven enrollments). With this profile, which contains a payload, the service sends commands and—if necessary—additional configuration profiles to the device. It can also query the device for information, such as its Activation Lock status, battery level, and name.
When a user removes an enrollment profile, all configurations, their settings, and managed apps based on that enrollment profile are removed with it. There can be only one enrollment profile on a device at a time.
After the enrollment profile is approved, either by the device or the user, configurations containing payloads are delivered to the device. You can then wirelessly distribute, manage, and configure apps and books purchased through Apple School Manager or Apple Business. Users can install apps, or apps can be installed automatically, depending on the type of app it is, how it’s assigned, and whether the device is supervised. See About Apple device supervision.
Configurations and legacy configuration profiles
A configuration consists of json payloads that apply settings to Apple devices and is usually created by your device management service. A legacy configuration profile can also apply settings and authorization information, but is an XML file (ending in .mobileconfig). You use your device management service or Apple Configurator for Mac to create legacy configuration profiles. For more information on using Apple Configurator for Mac to create and install legacy configuration profiles on iPhone, iPad, and Apple TV devices, see Create and edit configuration profiles in the Apple Configurator for Mac User Guide.
If your device management service supports it, you can distribute a legacy configuration profile as a mail attachment, through a link on your own webpage, or through the service’s built-in user portal. When users open the mail attachment or download the legacy configuration profile using a web browser, they receive a prompt to begin the installation.
You can deliver a configuration that can change settings for an entire device or for a single user:
Device configurations: These apply settings to the all users of a device.
iPhone, iPad, Apple TV, Apple Watch, and Apple Vision Pro devices have no way to recognize more than one user, so configurations are always applied to the device.
User configurations: These apply settings to just the respective users of a device.
Mac computers and Shared iPad can have multiple users, so you can apply settings either the device or the user. The user account that Setup Assistant creates on a Mac is considered managed by the device management service and can receive configurations. On a Mac with macOS 11 or later, an administrator account created by your device management service during enrollment can be optionally managed instead. For Active Directory–bound deployments, the current logged-in network user becomes a managed user.
Device and user settings vary according to where they reside: Settings installed at the system level reside in a device channel. Settings installed for a user reside in a user channel.
For more information about legacy configuration profile installation and Lockdown Mode, see the Apple Support article, About Lockdown Mode.
Configuration and legacy configuration profile removal
How you remove configurations and legacy configuration profiles depends on how they were installed. The following sequence indicates how you can remove a profile:
You can remove all configurations and legacy configuration profiles by wiping the device of all data.
If the device is enrolled using Automated Device Enrollment, you can choose whether the user can remove the enrollment profile, or whether only the device management service can remove it. Removing the enrollment profile also removes associated configurations and legacy configuration profiles.
The device management service can remove configurations or legacy configuration profiles it installs. The user can remove them by unenrolling from the service.
If Apple Configurator installs the legacy configuration profile, that supervising instance of Apple Configurator can remove the profile.
If Apple Configurator installs the legacy configuration profile or you install it manually on a supervised device and the profile has a removal password payload, the user needs to enter the removal password to remove the profile.
The user can remove all other legacy configuration profiles.
An account installed by a configuration or legacy configuration profile can be removed by removing the profile. A Microsoft Exchange ActiveSync account, including one installed using a configuration or legacy configuration profile, can be removed by Microsoft Exchange Server by issuing the account-only remote wipe command.
Important: If users know the device passcode, they can remove manually-installed legacy configuration profiles from iPhone and iPad devices that aren’t supervised, even if the option is set to Never. Users on Mac can do the same thing only if the user knows a local administrator’s user name and password. They can do this using System Settings or the
profilescommand-line tool.
Device management service communication requirements
You need to complete the following requirements to allow the device to communicate successfully with a device management service:
The device is powered on
The device is currently enrolled in the service
The device is able to connect to the Apple Push Notifications service (APNs)
The APNs certificate of the device management service is valid and not expired
The device is able to access service-related Apple hosts
For more information, see the Apple Support article Use Apple products on enterprise networks.
Note: Apple doesn’t control third-party device management services. Additional issues, such as misconfigured payloads, may also cause communication to fail.