Supervision for iOS devices powers IT teams with enhanced control over company-owned devices. iOS supervision is recommended for effectively managing app installation, configuring network and sharing settings, and policy enforcement on company-owned iOS devices like iPhones and iPads.
For supervising devices in bulk, Apple DEP is the practical route, because supervision happens over the air rather than by hand as it does with Apple Configurator 2. Apple renamed DEP to Automated Device Enrollment (ADE) and moved it into Apple Business; the steps below use the current screens.
It’s an excellent way to cut down operation costs for deploying devices to the field force, especially since a reset device can be enrolled into Apple MDM remotely.
With Apple DEP, devices can be supervised at the time of purchase, eliminating the need to manually supervise them and enroll them into an MDM.
Also, since the devices are supervised using their serial number, they can be reverted to the device MDM settings even after reset.
Devices qualify if they were bought from Apple or a participating reseller and appear in your Apple Business account. Apple documents the enrollment options as available from iOS and iPadOS 7 and later, and macOS 10.9 and later.
Also read: Industry Use Cases of iOS Device Management
Step-By-Step iOS Device Supervision Using Apple DEP:
You need an Apple Business account at business.apple.com, signed in with a Managed Apple Account that holds Administrator privileges. The old DEP portal at deploy.apple.com was retired on 14 January 2021, so any guide still pointing there, including earlier versions of this one, is describing screens that no longer exist.
You do not need the devices in front of you. Serial numbers are enough.
Step 1: Get the public key from your MDM
Your MDM supplies a public key certificate file, ending in .pem or .der. Apple needs it before it will authorize the link.
Step 2: Open Device Management Service Assignment
In Apple Business, select your name at the bottom of the sidebar, then Preferences, then Device Management Service Assignment.
Step 3: Add the service
Select Add, give the service a unique name, upload the public key certificate file, then save.
Step 4: Download the token and hand it back
Select Download, then Download Device Management Service Token, and upload that file to your MDM. That completes the trust in both directions: Apple has your MDM’s key, your MDM has Apple’s token.
Step 5: Assign the devices
Assign devices to the service by serial number or order number. You can download a CSV of the serial numbers assigned to a service at any point, which is the quickest way to check what is actually attached to what.
Step 6: Make it the default for future purchases
Set the service as the default assignment so devices you buy later are attached to it without anyone remembering to do it.
Step 7: Switch the device on
The device enrolls and supervises itself during Setup Assistant, and your policies apply straight away. Apple is explicit about what supervision buys you here: a supervised device cannot be unenrolled by the user. A hard reset brings the same configuration back rather than clearing it.
One maintenance note worth diarising: the token expires after a year. It also has to be replaced if you generate a new public key or a new token, or if the password changes on the account that downloaded it.
A supervised iOS device integrated with a strong MDM can improve your enterprise mobility. Supervise your company-owned iPhones and iPads with Apple DEP and enroll them to Scalefusion MDM for iOS – to offer corporate resources to your employees and enforce company policies on company-owned iOS devices.
FAQs
1. What is Apple DEP?
Apple DEP (Device Enrollment Program) was Apple’s program for deploying and managing iOS devices across an organization. It is now called Automated Device Enrollment and runs inside Apple Business. It configures and supervises devices as soon as they are turned on, with no manual step.
2. What are the benefits of using Apple DEP?
- Streamlined device deployment: Devices can be automatically configured with the desired settings and apps as soon as they are turned on.
- Enhanced security: Devices can be supervised, which gives IT administrators more control over what users can do with them.
- Reduced costs: DEP can help to save time and money by automating the deployment process.
3. How do I enroll in Apple DEP?
DEP no longer has a separate sign-up. Enrollment now happens through Apple Business at business.apple.com, using a Managed Apple Account belonging to your organization rather than a personal Apple Account.
4. How do I supervise iOS devices using Apple DEP?
Once you are enrolled in DEP, you can supervise iOS devices by adding their serial numbers to your DEP account. You then assign those devices to your device management service, which configures and manages them from that point on.
5. What are some of the things that I can do with supervised iOS devices?
With supervised iOS devices, you can: Restrict access to certain apps and features. Require users to enter a passcode, Install apps and certificates and Wipe the device remotely
