Enrollment

What is MDM enrollment

In order for a device to be managed by Mosyle MDM, it first needs to be enrolled. The enrollment process involves the download and installation of an enrollment profile, either automatically or manually, which will establish secure communication between the device and the Mosyle MDM server. Once the enrollment profile is installed on the device, it is considered managed by the MDM and can receive profiles and commands.

The MDM enrollment profile can be viewed on a device at any time.

After a device is enrolled, the Mosyle MDM maintains communication using the Apple Push Notification service (APNs). Any time a command is generated or a profile is requested to be installed or removed, the MDM sends a push notification to the device via APNs to instruct the device to contact the MDM server. The device then contacts the MDM server to retrieve and act upon the command.

apn.png

Mosyle MDM Enrollment options

Mosyle supports enrollment of devices using Automated Device Enrollment, Device Enrollment, and User Enrollment. Navigate to My School > Apple Basic Setup > Enrollment to view the options available.

The top middle dropdown menu will allow you to choose between iOS/iPadOS, macOS, and tvOS to access specific enrollment information for each OS.

The options listed under Device Enrollment include Automated Device Enrollment, Apple Configurator 2 (iOS/iPadOS and tvOS) and Manual enroll via Safari (URL). Enrollment using one of these methods is recommended for devices owned by the school or district. Click each tile to view more information or configure specific enrollment settings.

User enrollment is available for user owned iOS/iPadOS and macOS devices. Click the user enrollment tile to configure specific settings.

Automated Device Enrollment

What is Automated Device Enrollment

Automated Device Enrollment provides an automated approach to enrolling devices owned by the school or district the moment they are unboxed. In order to enroll using Automated Device Enrollment, devices must exist in an Apple School Manager account and be assigned to the Mosyle MDM server. Devices purchased from Apple or an Apple Authorized Reseller or carrier can be automatically added to the Apple School Manager account. Other devices can be manually added to Apple School Manager using Apple Configurator 2 (certain restrictions apply). Click here for more information on manually adding devices to Apple School Manager.

Devices assigned to the Mosyle MDM server from Apple School Manager can be assigned to an Automated Device Enrollment profile created in Mosyle to be synced with Apple's Cloud Configuration servers. Doing this will ensure devices automatically download the enrollment profile when the devices are powered on for the first time, or erased and the OS reinstalled, and connected to the network. Different settings can be configured in the Automated Device Enrollment profile to dictate the Setup Assistant steps that will be presented when enrolling devices.

In addition to the benefit of over-the-air hands off deployment and enrollment of devices, enrolling devices using Automated Device Enrollment provides:

During Automated Device Enrollment, devices will attempt to retrieve/download the cloud configuration profile that is synced with Apple servers. In order to successfully retrieve the profile and complete enrollment it's critical the network allows for proper communication, including access to all Mosyle and Apple domains. Click here for information on which hosts and ports are required for Apple products.

enroll.png

Enrolling devices using Automated Device Enrollment

The first steps to enrolling devices into Mosyle using Automated Device Enrollment include:

  1. Integrating the Apple School Manager account with Mosyle
  2. Assigning devices in Apple School Manager to the Mosyle MDM Server
  3. Creating and syncing an Automated Enrollment profile

Steps 1 and 2 have been reviewed in previous lessons. In the next sections we'll review the many configuration options available in the Mosyle Automated Device Enrollment profile.

All Mosyle accounts include a Default enrollment profile which has basic enrollment settings configured. All devices assigned to the Mosyle MDM server will be assigned to the Default profile unless they are manually assigned to a different enrollment profile. Modify the Default profile at any time to meet the needs of the school or district.

View devices assigned to the Mosyle MDM server and their current status by going to My School > Apple Basic Setup > Enrollment > Automated Device Enrollment > View devices. The following statuses are retrieved from Apple servers and will be listed for each device:

Each status is color-coded to assist with quick identification. If needed, the devices and their current status can be exported from this screen using the “Download devices” option at the bottom of the list.

Update the list of devices and their status by clicking the “Update” button in this screen.

Tip: It's recommended to work within your Mosyle Education account while going through this section to configure the Automated Device Enrollment profiles to meet your school or district's needs.

Automated Device Enrollment configurations for iOS/iPadOS

Use the Automated Device Enrollment profile(s) to specify how the devices will behave after they're unboxed, or after Erasing all Content and Settings. Multiple enrollment profiles can be created if needed.

To start, go to My School > Apple Basic Setup > Enrollment > Automated Device Enrollment. Choose the iOS/iPadOS platform from the dropdown menu at the top. Click the Default profile to make any changes or adjustments, or create a new profile by clicking “New profile”. The Automated Device Enrollment profiles are separated into different sections. Each is addressed below.

Profile Name

Enter a name for the enrollment profile. Only Mosyle Administrators will see this information, so feel free to use a name that will help organize and identify the enrollment settings configured.

The default enrollment profile will be named the same as the Mosyle account. You can update the name at any time by clicking the profile and editing this field.

Check the options you want to activate on the device

Each new enrollment profile created in Mosyle will automatically have the default settings configured. Feel free to check any new options or uncheck options as needed.

Supervision Identity

The Supervision Identity is required in order to pair a device with a computer when the restriction “Do not allow host pairing” is applied. When the restriction is applied, devices will not be able to connect or pair with computers. By installing the Supervision Identity on the Mac, you grant permission for the device to pair with the computer. Devices will only be able to pair with computers that have the Supervision Identity certificate installed.

The options that can be configured in Mosyle include:

In most cases when pairing is required, a command from Mosyle MDM can be sent to the device to remove the restriction profile and allow host pairing. If the device loses network connectivity and is unable to receive commands from the MDM to remove the restriction profile, the Supervision Identity is useful to allow pairing access.

Devices will be used in which model?

If you choose to enroll devices to limbo and they are assigned after the enrollment, if the device is ever wiped it will automatically re-enroll in Mosyle and will automatically be reassigned to the user. If you do not want this to happen, please check the option to Return devices to assignment model selected above after wipe.

Select the location responsible for the devices

Here you can choose which of the locations in Mosyle the device should be assigned after it is enrolled. If the device will be assigned 1:1 to a user or to a Shared Device Group, the device will assume the location of the user or shared group.

Customize Setup Assistant (Available only for iOS 13+)

The options available allow you to customize the end user experience during the enrollment process. Include items such as a welcome message, an End User License Agreement Screen, and/or authentication. Each option is described in more detail below. As items are added, they can be rearranged by dragging and dropping the tile in any order desired.

*When using the options in the Custom Setup Assistant to complete device assignment (Mosyle User Authentication and Single Sign-On Authentication), be sure the Device Assignment options configured in your account are correct. To confirm, go to My School > Users > Device Assignment > User Authentication Assignment. Be sure the option under the heading 'Assignment through SSO Authentication during Automated Device Enrollment' is configured with the selection Auto-assign the device to the Authenticated user during the SSO Sign In.

Select the iOS/iPadOS devices that will receive this profile

Choose the device serial numbers to receive the enrollment profile. Assign all devices or specific devices to the enrollment profiles as needed to meet the needs of your school or district.

By default, devices that are erased and re-enrolled in Mosyle will automatically keep the user assignment. Therefore, if you wish to always enroll devices as freshly unassigned devices check the box for “Enroll devices as unassigned devices”.

Select the options that will not be presented to the user in Setup Assistant

Check any of the Setup Assistant steps you wish to skip during the enrollment. Uncheck any steps you wish to present to the user during the enrollment. Anything skipped during the enrollment can always be configured at a later time through the device Settings unless it is configured to be restricted.

It's recommended to not skip the Location Services prompt so that users will be prompted to enable Location Services during enrollment, which will ensure the device date and time is correct.

Phone & Email Support (optional)

These fields are optional. If information is entered here it will be displayed on the Remote Management screen during the enrollment as the School/District Support Email and Phone Number.

Rename devices after enrollment

Automatically rename devices during the enrollment flow using device or user variables. If users are authenticating during the enrollment and completing the device assignment, any available 1:1 variables can be used for the renaming. If prompting users to enter Tag or Asset Tag information with the Custom Setup Assistant, use the corresponding variables to rename the devices.

After configuring the Automated Device Enrollment profile for iOS/iPadOS devices, click Save. View the device list to ensure the devices show a “Profile Associated” (Enrollment > Automated Device Enrollment > View Devices). Once the devices show a “Profile Associated” they are ready to be enrolled.

iOS and iPadOS devices will prompt the enrollment process in one of two ways:

Automated Device Enrollment configurations for macOS

Use the Automated Device Enrollment profile(s) to specify how the devices will behave after they're unboxed, or after erasing and reinstalling the macOS. Multiple enrollment profiles can be created if needed.

To start, go to My School > Apple Basic Setup > Enrollment > Automated Device Enrollment. Choose the macOS platform from the dropdown menu at the top. Click the Default profile to make any changes or adjustments, or create a new profile by clicking “New profile”. The Automated Device Enrollment profiles are separated into different sections. Each is addressed below.

Profile Name

Enter a name for the enrollment profile. Only Mosyle Administrators will see this information, so feel free to use a name that will help organize and identify the enrollment settings configured.

The default enrollment profile will be named the same as the Mosyle account. You can update the name at any time by clicking the profile and editing this field.

Check the options you want to activate on the device

The following options are the same as the iOS/iPadOS configuration. Please see “Automated Device Enrollment configurations for iOS/iPadOS” for additional information.

Each new enrollment profile created in Mosyle will automatically have the default settings configured. Feel free to check any new options or uncheck options as needed.

Customize Setup Assistant (Available only for macOS 10.15+)

The options available in the Custom Setup Assistant for macOS are the same as the options for iOS/iPadOS, allowing the possibility to provide a consistent enrollment experience across all devices in the fleet. Please see “Automated Device Enrollment configurations for iOS/iPadOS” for additional information.

If using the Auto-Advance enrollment options, it's recommended to skip as many Setup Assistant steps as possible to fully leverage the Auto-Advance enrollment process.

Select the Macs that will receive this profile

Choose the device serial numbers to receive the enrollment profile. Assign all devices or specific devices to the enrollment profiles as needed to meet your organization needs.

Select the options that will not be presented to the user in Setup Assistant

Check any of the Setup Assistant steps you wish to skip during the enrollment. Uncheck any steps you wish to present to the user during the enrollment. Anything skipped during the enrollment can always be configured at a later time through the device System Settings unless it is configured to be restricted.

It's recommended to not skip the Location Services prompt so that users will be prompted to enable Location Services during enrollment, which will ensure the device date and time is correct.

Account Configuration

Define whether or not the user will be prompted to create a local user account during the Setup Assistant, and/or configure a local administrator account on the Mac using the options below.

To prompt the creation of a local user account on the Mac during the Setup Assistant, check the box for “Prompt user to create an account”. After checking the box, you'll have additional option available:

If you plan to use Mosyle Auth 2 to create user accounts, or users will be logging in using a network/mobile account or another account created outside of Setup Assistant, uncheck the box for “Prompt user to create an account”. In doing so, after downloading and installing the enrollment profile it will boot to the Login Window without requiring the user to manually create a local user account.

Since the Mac requires at least one Admin account during setup, when skipping the manual creation of a local user account you'll be required to create a managed administrator account using the option “Create additional local admin during Setup Assistant”. When creating the managed administrator account:

Phone & Email Support (optional)

These fields are optional. If information is entered here it will be displayed on the Remote Management screen during the enrollment as the School/District Support Email and Phone Number.

Rename devices after enrollment

Automatically rename devices during the enrollment flow using device or user variables. If users are authenticating during the enrollment and completing the device assignment, any available 1:1 variables can be used for the renaming. If prompting users to enter Tag or Asset Tag information with the Custom Setup Assistant, use the corresponding variables to rename the devices.

After configuring the Automated Device Enrollment profile for macOS devices, click Save. View the device list to ensure the devices show a “Profile Associated” (Enrollment > Automated Device Enrollment > View Devices). Once the devices show a “Profile Associated” they are ready to be enrolled.

macOS devices can be enrolled in the following ways:

Automated Device Enrollment configurations for tvOS

Use the Automated Device Enrollment profile(s) to specify how the devices will behave after they're unboxed, or after Erasing all Content and Settings on the Apple TV. Multiple enrollment profiles can be created if needed.

To start, go to My School > Apple Basic Setup > Enrollment > Automated Device Enrollment. Choose the tvOS platform from the dropdown menu at the top. Click the Default profile to make any changes or adjustments, or create a new profile by clicking “New profile”. The Automated Device Enrollment profiles are separated into different sections. Each is addressed below.

Profile Name

Enter a name for the enrollment profile. Only Mosyle Administrators will see this information, so feel free to use a name that will help organize and identify the enrollment settings configured.

The default enrollment profile will be named the same as the Mosyle account. You can update the name at any time by clicking the profile and editing this field.

Check the options you want to activate on the device

Devices will be used in which model?

Apple TVs can only be enrolled as Limbo devices.

Select the location responsible for the devices

Here you can choose which of the locations in Mosyle the device should be assigned after it is enrolled.

Select the Apple TVs that will receive this profile

Choose the device serial numbers to receive the enrollment profile. Assign all devices or specific devices to the enrollment profiles as needed to meet the needs of your school/district.

Select the options that will not be presented to the user in Setup Assistant

Check any of the Setup Assistant steps you wish to skip during the enrollment. Uncheck any steps you wish to present to the user during the enrollment. Anything skipped during the enrollment can always be configured at a later time through the device Settings unless it is configured to be restricted.

If using the Auto-Advance enrollment options, it's recommended to skip as many Setup Assistant steps as possible to fully leverage the Auto-Advance enrollment process.

Phone & Email Support (optional)

These fields are optional. If information is entered here it will be displayed on the Remote Management screen during the enrollment as the School/District Support Email and Phone Number.

Rename devices after enrollment

Automatically rename devices during the enrollment flow using device variables.

After configuring the Automated Device Enrollment profile for tvOS devices, click Save. View the device list to ensure the devices show a “Profile Associated” (Enrollment > Automated Device Enrollment > View Devices). Once the devices show a “Profile Associated” they are ready to be enrolled.

Apple TVs can be enrolled in the following ways:

After enrollment

Once devices are enrolled in the Mosyle account, they can be fully managed by all available and compatible configuration profiles and commands. Enrolled devices can be found under the Management tab > Devices Overview. Click the device name to bring up the Device Info window.

Device Enrollment

What is Device Enrollment

Device enrollment is available for devices that are not purchased from Apple or an Authorized Reseller or carrier and therefore are not eligible for Automated Device Enrollment. Device enrollment allows the device to be manually enrolled in the MDM using Apple Configurator 2 or by entering the enrollment URL into Safari.

Enrolling iOS/iPadOS and tvOS devices using device enrollment does not guarantee device supervision unless they are enrolled using Apple Configurator 2 and supervision is applied. Devices enrolled using device enrollment will not have the ability to lock the MDM enrollment profile, allowing end users to remove the profile at any time from the device Settings or System Settings.

During device enrollment, devices will attempt to retrieve/download the enrollment profile and the user will need to manually approve and install the profile installation. In order to successfully retrieve the profile and complete enrollment it’s critical the network allows for proper communication, including access to all Mosyle and Apple domains. Click here for information on which hosts and ports are required for Apple products.

 

 

Enrolling devices using Apple Configurator 2

To enroll iOS, iPadOS, or tvOS devices using Apple Configurator 2, the enrollment URL will need to be added to Apple Configurator 2 during the “Prepare” workflow. The enrollment URL can be found in Mosyle under My School > Apple Basic Setup > Enrollment > Apple Configurator 2.

Within the Mosyle interface a step-by-step tutorial is provided to walk through the enrollment using Apple Configurator 2. It's important to enable Supervision to get the most out of the management features and functionality available.

apple-configurator-2.png

Notes:

 

Device Enrollment using the Safari URL

To enroll iOS, iPadOS, or macOS devices manually, the enrollment URL can be entered into the Safari browser to download the MDM enrollment profile. When enrolling devices using the Safari URL, they can be enrolled as general, unassigned devices, or enrolled and assigned to a specific user. Depending on the enrollment preference, the enrollment URL can be found in Mosyle in a few areas:

Once the profile is downloaded, users will be prompted to install the enrollment profile under the device Settings or System Settings. To install the enrollment profile on Mac computers, the user must have Admin rights.

Notes:

Additional manual enrollment settings can also be configured under My School > Apple Basic Setup > Enrollment > Manual enroll via Safari (URL). The options available include:

Once devices are enrolled in the Mosyle account, they can be found under the Management tab > Devices Overview. Click the device name to bring up the Device Info window.

User Enrollment

What is User Enrollment

User Enrollment is available for devices that are not owned by the school or district, rather are personally owned devices. User Enrollment requires Managed Apple IDs to establish a user identity on the device.

With User Enrollment, organization data is separate from user data and the MDM can only access and manage certain aspects of the device. For more information about User Enrollment, visit Apple's documentation.

 

Resources

Enrolling devices using User Enrollment

To enroll iOS, iPadOS, or macOS devices using User Enrollment, the device must support User Enrollment, the user must have a Managed Apple ID, and the user must be registered, with the Managed Apple ID, in Mosyle under My School > Users.

When enrolling via User Enrollment, users will enter the enrollment URL into the Safari web browser and authenticate with their Managed Apple IDs to download and install the enrollment profile. Once the enrollment profile is installed, the Mosyle MDM will be able to communicate with and manage the device. Once enrolled, users will see the Managed Apple ID account configured in Settings > Passwords & Accounts on iOS/iPadOS devices and in System Settings on macOS devices.

To obtain the User Enrollment URL and configure additional options, go to My School > Apple Basic Setup > Enrollment > Click “Configure User Enrollment”.

Within the User Enrollment configuration area, choose the settings to best meet the needs of your school or district. To allow User Enrollment, check the box to Allow User Enrollment (BYOD).

User Enrollment screen

Customize the screen user's will see when enrolling via User Enrollment. Choose between using the Standard screen, a Personalized screen, or use your own HTML code.

URL for User Enrollment

Customize the URL user's will enter into Safari when enrolling via User Enrollment. Choose between using the Standard URL, a Premium URL, or a Custom URL.

Install Self-Service app after enroll

Choose whether or not the Mosyle Manager application will be installed on devices enrolled via User Enrollment.

Users allowed to complete User Enrollment

Allow or restrict the use of User Enrollment to specific users in the school or district.

 

Enrolling devices using Account-driven User Enrollment

Account-driven User Enrollment can be used for devices running iOS/iPadOS 15 or later. This method of User Enrollment still requires the user to have a Managed Apple ID, and the user must be registered, with the Managed Apple ID, in Mosyle under My School > Users.

When enrolling via Account-driven User Enrollment, users will go to the device Settings > General > VPN & Device Management > Click “Sign in to work or school account” > Authenticate with school/district credentials. After authenticating, the enrollment profile is downloaded and can be installed. Once the enrollment profile is installed, the Mosyle MDM will be able to communicate with and manage the device.

To enable Account-driven User Enrollment and additional options, go to My School > Apple Basic Setup > Enrollment > Under the iOS/iPadOS enrollment options, click “Configure User Enrollment”.

Using the dropdown menu at the top, select Account-driven User Enrollment and check the box to Allow Account-driven User Enrollment.

User Enrollment screen

Customize the screen user's will see when enrolling via User Enrollment. Choose between using the Standard screen, a Personalized screen, or use your own HTML code.

Well-known host

This is where the user will authenticate with school/district credentials to download the enrollment profile. Mosyle provides the option to use a Mosyle well-known endpoint and to define the unique identifier to authenticate in order to retrieve the enrollment profile. Schools/Districts can also host the well-known endpoint at their domain to which end users must authenticate.

Required App for MDM

Starting with iOS/iPadOS 15.1 and later, schools can require an application to be installed via the MDM on User Enrolled devices without first prompting for end user approval. Use this area to select a required application, such as a custom application, VPN or web filtering application.

Install Self-Service app after enroll

Choose whether or not the Mosyle Manager application will be installed on devices enrolled via User Enrollment.

Users allowed to complete User Enrollment

Allow or restrict the use of User Enrollment to specific users in the school or district.

Once devices are enrolled in the Mosyle account, they can be found under the Management tab > Devices Overview > User Enrollment tab. Click the device name to bring up the Device Info window.

Users can manually remove the MDM enrollment profile at any time through the device Settings or System Settings. In doing so, the device will be removed from the Mosyle interface.