Apple Deployment Programs VI: User Enrollment

Supported Platforms

• iPhone
• iPad
• macOS

Prepare Service Discovery

With the release of iOS 18, iPadOS 18, and macOS 15, Apple has introduced a significant change in the enrollment process for User Enrollment. The system transitioned finally from the traditional profile-based enrollment to the more seamless and modern account-driven enrollment. The Account-Driven User Enrollment starts from the settings application on device, where the user have to enter their Managed Apple ID (e.g. maria.miller@imagoverum.com). Based on the domain portion, the device sends an HTTPS GET request for the URL https://<domain>/.well-known/com.apple.remotemanagement (where <domain> is the extracted domain/FQDN portion of the user identifier). This means that you must publish a file on your web server for your domain so that Apple can reach the service and retrieve enrollment information. This file contains the URL of your Silverback server and must be available for the corresponding device to be enrolled. For example, if your Managed Apple IDs are ending with imagoverum.com, you must ensure that the file is accessible at the following URL:

https://imagoverum.com/.well-known/com.apple.remotemanagement

The file contains your Silverback URL with the appendix /ssp/enrollment/byod and the Version identifier, which must be mdm-byod. 

You can download the example file here: com.apple.remotemanagement.json. After the download, open the file with an Text Editor of your choice and modify the BaseURL to your own Silverback URL and save the file. Afterwards, provide the file to your Webserver Administrator and provide the additional information that this file should have the content-type application/json. 

Create Managed Apple ID 

• Login to your Apple Business Manager or Apple School Manager
• Navigate to Users
• Press +Add 
• Enter a First Name
• Enter a Last Name
• Under Managed Apple Account, enter a username
  • We recommend to use a naming convention which will be covered with Silverback Variables, e.g. {firstname}.{lastname}@imagoverum.com
  • Enter as username e.g. maria.miller@imagoverum.com or mmiller@imagoverum.com
• Under Roles Select Staff
• Select your Location
• As Email Address use e.g. the corporate email address of the user or any other personal email address where the temporary Managed Apple ID password should be send to

• Add additional information (optional)
• Click Save

• Click Create Sign-In
• Select Send as an email 
• Click Continue
• Click Done

Grant users access to Self Service Portal

During enrollment, users are redirected to the Silverback Self Service Portal to authenticate to the system and associate the device with the identity in Silverback. This means you need to have at least the following scenarios in place:

• You have created local accounts for your users
• You have added a valid LDAP connection
• Or you are using an Identity provider

Configure Self Service Portal (optional) 

After the above mentioned authentication in the Self Service Portal, users must provide their Managed Apple ID. You can simplify the process by providing either a placeholder that displays the format users should use or you can define presets, based on System Variables.

• Login to your Silverback Management Console
• Navigate to Admin
• Navigate to Self Service Portal
• Configure either a Apple ID placeholder for the Self Service Portal, e.g. firstname.lastname@imagoverum.com
• Or define Apple ID presets, e.g. {firstname}.{lastname}@imagoverum.com
• Click Save

Device Overview

When user enrollment is complete, the device will appear as a managed device in your Silverback Management Console. The ownership will be set to Personal by default. Open the Device Information and review the available information and actions under More. You will notice that you have limited information and limited device actions. As mentioned in the introduction to this article, this is due to the privacy of personal devices. Refer to the next chapter to learn more about the restrictions. 

User Enrollment Limitations

Because User Enrollment is a modified version of the MDM protocol with a much greater focus on user privacy, implemented with a level of security that organizations and end users should feel comfortable with, User Enrollment provides a limited subset of capabilities for managing personally owned devices. This includes the following limitations: