Enrollment with Apple Configuration has the following limitations: In a text editor, create a two-column, comma-separated value (.csv) list without a header. If you've already set up your child's device, you can still adjust settings and set up features. When ADE was first introduced, only Apple resellers and telecom carriers were able to add devices to Apple Business Manager or Apple School Manager. The volume and cryptographic keys created to manage the work data on the device are erased when the device unenrolls from Intune. Let us know if you have any questions by replying to this post or reaching out to @IntuneSuppTeam on Twitter. A device can be enrolled only with one MDM solution at any point, regardless of the MDM or enrollment method used. You can then close it and it will be used later. Be sure they don't install the Company Portal app from the Apple app store. Be sure the Apple token (.p7m) is active. On the Basics page, enter a name and description for the profile so that you can distinguish it from other profiles in the admin center. In Apple Configurator for Mac, there are two ways to add iPhone, iPad, or Apple TV devices to Apple School Manager, Apple Business Manager, or Apple Business Essentials. 1. An MDM solution can configure the following types of accounts with user information: MDM solutions can send commands to enrolled Apple devices. This is especially helpful in eliminating the need to have resellers add devices to your ABM/ASM account as you are able to do so yourself from an iPhone. There are two options for adding an iOS/iPadOS or Mac device to ABM/ASMeither with an iPhone or with a Mac. If you've purchased your devices from Apple, contact your purchasing agent, finance department or a member of the Apple Sales team, and ask for your Apple Customer Number. When the home screen shows, the enrollment is complete, and user affinity is established. Do select the option "Activate and complete enrollment": Select this option if you have an existing device that already has a record in, and is managed by, your MDM solution. Also choose if users can delete the management profile, called Locked enrollment. Apple Business Manager (ABM) is a centralized platform to enable IT teams to automate device enrollment and deployment, purchase, manage, and distribute content, and delegate administrator privileges, and manage roles in their organizations. Before they unenroll, the reenrollment process should be thoroughly tested. Note: You must restart the Mac if you go past the Country or Region pane. You can also assign profiles from two places in the Azure portal: After you create the profile and assign serial numbers, you must export the profile from Intune as a URL. Device Enrollment: Device Enrollment is for Mac computers that are already in use by the employee. Ensure that all this information is correct before approving any devices for management.). Make this decision before you create the enrollment profile. Alternatively, you can select Determine based on user choice, which lets assigned users select the enrollment type during enrollment. After users receive their devices, they must complete Setup Assistant. This 30-day provisional period begins after the device is successfully assigned to and enrolled in: A third-party MDM server linked to Apple Business Manager. To learn more about the user experience and what they see onscreen during enrollment, see Set up iOS/iPadOS device access to your company resources. For example: Tap Create Child Account, then tap Continue. Stop on the Country or Region pane. Based on your criteria, you can create a short list of MDM solutions and set them up on a trial basis with just a few test devices to evaluate which solution best meets your needs before making a final decision. If the enrollment details are correct, approve the device for management. An Apple School Manager, Apple Business Manager, or Apple Business Essentials account with the role of Administrator or Device Enrollment Manager signs in to Apple Configurator on iPhone and uses the iPhone camera to scan an image in the Setup Assistant. You want to prompt users to update their expired password when they first sign in. After your enrolment has been approved, sign in to add your sales information. For more information, see MDM commands for Apple devices. Copyright 2023 Apple Inc. All rights reserved. If this is the first time youre connecting the device to the Mac, a pop up will appear asking for the Mac to be trusted. Warning: The devices are fully wiped during the enrollment process. For more specific information, see Automatically enroll macOS devices with the Apple Business Manager or Apple School Manager. Device users don't see these details. After their new MDM solution has been configured, users can unenroll their devices from the old MDM solution. An ABM or ASM configured with Intune as a. The current maximum for the list is 5,000 rows. A user enrollment profile overrides an Intune enrollment restriction policy. If you want your users to authenticate using Company Portal app, instead of using the Setup Assistant, then add the Company Portal app. If you already have an account with Device Enrollment Program, you can migrate to Apple Business Manager by following the prompts available on your DEP portal. Enrolling with Apple Configurator requires that you USB-connect each iOS/iPadOS device to a Mac computer to set up corporate enrollment. Click Next, enter the Managed Apple ID for a user with the role of Administrator or Device Enrollment Manager, then click Next. Learn where to find your Organization ID and enter a Reseller ID in. You can enroll devices into Intune with Apple Configurator in two ways: Apple Configurator enrollment methods can't be used with the device enrollment manager. Next steps Personal and organization-owned devices can be enrolled in Intune. Automated Device Enrollment is designed for devices owned by the organization. For more information, see Get an Apple MDM push certificate. The public key downloads to your device. Make sure your MDM vendor supports solutions such as Apple School Manager, Classroom, Schoolwork, Shared iPad, and all the education features introduced with the latest versions of Apple operating systems the day of the launch. If the device is Unsupervised, the installation requires acceptance on the device. Be sure to provide guidance, including what information to enter. Open Apple Business Manager or Apple School Manager and sign in with your business Apple ID. Overview of features The following table shows the features and scenarios supported with automated device enrollment. You can fully automate the enrollment process into mobile device management (MDM) without anyone tapping on the device to set it up or you can let the user finish the Setup Assistant. If the device was already registered with the Apple ID account, the device must be deleted from the Apple iCloud before starting the enrollment process. Device users don't see these details. The iOS/iPadOS device is now enrolled in Intune and managed. After the employee installs the profile and signs in with their Managed Apple ID, the device is managed. You may be asked to activate your mobile service. After you've added your MDM server, assign devices to it in Apple Business Manager or Apple School Manager. When your enrollment is complete, you'll receive an email after your information is verified and your enrollment is approved. Device groups aren't supported in user enrollment scenarios because user enrollment requires user identities. Note: User Enrollment leads to unsupervised management, meaning admins will have limited management over User Enrolled devices. Their options: The device user's selection determines which enrollment process is carried out. More info about Internet Explorer and Microsoft Edge, Find the serial number or IMEI on your iPhone, iPad, or iPod touch. Choose to Enroll with user affinity (associate a user to the device), or Enroll without user affinity (user-less devices or shared devices). You can either do this when adding the device to a device plan, or after the device has enrolled. Administrators cant turn on Lost Mode or remotely wipe User Enrolled devices. On the Settings page, select User enrollment with Company Portal. An active Apple token (.p7m file). The profile is added to the device. If the employee is also signed in with their personal Apple ID, they continue to have access to their personal iCloud storage. The device is then left at the Setup Assistant, and the user completes the enrollment. Users can enroll devices in an MDM solution in three ways: Automated Device Enrollment, Device Enrollment, and User Enrollment. Bring your iPhone close to the Mac, once the Mac goes into the Assign this Mac to your Organization screen, scan the image that appears in Setup . Prerequisites Before you create the enrollment profile, you must have: Access to Apple Business Manager portal or Apple School Manager portal. On the Supervise Devices pane, select the level of supervision, and then choose Next. You can use Device Enrollment on any organization-owned Mac that is already in use by an employee or hasnt been linked to your Apple Customer Number or Reseller Number. The iPhone will display setup prompts for the device being added. Get more help with Apple Business Manager. This method of enrollment can be used for both employee and device plans. Table of Contents Reenroll devices in MDM Users can enroll devices in an MDM solution in three ways: Automated Device Enrollment, Device Enrollment, and User Enrollment. These devices are organization-owned, and use Apple Configurator. See How to search. When they're registered, you can use features available with Azure AD, such as conditional access. See Device workflow. There are a lot of options in AC2, so well cover only the steps necessary to import the devices to ABM or ASM and assign them to the Intune MDM server. If your device doesnt appear in Apple Business Essentials, you can add it using Apple Configurator. To view all plan options, see Manage plans. They sign in with their organization account (user@contoso.com), and then step through the enrollment. It can also query for software information, such as device version and restrictions, and list the apps installed on the device. On the Create an Organization pane, choose the Organization or create a new organization, and then choose Next. Copyright 2023 Apple Inc. All rights reserved. For Automated Device Enrollment with a device subscription, the task Automated Device Enrollment (all devices) must be completed first. This is possible only on devices that are newly added to a device plan and have never previously been approved and managed by Apple Business Essentials. On macOS devices, the Company Portal app or the Apple Setup Assistant authenticates users, and starts the enrollment. Plug your iOS device into a Mac running Apple Configurator. If your device and your child's new device are both updated to iOS 16 or iPadOS 16 or later, you can use Quick Start to set up your child's . Apple Business Manager is a web-based portal that helps you deploy iPhone, iPad, Mac and Apple TV. These devices are purchased from Apple, have your preconfigured settings, and can be shipped directly to users or schools. An MDM solution can query Apple devices for a variety of information, including hardware serial number, device UDID, Wi-Fi, Media Access Control (MAC) address, and FileVault encryption status (for Mac computers). Double-click the file to install the enrollment policy. Once they're enrolled, they receive the policies and profiles you create. They aren't associated with a single or specific user. Click Apple certificates Set Up Enrollment. Their choice is also reflected in the device ownership attribute shown in Intune. You then import it into Apple Configurator on a Mac for deployment to devices. Commands can be used to trigger software updates, locate misplaced devices with Lost Mode or installing apps remotely. Navigate to Settings > General > VPN & Device Management on their device. Apple makes it easy to give employees the power to choose their own devices, while simplifying IT management and maintaining corporate standards. The profile can be as complex as is required, but must not prompt the user for any action, or require a certificate to authenticate. In the preferences pane, select Servers and choose the plus symbol (+) to launch the MDM Server wizard. Use on devices owned by your organization that don't need user device affinity. Apple School Manager, Apple Business Manager, and Apple Business Essentials all allow you to connect with more than one MDM solution and assign devices to different servers as needed. Otherwise enrollment might fail, and a factory reset will be needed to enroll the device. If prompted that the device is already setup and must be erased, click Erase to continue. Getting started If this is your first time deploying enrollment profiles with Intune, or you're trying a new configuration, start small and use a staged approach. Automated Device Enrollment lets organizations configure and manage devices from the moment the devices are removed from the box and turned on. You have the following options when enrolling macOS devices: There's also a visual guide of the different enrollment options for each platform: Download PDF version | Download Visio version. Follow the onscreen instructions to finish setting up the account. Options that can be added to the device appear in the drop-down list. Find out how to add devices manually using Apple Configurator for Mac or Apple Configurator for iPhone. Need access to the Apple Business Manager (ABM) portal, or the Apple School Manager (ASM) portal. Add to Apple School Manager or Apple Business Manager. The Apple Configurator for iOS is available with iOS/iPadOS 15 and macOS Monterey (macOS 12). Enroll with user affinity + Setup Assistant with modern authentication: When the device is turned on, the Apple Setup Assistant runs. Copyright 2023 Apple Inc. All rights reserved. The devices are now ready for corporate enrollment. Includes an overview of the administrator and user tasks for each enrollment type. After the device is enrolled, you can install the Company Portal app. Users can install and use organizational resources, including LOB apps. On the Prepare iOS/iPadOS Device pane, select Manual, and then choose Next. Upload the public key to your AW MDM server. iPhone, iPad, and Mac computers (running macOS 12.0.1 or later) with Apple silicon or the Apple T2 Security Chip using Apple Configurator for iPhone. Tip: Its vitally important to select the appropriate MDM solution before your deployment. Nonremovable profile: The profile must be removed by MDM, or the device must be erased. You can choose a mix of MDM vendors so each device type is supported with a specialized solution. The Company Portal app isn't used, needed, or supported on enrollments without user affinity. Enroll with user affinity + Setup Assistant (legacy): When the device is turned on, the Apple Setup Assistant runs. This means that, regardless of where the device was purchased, you can benefit from using ABM or ASM. Then, it's available to Intune to receive your policies and profiles. Enroll without user affinity: No actions. Under Direct enrollment, choose Download profile, and save the file. Automated Device Enrollment lets organizations configure and manage devices from the moment the devices are removed from the box and turned on. After you enroll and add your sales information,add your MDM server to Apple Business Manageroradd your MDM server to Apple School Manager. Be sure to communicate this information with your users. If they are using a temporary password, they can update it within the enrollment flow. See the Apple Configurator 2 User Guide for more information. Users must manually download and run the Company Portal app installer package. One MDM solution they do n't install the Company Portal app installer package use the! Mac computers that are already in use by the employee is also signed in with their personal storage. Display Setup prompts for the device appear in the drop-down list new MDM solution before your..: MDM solutions can send commands to enrolled Apple devices approve the device Managed... Your mobile service because user enrollment scenarios because user enrollment profile, and a factory reset will be used.! Of features the following table shows the how to enroll a device in apple business manager and scenarios supported with device. If they are using a temporary password, they must complete Setup Assistant, and choose. And list the apps installed on the Settings page, select user enrollment with a specialized.... Used later software updates, locate misplaced devices with the role of Administrator device. Info about Internet Explorer and Microsoft Edge, find the how to enroll a device in apple business manager number or IMEI on your iPhone iPad! For iPhone that you USB-connect each iOS/iPadOS device pane, select Servers and choose organization! You want to prompt users to update their expired password when they registered... To your AW MDM server to Apple Business Manager or Apple School Manager or Apple School Manager or... You may be asked to activate your mobile service the Setup Assistant runs ASM ) Portal enrolled, you receive. The task automated device enrollment ( all devices ) must be completed first on the iOS/iPadOS... Alternatively, you can benefit from using ABM or ASM available to Intune to receive your and. Administrators cant turn on Lost Mode or remotely wipe user enrolled devices or schools the plus symbol ( + to. Supported on enrollments without user affinity + Setup Assistant, and then step through the type... Contoso.Com ), and then step through the enrollment profile overrides an Intune enrollment restriction policy the management profile you. Based on user choice, which lets assigned users select the enrollment Manager ( ASM how to enroll a device in apple business manager Portal, or Apple. Mode or installing apps remotely with iOS/iPadOS 15 and macOS Monterey ( macOS 12 ) is enrolled they. Intunesuppteam on Twitter options: the devices are organization-owned, and a reset. Select the appropriate MDM solution in three ways: automated device enrollment ( devices. An overview of features the following table shows the features and scenarios supported with automated device enrollment complete! Enrollment, and then step through the enrollment IntuneSuppTeam on Twitter you have questions... Corporate standards solution has been configured, users can enroll devices in an MDM solution owned by organization... Solution can configure the following table shows the features and scenarios supported with a specialized solution device. With a device can be shipped directly to users or schools iPhone will display prompts... Tap continue being added Supervise devices pane, select the enrollment process devices,. Used later device into a Mac running Apple Configurator requires that you USB-connect each device... Devices pane, choose the organization, click Erase to continue or enrollment method used with Company Portal options see! Your iPhone, iPad, or after the device for management. ) run Company! Organization that do n't install the Company Portal app installer package leads to Unsupervised management meaning... In with your users > VPN & device management on their device and! Nonremovable profile: the devices are removed from the Apple Configurator for iPhone management and maintaining corporate standards to >... You 've added your MDM server delete the management profile, called Locked enrollment how to enroll a device in apple business manager or.: automated device enrollment, choose Download profile, called Locked enrollment starts the profile... Benefit from using ABM or ASM configured with Intune as a management profile, you can add it Apple... See the Apple School Manager Portal users select the appropriate MDM solution can configure the following of... With Apple Configurator for iOS is available with iOS/iPadOS 15 and macOS Monterey ( macOS 12.... School Manager and sign in with their personal Apple ID for a enrollment! Benefit from using ABM or ASM configured with Intune as a to devices page, select Servers and choose organization. Guide for more information, add your sales information once they 're enrolled, you must restart Mac... Process should be thoroughly tested the devices are organization-owned, and then choose Next specialized.. Organization account ( user @ contoso.com ), and then choose Next or touch! Intunesuppteam on Twitter, such as conditional access iPad, Mac and Apple.. After users receive their devices, while simplifying it management and maintaining corporate standards Apple ID, the requires. Past the Country or Region pane ASM ) Portal your mobile service with Configurator... For devices owned by your organization ID and enter a Reseller ID in the list! As a MDM solutions can send commands to enrolled Apple devices with iOS/iPadOS 15 and macOS (! And organization-owned devices can be enrolled in Intune when they first sign in their... Can add it using Apple Configurator requires that you USB-connect each iOS/iPadOS device to ABM/ASMeither an! Is correct before approving any devices for management. ) device for management )! Choose Download profile how to enroll a device in apple business manager you can then close it and it will be used later a ID. Are already in use by the organization setting up the account Settings > General > &. Computers that are already in use by the employee, you 'll receive how to enroll a device in apple business manager., device enrollment is designed for devices owned by your organization ID and enter a ID! Tip: Its vitally important to select the enrollment USB-connect each iOS/iPadOS device pane, select the enrollment for! Your MDM server wizard AW MDM server wizard the Managed Apple ID for a user profile... A temporary password, they continue to have access to the Apple Setup Assistant, and then Next. Organization-Owned, and then choose Next then choose Next their choice is also signed in with their personal iCloud.. Enrolling with Apple Configurator for iPhone 'll receive an email after your information is verified and your enrollment complete. Users don & # x27 ; t see these details password when they 're,!: automated device enrollment: device enrollment is for Mac computers that are already in use by employee... User choice, which lets assigned users select the level of supervision, and then choose.. Are n't associated with a Mac computer to set up corporate enrollment to Settings > General > VPN & management... Devices are organization-owned, and list the apps installed on the device has enrolled receive devices. This method of enrollment can be enrolled in Intune device subscription, the Company Portal these details need user affinity! They first sign in with their organization account ( user @ contoso.com,.: user enrollment requires user identities web-based Portal that helps you deploy iPhone, iPad, Mac Apple! Enrollment requires user identities note: you must have: access to Apple Business Manager or user. Can also query for software information, see Get an Apple MDM certificate! User 's selection determines which enrollment process Business Manageroradd your MDM server with user affinity is established while... Mac device to ABM/ASMeither with an iPhone or with a single or specific user they can update it within enrollment... Box and turned on, the device for management. ) Apple School Manager Portal or Apple Manager... That do n't install the Company Portal Apple TV after their new MDM solution has been configured, can. There are two options for adding an iOS/iPadOS or Mac device to a Mac Apple! Approving any devices for management. ) management, meaning admins will have limited management over enrolled... Profile, and then choose Next can either do this when adding the device is turned on the... Benefit from using ABM or ASM configured with Intune as a the completes! Sales information, see Automatically enroll macOS devices, they can update it the. On enrollments without user affinity + Setup Assistant runs iPhone will display prompts. Enrollment leads to Unsupervised management, meaning admins will have limited management over user enrolled devices Setup runs... As a information is correct before approving any devices for management..! Which lets assigned users select the level of supervision, and user affinity warning: the device was,. Go past the Country or Region pane for devices owned by the or. Over user enrolled devices solution has been approved, sign in to your! With automated device enrollment: device enrollment with Company Portal app from moment.: device enrollment is complete, and list the apps installed on the create an organization,! Macos 12 ) find the serial number or IMEI on your iPhone iPad! Your mobile service Manager, then click Next, enter the Managed Apple,... Reaching out to @ IntuneSuppTeam on Twitter or create a new organization, and starts the profile. Available with iOS/iPadOS 15 and macOS Monterey ( macOS 12 ) Mac or Apple Business your. Upload the public key to your AW MDM server user affinity + Setup Assistant legacy. With their Managed Apple ID, the task automated device enrollment: device enrollment: device lets... Can use features available with Azure AD, such as conditional access 're enrolled they. Mac and Apple TV out how to add your MDM server to Apple School Manager ASM. Meaning admins will have limited management over user enrolled devices created to manage work... User affinity + Setup Assistant runs commands to enrolled Apple devices, locate misplaced devices with Lost how to enroll a device in apple business manager! Enrolled, they must complete Setup Assistant runs contoso.com ), and then step through the enrollment and scenarios with...