Apple School Amnager What Does Release Device Do

Apple Device Enrollment Program (DEP)

1. Last updated

2. Save as PDF

The Apple Device Enrollment Program (DEP) allows administrators to pre-provision iOS, iPadOS, and macOS devices to automatically self-enroll into Systems Manager before even touching them, and provides an additional level of management control through bulk device supervision. This greatly simplifies adding and deploying iOS, iPadOS, macOS, and tvOS devices with Automatic Device Enrollment into Meraki Systems Manager. This article will cover how to use the Apple Automatic Device Enrollment with System Manager.

For additional information on DEP, including how to qualify for the program, please review Apple's official deployment guide. Additional information can be found directly from Apple Business Manager portal or Apple School Manager portal.

The following video also outlines an example DEP configuration and deployment through Systems Manager:

With the release of iOS 11, you can now add any iOS 11+ device into an existing DEP account through Apple Configurator, even if it was not purchased from Apple or an Apple reseller. For steps on how to do this, see this article.

Linking Systems Manager to Apple DEP

In order to use the Apple DEP with Systems Manager, a Systems Manager deployment must be linked to an organization within DEP. These steps assume an Apple ID for the organization has already been created, as outlined in the Device Enrollment Program Guide. You can also use Apple Business Manager portal or Apple School Manager portal for the same functionality.

1. In Dashboard, create an EMM network for Systems Manager.
2. Navigate to Organization > Configure > MDM, then scroll down to theApple Device Enrollment Program section.
3. Download the Meraki_Apple_DEP_cert.pem file provided.
   • If someone has downloaded the .pem file previously, and the server token has expired, clickclear token in order to download the .pem file again.
4. In another browser window, go to the Apple Business Manager or Apple School Manager portal and sign in with the Apple ID tied to the desired organization.
5. Navigate to Settings > Device Management Settings
6. Click Add MDM Server.
7. Enter a Name for the MDM server in DEP, then click Next.
8. Click Choose File... and upload the .pem public key downloaded in step 3, then click Next.
9. Download the server token provided, then click Done.
10. Back in Dashboard, click on the Choose File button in the DEP section.
11. Select/upload the server token downloaded in step 9.
12. Choose the default Systems Manager network where devices tied to this MDM server in DEP will be enrolled.
13. Click Save Changes.

If you encounter an error uploading the server token to Dashboard, make sure that the file name ends in 'smime.p7m' without any trailing characters like '(1)' that may appear from downloading multiple copies of the file.

The last downloaded DEP token on the Apple portal is the only one that MDMs can sync with. You may see error "Sync failed: Unable to connect to Apple's servers at this time." or "Sync failed. Please try again later." in the event that the current token is unable to sync. The Apple portal shows the following warning if someone tries to download a token twice:

In this case, the token would need to be renewed again in order to continue syncing with Meraki Systems Manager.

Renewing a DEP Token

Apple DEP tokens last for one year by design. To continue enrolling via DEP:

1. In your Meraki Dashboard navigate to Organization > MDM and click on the Apple DEP Server you want to renew. In theEdit DEP Server window press Update Token.
   
2. Then, press download your public key cert to download theMeraki_Apple_DEP_cert.pem file.
   
3. Log in to the Apple Business Manager or Apple School Manager portal.
4. Navigate to Settings > MDM Servers > Click on the MDM server to renew ("Meraki" in the screenshot below).
   
5. Click on Edit and then click on Upload New...
   
6.  Upload theMeraki_Apple_DEP_cert.pem file and click Apply to save. Then press on Download Token to download the Meraki_Token_smime.p7m file.
   
7. Now back in your Meraki Dashboard upload theMeraki_Token_smime.p7m file to Meraki to finish updating your DEP token.
   
   After this process is finished, the token is valid for another 365 days.

If the existing DEP token is cleared or the DEP server is deleted instead of renewing the token, all associated DEP settings profiles will be removed from the Systems Manager > DEP page and will have to be re-created manually.

Importing Devices

The following steps will help you import devices into your Apple DEP server and sync them into Systems Manager.

To import devices into your Apple DEP server viaApple Order Number orSerial Number:

1. In Apple Apple Business Manager or Apple School Manager, navigate to Devices > Device Assignments
2. Choose Order Number,Serial Number, or Upload CSV file and provide the appropriate information.
3. Choose the Assign to Server action and select the desired MDM server.
4. Click Done.

To sync the devices from your Apple DEP server into System Manager, there are two ways.

1. Navigate to Systems Manager > Manage > DEP, this will cause a partial sync between System Manager and Apple DEP server.
2. If devices are missing, you can try a full sync by clicking on thefull syncbutton in the top right of the page.

Note: To be eligible, devices must have been purchased directly from Apple within the last three years, or through participating resellers and carriers. This requirement will be changing with iOS 11, which will allow users to add iOS or iPadOS devices from any purchaser into DEP. For more information regarding this and supported countries, please refer to Apple's Device Enrollment Program page.

Applying Settings to Devices

DEP settings are applied during setup assistant, either upon setting up the device for the first time, or after a factory resetfor devices already in use.

DEP Enrollment Status

There are 3 states for the 'DEP enrollment' status column. If you've just synced your devices from the DEP server into Systems Manager, they will be labeled 'Empty'.

• Empty: The default state when devices are first synced from DEP into Systems Manager. This means that the device has no DEP settings assigned to them.
• Assigned: This means new DEP settings have been assigned to the device, but not yet applied. Upon initial setup, or after a factory reset, the applied settings will take effect.
• Pushed: This means the device has its DEP settings applied. You can see information on what settings were pushed, and when, on the other columns of the table.

NOTE: DEP Push status is onlyrelated to Device Enrollment status, and does not strictly determine it.  This means that you may have devices which show their DEP payloads as 'Empty' which have already been enrolled (and therefore, have a valid link to their Device Details page in the Name column), and devices which show their DEP payloads as 'Pushed' but have yet to complete enrollment (most often because they stopped at the authentication step).

Assigning Settings

After devices have been assigned to Systems Manager via DEP, they will automatically be enrolled in the default Systems Manager network upon setup. Additional configurations such as supervising the device or skipping setup steps will further customize and streamline your deployment.

1. Navigate to Systems Manager > Manage > DEP within the Systems Manager network.
2. Click the checkbox next to any devices that require settings be applied.
3. Click Assign settings.
4. If you have existing setting presets, select them from the dropdown. Otherwise, complete the fields/selections that appear:
   • Name: A friendly name for the group of settings applied.
   • Support phone number: A number provided to users during setup if help is required.
   • Support email address: An email address provided to users during setup if help is required.
   • Department: Display the organization department the iPad is assigned to. This is displayed during setup.
   • Supervise: Supervise devices upon enrollment.  This is now required for all DEP payloads.
   • Supervising host certificate: Devices are only allowed to pair with computers that have the matching keypair.
     • Note: If left unconfigured and no pairing restriction payload is assigned, the device will have the ability to pair with any computer.
   • Allow pairing: Devices can be paired with a computer. Note that if unchecked, devices will not be able to connect to applications like Xcode or iTunes on a computer, which will limit the ability to troubleshoot or restore the device, especially in cases where it will be locked into single app mode.
     • Note: In iOS 13+, this setting has been migrated to the Restrictions profile, and should be considered deprecated on DEP payloads.
   • Mandatory: Users are required to complete enrollment during setup, and cannot skip the step.
     • Note: In iOS 13+, all devices with assigned DEP settings must go through DEP enrollment setup
   • Removable: When checked, the management profile can be removed by the user. When unchecked, the management profile cannot be removed by the user. See here for more info.
   • Skip: Allows you to specify pages during the setup process to skip, e.g. hiding the prompt to set or sign into an Apple ID. These can be completed later if needed.
   • Shared iPad: Used for shared device deployments with Apple School Manager. Do not  select this unless you have ASM provisioned with managed Apple IDs. See official Apple documentation here.
   • Await Configuration:If selected, the device will not continue in Setup Assistant until the device is configured.
     • Note: Currently, this setting is only scoped to the device receiving the 'Maximum Users' payload.
   • Maximum Users: The maximum number of users that can use a Shared iPad

1. Click Assign # device(s). You should see the 'DEP enrollment' status update to 'Assigned'.
2. In most cases, the device(s) should be factory reset at this point. This is required to ensure the device is activated and configured with DEP settings.
   1. On a Mac, restart in Recovery Mode and reinstall the operating system. On an iOS or iPadOS device, navigate toSettings > General > Reset, then tap Erase All Content and Settings.
   2. Confirm by tapping Erase.
   3. In some cases, this may be required for brand-new device as well, if Apple doesn't correctly push the DEP settings during the initial activation process.

Please chooseSet Up as New Device,or skip the "Restore from Backup" option entirely when assigning the DEP settings. Apple does not recommend restoring from iCloud, iTunes, or Migration Assistance backups if the supervision state of the device is changing. iCloud can be signed into after device setup to sync settings. Apple information related to this can be found here.

To apply configuration profiles and settings to devices, the appropriate tags will need to be applied. These can be configured in advance so that once a device enrolls, the tags configured below are automatically applied. Profiles and apps tied to those tags will then be automatically installed upon enrollment for a seamless experience.

1. Navigate to Systems Manager > Manage > DEP .
2. Click the checkbox next to any devices the tag must be applied to.
3. Click Tag.
4. Within the Add box, type the tag that should be applied to the device(s). If it is an existing tag, select it from the list. Otherwise, click Add option create a new tag. Tags must not contain spaces.
   
   
5. Click Add to apply the tag(s).

Removing Settings from Devices

In the event a device needs to be reset and managed under different conditions, the settings applied via DEP can be removed.

1. Navigate to Systems Manager > Manage > DEP.
2. Click the checkbox next to the device(s) in question.
3. Click Remove settings.

To overwrite existing settings, follow the previous steps for applying settings. Note that the newly assigned settings will not apply until the device has been factory reset.

If tags were applied to a device prior to enrollment, they can also be removed to prevent profiles and apps from associating.

1. Navigate to Systems Manager > Manage > DEP.
2. Click the checkbox next to the device(s) in question.
3. Click Tag.
4. In the Remove box, select any tags that should be removed from the device.
5. Click Remove.

Show/Hide Settings

To hide unused DEP settings presets from being displayed when applying settings, hit the 'Show/Hide settings' option and uncheck the settings you wish to hide.

Recovering DEP Devices

If a DEP-enrolled device is removed from Systems Manager, it will not automatically reappear without taking additional steps to sync Dashboard with Apple DEP.
For specific instructions on DEP device recovery, please refer to our documentation for more info.

Clearing Apple DEP Token

There are some instances where a DEP token needs to be removed to resolve an issue, or to use a different MDM server on the Apple side. To do this, navigate to theOrganization > MDM page. UnderApple Device Enrollment Program, click theClear Server Token button. This will remove the existing token and allow a new one to be uploaded.

Note:Once the DEP token has been cleared, the client drop-down menu under Systems Manager > Manage > DEP with existing DEP settings will be cleared.

It is important to note that any devices that need to be associated with the organization in Dashboard must also be assigned to the new MDM server within Apple's DEP portal. So if the MDM server is changing, the devices should also be reassigned. Avoid doing this if possible when there are a large number of devices already assigned with settings, as clearing the DEP token will purge these assigned settings in the cloud (but not on devices themselves). It is also recommended that a list of assigned devices be exported to a spreadsheet, within the Apple site, to aid in the reassignment process.

Apple School Amnager What Does Release Device Do

Source: https://documentation.meraki.com/SM/Device_Enrollment/Apple_Device_Enrollment_Program_(DEP)

Share this post