Profile and Device Management on iOS is Apple’s framework for enrolling iPhones and iPads with a device management service and applying configuration profiles that control settings, restrictions, accounts, certificates, apps, and network access. The controls available depend on the enrollment method and whether the device is supervised.
According to recent statistics, there are over 1.46 billion active iPhone users globally. With the growing popularity of iOS mobile phones, businesses are increasingly providing iOS devices to their employees for work. Additionally, the rise of the BYOD (Bring Your Own Device) trend has led many employees to use their personal iOS devices for official purposes.
Companies must manage both company-owned supervised iOS devices and unsupervised BYO devices. Unlike macOS, iOS devices cannot support multiple users or Apple IDs, making it essential to utilize a Device Profile for its effective management. A device profile provides granular control to enterprises over their devices, enhancing security.
This blog will explain the concept of device profiles for iOS and the capabilities of device profiles that Scalefusion’s Apple MDM provides for iOS.
What Is Profile and Device Management for iOS?
Profile and Device Management for iOS is Apple’s built-in framework for enrolling iPhones and iPads with a device management service and applying organizational settings, restrictions, accounts, credentials, apps, and management actions. The level of control depends mainly on the enrollment method and whether the device is supervised.
In practice, iOS profile management has two distinct jobs. Enrollment establishes the management relationship between the device and the organization. After enrollment, configuration profiles and other management mechanisms define how that device should be configured.
For profile-based enrollment, Apple allows only one enrollment profile on a device at a time. Once enrollment is established, however, the management service can deliver additional configuration profiles containing payloads for settings such as Wi-Fi, VPN, passcode requirements, certificates, accounts, and restrictions.
That distinction matters because not every managed iPhone should receive the same level of control. Apple specifically designs User Enrollment for personally owned BYOD devices, where IT manages organizational accounts, settings, and data without managing the user’s personal account. Automated Device Enrollment, by contrast, is intended for organization-owned devices and provides much broader control.
Can an organization read personal data just because an iPhone is managed?
No. Apple states that device management can’t view personal calendars, contacts, mail, notes, reminders, iMessage or SMS messages, FaceTime or phone call logs, or Safari browsing history, regardless of the enrollment method.
Device Management Profile vs Configuration Profile vs MDM: What’s the Difference?
A device management profile, a configuration profile, and MDM are related, but they aren’t interchangeable terms. MDM is the management service, an enrollment profile establishes the management relationship when profile-based enrollment is used, and configuration profiles carry the settings IT wants the device to apply.
| Term | What It Is | What It Does |
|---|---|---|
| Device management / enrollment profile | The enrollment profile used in profile-based Device Enrollment | Connects the device to a device management service so the service can send commands, query supported device information, and deliver additional configuration profiles. |
| Configuration profile | An XML .mobileconfig file containing one or more payloads | Configures settings such as Wi-Fi, VPN, certificates, accounts, passcode rules, restrictions, or web filtering. |
| MDM / device management service | The server-side management platform | Enrolls devices, distributes profiles and apps, sends management commands, collects permitted device information, and maintains policies across a fleet. |
Apple permits only one enrollment profile at a time, while configuration profiles are separate management objects that can be delivered after enrollment. Removing an enrollment profile also removes the configuration profiles, settings, and managed apps associated with that enrollment.
There’s another similarly named term worth separating: a provisioning profile. Provisioning profiles belong primarily to Apple app development and code signing. They associate an app ID with certificates, entitlements, and, for some development or ad hoc workflows, registered devices. They are not a substitute for an MDM enrollment or configuration profile.
How iOS Configuration Profiles Work: Profiles, Payloads and Commands
iOS configuration management works through several layers: profiles package settings, payloads define individual configuration areas, and MDM commands tell an enrolled device to perform an action. Treating all three as a single “device profile” hides an important part of how device management for iOS actually works.
A simplified flow looks like this:
- The device is enrolled. Enrollment establishes a trusted management relationship. Apple uses device identities and certificates so the device can authenticate with organizational services.
- Configuration profiles are delivered. A configuration profile is an XML-based
.mobileconfigfile. It acts as a container for one or more payloads and can be created by a device management service, Apple Configurator, or manually where appropriate. - Payloads configure individual settings. A payload may configure a passcode policy, Exchange account, certificate, VPN, Wi-Fi connection, web content filter, restriction, or another supported setting. Each payload has rules around supported operating systems, enrollment methods, channels, supervision requirements, and whether duplicate payloads are allowed.
- MDM commands perform actions. Commands aren’t persistent configuration settings. A device management service sends them when it needs an enrolled device to do something, such as clear a passcode or perform another supported management operation. Command availability varies by platform, OS version, enrollment state, supervision, and MDM vendor support.
For administrators working directly with .mobileconfig files, identifiers matter too. On iPhone and iPad, Apple uses PayloadIdentifier values to match corresponding payloads when profiles are updated, and payload identifiers within a profile must be unique.
Modern Apple management is also broader than the traditional profile-and-command model. Declarative device management lets managed devices independently apply configurations based on defined criteria and report relevant state, rather than relying entirely on repeated server-driven commands and queries. Apple includes declarative management within its existing device-management protocol.
iOS Enrollment Methods Compared:
User Enrollment vs Device Enrollment vs Automated Device Enrollment
Apple supports three main enrollment approaches: User Enrollment, Device Enrollment, and Automated Device Enrollment (ADE). User Enrollment is the privacy-focused choice for BYOD; Device Enrollment provides broader device-level management through manual enrollment; ADE is the strongest option for organization-owned iPhones and iPads and automatically supervises the device.
| Enrollment Method | Best Fit | How It Works | Supervised on iPhone/iPad? | IT Control |
|---|---|---|---|---|
| User Enrollment | Personally owned/BYOD devices | The user enrolls with a Managed Apple Account through account-driven User Enrollment. | No | Limited to a curated set of management capabilities, with strong separation between organizational and personal data. |
| Device Enrollment | Devices requiring broader management through manual enrollment | Can be account-driven or profile-based. | No | More device information, payloads, restrictions, and commands than User Enrollment. |
| Automated Device Enrollment | Organization-owned iPhones and iPads | Device is assigned through Apple School Manager or Apple Business and enrolls during setup. | Yes | Broadest management scope, including supervised-only restrictions and the option to prevent removal of management. |
Apple currently supports account-driven User Enrollment from iOS 15, account-driven Device Enrollment from iOS 17, profile-based Device Enrollment from iOS 4, and Automated Device Enrollment from iOS 13.
User Enrollment
User Enrollment should be the default starting point for genuine BYOD deployments. Apple limits what IT can see and control, and the organization manages only the accounts, settings, and information it provisions rather than the user’s personal account.
Device Enrollment
Device Enrollment gives IT substantially more device-level authority. It can be account-driven, where the user signs in with a Managed Apple Account, or profile-based, where the user installs an enrollment profile. On iPhone and iPad, neither method makes the device supervised merely by enrolling it.
This is a poor default for privacy-sensitive BYOD when User Enrollment already meets the business requirement. Apple allows Device Enrollment to expose more device information and supports capabilities such as remotely erasing all content and settings that aren’t available through User Enrollment.
Automated Device Enrollment
Automated Device Enrollment (ADE) is the right model for most company-owned or school-owned iPhone and iPad fleets. It enrolls devices during setup, automatically supervises them, supports the full set of applicable Apple-defined payloads and restrictions, and can make MDM enrollment non-removable by the user.
What Does Supervision Mean on an iPhone or iPad?
Supervision means an iPhone or iPad is treated as an organization-owned managed device with additional administrative controls. It isn’t a separate MDM product or profile; it is a management state that unlocks restrictions and commands Apple doesn’t permit on ordinarily enrolled, unsupervised iPhones and iPads.
For scalable deployments, Automated Device Enrollment is the standard route to supervision. Apple automatically supervises iPhones running iOS 13 or later and iPads running iPadOS 13.1 or later when they enroll through ADE.
Supervision matters because it enables controls intended for devices the organization owns. Depending on OS version and MDM support, examples include managing Activation Lock, configuring Always On VPN or a global HTTP proxy, setting the device name, applying supervised-only restrictions, and placing a device into Managed Lost Mode.
Does supervision let IT spy on an iPhone? No. Apple doesn’t allow MDM to read a user’s iMessage or SMS messages, phone or FaceTime call logs, Safari history, or personal calendars, contacts, mail, notes, and reminders.
Location is also more restricted than the word “supervised” may suggest. An administrator can obtain the location of a supervised iPhone or iPad only after placing it into Managed Lost Mode. The device is visibly locked while that happens, and Apple says the user is notified when Lost Mode is turned off and the location has been collected.
What Can IT Configure With an iOS Device Profile?
An iOS device profile can configure security rules, networks, certificates, accounts, restrictions, app behavior, and other device settings. What IT can actually enforce depends on the payload, iOS or iPadOS version, enrollment method, supervision state, and capabilities supported by the organization’s device management service.
Common areas IT can configure include:
- Passcode and security policies: Require a passcode and configure supported passcode requirements to reduce unauthorized device access.
- Wi-Fi and network access: Preconfigure Wi-Fi networks and related authentication settings so users don’t have to enter network details manually.
- VPN and secure connectivity: Configure supported VPN options, including per-app VPN in appropriate deployments. Some advanced controls, such as Always On VPN, require the appropriate supervised enrollment.
- Certificates and identities: Install certificates and identities used to authenticate devices or users to organizational networks and services.
- Email and account settings: Configure supported mail, Exchange, calendar, contacts, LDAP, and other account payloads.
- Web access: Deploy web content filters and other supported network controls for managed iPhones and iPads.
- Apps and app behavior: Install and configure managed apps, control supported app-related settings, and use App Lock or Single App Mode where the deployment and supervision requirements are met.
- Device restrictions: Restrict features such as AirPrint, camera use, account changes, or other OS functionality where Apple exposes an applicable restriction. Many of the stronger restrictions require supervision.
- Interface and device configuration: Apply supported settings such as Home Screen layouts, notifications, Web Clips, and other payload-based configurations.
There’s an important technical boundary here: not every remote-management feature is part of a configuration profile. Persistent settings are normally represented by payloads or declarative configurations, while one-time actions such as clearing a passcode, remotely erasing a device, or activating Managed Lost Mode are performed through device-management commands.
That distinction makes iOS profile management easier to reason about. Profiles describe how a device should be configured; the MDM service provides the ongoing control plane needed to deploy, update, query, and act on managed devices.
Configuring iOS Device Profiles with Scalefusion Apple MDM Solution
Deploying iOS device profiles manually is a tedious task. It reduces the productivity of the IT team and consumes time. Scalefusion Apple MDM solution offers remote deployment of Profiles to iOS devices and device groups from a single dashboard.
Scalefusion offers you the following device management capabilities:
1. Single and Autonomous Single App Mode
Single App Mode (SAM) allows you to set one application to run always, which is important for supervised iOS devices deployed for kiosk usage. With Autonomous Single App Mode (ASAM), you can choose a subset of allowed applications to set themselves in single-app mode whenever they want.
ASAM is useful for scenarios when time-bound assessments, surveys, or gathering information on demand might require the applications to run in SAM for a specific duration and, once done, can be exited from that mode.
2. Content Filtering
Content Filtering allows IT admins to configure end-user access to websites. This allows you to limit access to inappropriate websites and allow access to pre-selected URLs. You can also add Web Clips to the home screen based on the visibility of allowed URLs.
3. Browser Control
Device profiles give you the flexibility to allow only certain websites to be accessible on employee iOS devices. This prevents the employees from distracting and boosts their focus. With Scalefusion’s ProSurf, you can turn your iOS devices into a specific kiosk browser to limit access to inappropriate websites.
4. Application Management
For a corporate-owned device, it is quite important to control the set of applications that the users have access to on the iOS devices. In device profiles, you can allow or block a set of applications and control app visibility on supervised iOS devices. In the case of unsupervised/BYOD devices, enterprises can only publish the required application on employee devices.
5. Passcode Policy
Passcode policy allows you to create and enforce passcode settings for device profiles and devices. This ensures employees are forced to set a passcode on the device, thereby preventing accidental data loss.
6. Certificate Management
Through certificate management, enterprises can streamline the process of deploying digital certificates to iOS devices by automatically provisioning digital identities onto them without end-user intervention and enabling authentication on managed iOS devices.
7. OS updates
IT admins can configure the rollout of iOS software updates by deferring them on supervised devices by 30 to 90 days. This setting is only available for devices with iOS 12.0 and above.
8. Network Settings
Network settings enable IT administrators to configure Wi-Fi, Bluetooth, hotspot, voice and data roaming, and eSIM on supervised devices. This feature is supported on iPhones with iOS 14 and above.
9. Email and Exchange
With email and exchange settings, you can configure your organization’s exchange policy and then push it to Scalefusion-managed iOS devices. Scalefusion supports exchange settings for Microsoft Exchange and POP/IMAP-based email servers.
10. Custom Settings
Custom payload lets you build your own policy using the Apple MDM protocol and add settings that are not built in Scalefusion. This feature allows IT admins to select a conflict resolution method in case the custom payload and device profile have the same settings.
11. Work Data Settings
Work data settings allow you to configure communication between managed and unmanaged apps and accounts. You can also enforce backups, manage external configuration profiles, and install UI configuration profiles.
12. Branding
Branding enables you to push branding elements such as your organization logo on home and/or Lock screen wallpaper and set a lock screen message on devices in your organization.
13. Managing Devices in a Profile
Once a device profile is created, you can add iOS devices to it and apply specific policies to those devices. Additionally, devices can be removed from the profile if they need to be reassigned to a different profile.
14. Other Restrictions
Scalefusion allows IT admins and organizations to configure other restrictions on Safari, iCloud, Siri, lock screen, app settings, and general settings that can be applied to multiple iOS devices instantly.
Leverage Granular Control with Scalefusion’s iOS Device Profile
Managing iOS devices is critical for security and efficiency. With device profiles for iOS, you gain comprehensive control over your iOS devices seamlessly.
Scalefusion’s iOS MDM solution simplifies the deployment and management of iOS device profiles, ensuring your organization’s iOS devices are secure and optimized for business use. Features like single-app mode, content filtering, and application management enhance operational efficiency and security.
FAQ’s
1. What is Profile and Device Management on iPhone?
Profile and Device Management on iPhone refers to Apple’s device-management framework, which allows an organization to enroll a device with an MDM service and apply configuration profiles. These profiles can configure settings, accounts, certificates, networks, apps and restrictions. Available controls depend on the enrollment method and whether the iPhone is supervised.
2. What is the difference between an MDM profile and a configuration profile on iOS?
An MDM enrollment profile connects an Apple device to a device-management service. Configuration profiles are separate XML files containing payloads that configure settings such as Wi-Fi, VPN, restrictions, certificates and accounts. One enrollment profile can exist on a device at a time, while multiple configuration profiles can be delivered after enrollment.
3. Does iPhone have a work profile like Android?
No. iPhone does not use Android’s Work Profile model. Apple separates organizational and personal data through enrollment methods such as User Enrollment and through managed apps, accounts and data-flow controls. The level of privacy and IT control depends on whether the device is personally owned, organization owned or supervised.
4. Can a device management profile be removed from an iPhone?
Sometimes. User-removable enrollment depends on the enrollment method and how the organization configured management. Organization-owned devices enrolled through Automated Device Enrollment can be configured so users cannot remove management. Removing an enrollment profile also removes configuration profiles, settings and managed apps associated with that enrollment.
5. Can multiple configuration profiles be installed on one iPhone?
Yes. Apple allows multiple configuration profiles on a device, and each profile can contain multiple payloads. Apple recommends careful planning because if multiple profiles contain the same payload with conflicting settings, the resulting behavior can be undefined. IT teams should avoid duplicate or contradictory configurations.
6. Do I need MDM to install configuration profiles on iOS?
Not always. Configuration profiles can be created and installed manually or with Apple Configurator in some scenarios. However, an MDM service is needed for scalable remote enrollment, policy updates, device commands, compliance monitoring, app distribution and ongoing management across fleets of iPhones and iPads.
