Using Apple Automated Device Enrollment with Workspace ONE UEM

Overview

VMware Workspace ONE® UEM provides a comprehensive management solution for macOS and iOS devices, supporting macOS 10.15 and later, and iOS 11.0 and later. With the ability to manage Corporate-Dedicated, Corporate Owned or Employee Owned (BYOD) devices, Workspace ONE UEM offers enterprises the flexibility to meet their employees’ needs at any level.

Workspace ONE UEM integrates with Apple Business Manager and Apple School Manager to provide seamless management of iOS and macOS devices straight out of the box. Once configured, corporate devices can be added to Apple Business Manager at the time of purchase and automatically synced to Workspace ONE UEM, making it possible to enroll the device during activation. This ensures the device is managed before the user even logs in for the first time, providing a streamlined and more secure enrollment experience.

Apple Business Manager

Apple Business Manager is a portal where IT admins can manage Apple’s Automated Device Enrollment, Volume Purchase Program (VPP), Managed Apple IDs, and content (apps, books, etc.) distribution. Apple Business Manager provides the following three key functions:

• Automated Device Enrollment – Automates MDM enrollment and initial device setup without requiring IT admins to physically access the devices.
• Volume Purchase Program - Allows organizations to buy content (such as apps and books) in volume, assign them to devices or users, and then install and update that content wirelessly, even if the App Store is not enabled.
• Managed Apple IDs – Create unique managed Apple IDs for users within your organization.

This tutorial will focus on the functionality within Automated Device Enrollment. For information about using Apple’s Volume Purchase Program to deploy apps with Workspace ONE UEM, see Deploying a Third-Party macOS App: Workspace ONE UEM Operational Tutorial on VMware Tech Zone.

Purpose of This Tutorial

This tutorial provides an overview of the features of Apple’s Automated Device Enrollment and takes you through the steps required to integrate Automated Device Enrollment with Workspace ONE UEM. It also describes some examples of its use when managing macOS and iOS devices. This tutorial assumes that you have already signed up for Apple Business Manager and that you have a managed Apple ID. For more information on enrolling in Apple Business Manager, see Sign up for Apple Business Manager.

Audience

This operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments. 

Both current and new administrators can benefit from using this tutorial. Familiarity with macOS and iOS is assumed.

Knowledge of additional technologies such as VMware Workspace ONE® Intelligence and VMware Workspace ONE® UEM is also helpful.

Validation Environment

The content created for this operational tutorial used the following software and hardware versions for testing:

• Workspace ONE UEM version 2212 (22.12.0.8)

The content in this tutorial may apply to earlier Workspace ONE UEM and Hub versions but this was not specifically tested.

Note: Any process steps referencing Apple Business Manager were up-to-date as of the writing on this document (April 2023). Changes made by Apple to the Apple Business Manager interface after publication might not be reflected in this document.

Apple Automated Device Enrollment

Automated Device Enrollment (formerly known as Device Enrollment Program) offers IT admins a streamlined method to deploy corporate-owned Apple devices, such as iPhones, iPads, and macOS computers. Automated Device Enrollment automates mobile device management (MDM) with zero-touch enrollment and supervision, hence simplifying initial setup and configuration. Automated Device Enrollment offers IT admins the following features:

• Mandatory and lockable MDM enrollment – Automated Device Enrollment can automatically enroll Apple devices into Workspace ONE UEM ensuring that users receive all required configurations and locking the devices in MDM for ongoing management.
• Wireless supervision – Supervision offers a higher level of device management, providing additional device configurations and features, and allowing additional restrictions to be applied to devices, such as turning off iMessage, AirDrop, or Game Center.
• Zero-touch configuration – Automated Device Enrollment makes large-scale deployments of Apple devices easier with over-the-air setup and configuration, eliminating the need for staging services or physically accessing each device.
• Streamlined Setup Assistant – When using Workspace ONE UEM with Apple’s Automated Device Enrollment, IT admins can streamline the built-in Setup Assistant by specifying which screens are displayed to guide users through the activation process.

For a device to be eligible for Automated Device Enrollment, it must be purchased from one of the following channels:

• Directly from Apple
• Participating Apple Authorized Resellers
• Cellular carriers

Alternatively, you can add a device to Apple Business Manager using Apple Configurator. For instructions on how to manually add devices to Apple Business Manager with Apple Configurator, see the Apple Business Manager User Guide.

Initial setup and configuration for Automated Device Enrollment is performed in Apple Business Manager or Apple School Manager and requires your organization to be signed up for one of these two programs. The processes described in this tutorial will focus on Apple Business Manager.

Note: Automated Device Enrollment was formerly called Device Enrollment Program. Some settings within Workspace ONE UEM still refer to the function as Device Enrollment Program, or DEP. This document will use Automated Device Enrollment unless referring to a specific component within Workspace ONE UEM where Device Enrollment Program is still used within the name.

DEP Enrollment Profile

The DEP Enrollment Profile in Workspace ONE UEM manages the initial configuration of devices enrolled through Automated Device Enrollment. These configurations include authentication, MDM features, and which Setup Assistant screens are displayed to the user, as well as others. When a new device is powered on for the first time, it will download the DEP Enrollment Profile once Wi-Fi is configured.

Note: If an incorrect DEP Enrollment Profile is assigned or assignment fails, a factory reset will be required before enrollment can be again attempted.

The DEP Enrollment Profile manages six key areas of enrollment. Each of these areas is discussed further in this section.

Custom Enrollment

Custom enrollment gives admins the option to customize the user experience by allowing the injection of customized enrollment screens during the automated enrollment process in place of the traditional Apple screens. These customized screens can simplify the user experience and enforce additional security controls that might be required by your organization. Some of the options available include:

• Terms of use
• Basic authentication
• Token authentication
• Multi-factor authentication
• SAML federation to an identity provider
• Corporate branding

Note: Custom enrollment is only available on iOS 13 and later, and macOS 10.15 and later.

Authentication

The Authentication settings control whether user authentication is required during enrollment, determine device ownership, the default Device organization group, and whether a custom message is delivered to the user in the Setup Assistant’s Authentication pane. The following table describes the settings available for Authentication.

Setting	Description
Authentication	When authentication is enabled, the user will be prompted for credentials during the Setup Assistant on the device. When disabled, you will select a default staging user to be used during the enrollment process.
Device Ownership Type	This option allows you to set the ownership type for the device when it is enrolled. Three options are available to you: Corporate-Dedicated, Corporate-Shared, and Employee Owned.
Device Organization Group	With this option, you set the organization group in which your end users authenticate.
Custom Prompt	With this option turned on, you can present custom text to the user on the device authentication screen during the Setup Assistant.
Message Template	This allows you to select the message template used by the Custom Prompt. This option is only available when Custom Prompt is On.

MDM Features

This section in the DEP Enrollment Profile configures the MDM features on the devices. These settings are applied during device enrollment. The MDM features control the behavior of MDM on the device, such as whether MDM enrollment is required, if the MDM profile is locked, and whether anchor certificates are used. The following table outlines the various options available.

Setting	Description
Profile Name	The name of the profile as it appears in the UEM console.
Department	The preferred name of your department. This will appear in the About Configuration screen during setup and enrollment.
Support Number	The support contact phone number for your organization. This will appear in the About Configuration screen during setup and enrollment.
Require MDM Enrollment	When set to Enable, this option will require MDM enrollment into Workspace ONE UEM during device activation.
Supervision	Setting this option will set devices in Supervised mode. This option only applies to iOS 12.4 and earlier.
Lock MDM Profile	When enabled, end users will be prevented from removing the Workspace ONE UEM MDM profile from the device.
Anchor Certificate	Enabling this option will result in a trusted anchor certificate being uploaded to devices during DEP enrollment.
Device Pairing	When this option is enabled, devices will be allowed to sync with any workstation using iTunes or Apple Configurator. With iOS 13 and up, this option is enabled by default and cannot be disabled.
Await Configuration	You can enable this setting if you expect to send extra commands to the device before the user proceeds with the Setup Assistant. When enabled, the device will not come out of the Setup Assistant until the expected commands are sent to the device.
Auto Advance Setup	If this option is enabled, the device will automatically apply the DEP enrollment Profile and skip all Setup Assistant panes, applying the most restrictive options to the device by default.

Setup Assistant

With the DEP Enrollment Profile, you can customize the Apple Setup Assistant items seen by end users during device activation. You can tell the Setup Assistant to skip certain items, such as biometric ID setup, Siri configuration, Apple Pay, Software Update settings, and App Store ID configuration. Some items are applicable to multiple platforms (iOS, macOS, and tvOS), while others are specific to a single Apple platform. If an item is skipped, the default setting is applied to the device.

Primary User Account

The primary user account allows admins to specify how the user’s device account is configured. You can configure the type of account that is created, whether the username and full name are auto-filled, and what data is used to autofill those fields. The primary user account settings only apply to macOS devices. The following table describes the available options for the primary user account.

Note: These settings only apply if the Primary Account Setup item is not skipped in the Setup Assistant settings.

Setting	Description
Account Type	This determines the type of user account created at the end of the Setup Assistant. The options available are Standard and Administrator. Note: If Standard is selected an Admin account must be defined in the Admin Account Creation section.
Autofill	When enabled, this option will autofill the username and full name fields with the account information of the enrollment user.
Username	To automatically populate the enrollment user's organization user name, use the lookup values, such as {EmailUserName}, {EnrollmentUser}.
Full Name	To automatically populate the enrollment user's first and last name, use the default lookup values, such as {FirstName}, {LastName}.
Allow Editing	If enabled, the end user can edit the primary account during creation.

Admin Account Creation

In many cases, it might be advantageous to have a local admin account on devices that are used by support staff. This account would be different from the one used by the end user. The DEP Enrollment Profile can create an administrator on the device during enrollment. This option allows you to configure the admin username, account password, and specify if the account is hidden from the end user on the macOS device.

The following options are only available if Create New Admin Account is set to Yes.

Setting	Description
Username	In this field, you can specify the username for the admin account.
Full Name	You enter the full name of the admin account in this field.
Unique Random Password	If set to Yes, a random password is generated composed of 14 characters (at least 2 symbols, 1 lowercase, 1 uppercase, and 1 digit). Note: If this is enabled, you cannot change it back to a static password.
Password	If Unique Random Password is disabled, you can create a static password for the admin account.
Hidden	When enabled, this option will hide the admin account from the device’s end user. Hidden accounts are not visible in the Login window to end users.

Integrating Automated Device Enrollment with Workspace ONE UEM

This exercise will detail the process for integrating Automated Device Enrollment with Workspace ONE UEM. The steps are sequential and build upon one another, so make sure that you complete each step before going to the next step.

The process includes the following steps:

1. Configure the Apple Business Manager Portal.
2. Create the Automated Device Enrollment profile.

Prerequisites

Before you can perform the steps in this exercise, you must have:

• Signed up for Apple Business Manager
• A managed Apple ID

Configure the Apple Business Manager Portal

To integrate Automated Device Enrollment with Workspace ONE UEM, you need to create a virtual MDM server in Apple Business Manager to which you will link your devices. This integration will establish a trust relationship between Apple Business Manager and Workspace ONE UEM, allowing the two platforms to communicate seamlessly.

To get the desired result, perform the following steps:

1. On your desktop, double-click the Google Chrome icon.
2. Navigate to the VMware Workspace ONE UEM Console.
   
   For example, navigate to https://<WorkspaceONEUEMHostname> where WorkspaceONEUEMHostname is the host name of the Workspace ONE UEM console.
3. Enter your Username, for example, administrator.
4. Click Next. The Password text box is displayed.
5. Enter your Password, for example, VMware1!. Click Login.
   
   Note: If you see a Captcha, be aware that it is case-sensitive.
6. In the left-hand menu bar, click Groups & Settings. Then select All Settings.
7. Expand Devices & Users, then expand Apple. Select Device Enrollment Program.
8. To begin the process of configuring Automated Device Enrollment, click the Configure button.
9. Download the Public Key from your Workspace ONE instance. You do this by clicking the link called MDM_DEP_PublicKey.pem.
10. Log in to your Apple Business Manager portal. In the lower left-hand corner, click your name and select Preferences.
11. You will create a new virtual MDM server. Select MDM Server Assignment.
12. Click Add MDM Server.
13. Enter a name for the new MDM Server. For example, enter MyMDMServer.
    
     
14. Leave Allow this MDM Server to release devices checked. And upload the public key you just downloaded from Workspace ONE by clicking the Choose File button. Click Save.
15. Click the Download Token button to get the newly created token from Apple Business Manager.

Create a DEP Enrollment Profile

Before you can begin assigning devices, you need to create an enrollment profile in Workspace ONE UEM that assigns a collection of Automated Device Enrollment policies to your registered devices. These policies create a customized experience for users when enrolling their Apple devices.

The Device Enrollment Program configuration process is not only the mechanism for linking your Workspace ONE UEM instance with Apple Business Manager; it also steps you through the process of setting up your authentication options such as the default device ownership type and device organization group, the initial MDM profile and device properties, and your preferred Setup Assistant configuration.

Although there are numerous options available within the configuration process, you will only configure the default settings for this exercise. More information about each option is available by hovering over the information icon beside each option.

To get the desired result, perform the following steps:

1. In the Workspace ONE UEM console, click Groups & Settings. Then select All Settings.
2. Expand Devices & Users, then expand Apple. Select Device Enrollment Program. Click the Configure button.
3. To upload the token you retrieved from Apple Business Manager earlier in this tutorial, click the Upload button.
4. Click Choose File and navigate to the token you retrieved from Apple Business Manager. Click Save.
5. Click Next.
6. Leave the default settings on the next page and click Next.
7. Enter a name for the MDM profile. For example, enter Default Enrollment Profile.
8. Enter a Department name. For example, enter IT.
9. Enter a Support number. For example, enter 123-456-7890.
   
    
10. For this exercise, the remaining settings can be left at their respective defaults. Click Next.
11. On the next screen, you can configure which Setup Assistant options are presented to the user during device activation. For this exercise, you will leave all of the settings at default. Click Next.
12. On the Summary screen, click Save.
    
     

Managing Automated Device Enrollment Devices

Devices that are purchased directly from Apple, through a participating Apple Authorized reseller, or from a cellular carrier are eligible for Automated Device Enrollment. And, if configured correctly, will be automatically added to Apple Business Manager. To learn more about how to ensure that your instance of Apple Business Manager is configured correctly, see the Apple Business Manager User Guide.

When new devices are added to Apple Business Manager, they need to be synced with Workspace ONE UEM prior to any action being taken on them. There are also certain remote tasks that you can perform on DEP-enrolled devices. The following exercises discuss the following:

• Manually syncing devices with Apple Business Manager.
• Configuring an automatic DEP Sync.
• Remote tasks on DEP-enrolled devices
• Wiping DEP-enrolled devices

Perform a Manual Sync with Apple Business Manager

A manual sync with Apple Business Manager can be executed at any time. 

To get the desired result, perform the following steps:

1. In the Workspace ONE UEM console, click Devices. Then select Lifecycle and Enrollment Status.
2. Select the Sync Devices dropdown menu, and click Apple.
   
    
3. On the Sync Devices from Apple Enrollment Program screen, click Sync. Any newly registered devices in Apple Business Manager will be synced into Workspace ONE UEM.

Configure Automatic DEP Sync

By default, Workspace ONE UEM automatically syncs with Apple Business Manager every 24 hours. You can customize the sync schedule to meet the requirements of your organization. There are four settings used to configure the DEP Sync. The following table describes each option.

Setting	Description
Schedule Type	This setting determines the schedule type, such as Daily, Weekly, or Monthly.
Frequency	This sets the frequency of the update. You must enter a value equal to or greater than 10 minutes.
Interval Type	Enter the interval, such as hours/minutes.
Start Date/Time	Enter the start date and time for the schedule.

Note: The DEP Sync Scheduler is only accessible by a system administrator at the Global organization group level.

To get the desired result, perform the following steps:

1. In the Workspace ONE UEM console, click Groups & Settings. Then select All Settings. Expand Admin and click Scheduler.
2. Scroll through the list until you find Device Enrollment Program Update. Click the pencil icon to edit the schedule.
3. Edit the recurrence type by modifying the fields discussed in the previous table.
4. Select Save to add this schedule to the list.

Available Remote Tasks for Devices

When a device is enrolled through Automated Device Enrollment, certain additional remote tasks become available within Workspace ONE UEM. These remote tasks are only available to devices that are supervised through Apple Business Manager. The following table describes these additional tasks.

Task	Description
Device Configured	You send this command to a device that is stuck in “Awaiting Configuration” state.
iOS Updates	This task can be used to update a device or devices in bulk.
Enable/Disable Lost Mode	Lost Mode will lock the device and send a message to the lock screen. Lost mode can only be deactivated by an administrator.
Request Device Location	If a device is in Lost Mode, you can query the device location. This is applicable to supervised iOS 9.3 and up devices.

To execute these tasks, perform the following steps:

1. In the Workspace ONE UEM console, click Devices. Then select List View. Select a device from the list.
2. On the Details View, select the More Actions menu. Click one of the above-mentioned actions.

Summary and Additional Resources

This operational tutorial discussed the features and functions of Apple’s Automated Device Enrollment and provided a step-by-step guide on how to integrate Workspace ONE UEM with Apple Business Manager.

Content in this tutorial included:

• Introduction to Automated Device Enrollment
• Integrate Automated Device Enrollment with Workspace ONE UEM
• Managing Automated Device Enrollment Devices

Additional Resources

For more information about Workspace ONE, explore the VMware Workspace ONE Activity Path. The activity path provides step-by-step guidance to help you level-up in your Workspace ONE knowledge. You will find everything from beginner to advanced curated assets in the form of articles, videos, and labs.

For more information on macOS, see Understanding macOS Management.

You may also wish to read these additional operational tutorials from macOS on VMware Tech Zone.

• Configuring Basic macOS Management
• Getting Started with Freestyle Orchestrator on macOS Devices
• Managing Updates with the macOS Updater Utility
• Distributing Scripts to macOS Devices
• Deploying a Third-Party macOS App

Changelog

The following updates were made to this guide:

Date	Description of Changes
04/18/2023	Guide was published.

About the Author and Contributors

This tutorial was written by:

Michael Bradley, Senior Technical Marketing Architect, End-User-Computing Technical Marketing, VMware.

Feedback

Your feedback is valuable.

To comment on this paper, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.