Device Provisioning - Apple

Apple provisioning overview

Cerberus Enterprise supports enrolling and managing iPhones, iPads and Macs. Apple provisioning requires an APNs certificate and can be performed using different enrollment methods.

Prerequisite: configure Apple Management (APNs)

Before enrolling any Apple device, complete Apple Management setup (APNs).

Choose an enrollment method

Manual enrollment (Enrollment Profile)

Automated Device Enrollment (ADE)

Account-driven enrollment (sign in with a work account)

On personal iPhones and iPads enrolled with User Enrollment, the App Store apps of the policy are installed with a user license of the Managed Apple Account, which Cerberus assigns by itself; the user is asked to install each app. The Managed Apple Accounts and the Apps and Books token must belong to the same Apple Business organization. Read Apps on personal devices.

Cerberus Enterprise app on iPhone and iPad

After the enrollment, Cerberus installs its Cerberus Enterprise app on iPhones and iPads with iOS or iPadOS 18.4 or later, with or without a policy. The app shares the device location and receives notifications and live tracking requests; on personal devices (User Enrollment) it receives messages and shares the location only if the policy turns on Location and geofences on personal devices and the user allows it. It needs a one-time step: add the free app to your Apple Business library (Apps & Books → App Store, search for "Cerberus Enterprise", Add for all current and future organizational units). Supervised devices install it silently; on other devices the user is asked to install it. If the user already installed it from the App Store, the device asks to let your organization manage the app, and the app keeps its data and permissions. If the user declines, use Retry on the device page. The user can't delete the app, and it stays installed if the Apps and Books token expires. Macs don't get the app.

You can use manual enrollment and ADE in parallel, depending on your device fleet and purchasing process.

Apple manual enrollment (Enrollment Profile)

Cerberus Enterprise supports manual enrollment for Apple devices using a QR code, an enrollment URL, or an enrollment profile file.

Manual enrollment is available when Apple Management (APNs) is configured. If you have not completed APNs setup yet, read Apple Management setup (APNs).

Enrollment tokens

An enrollment token has its own Enrollment URL and QR code, and assigns these settings to the devices that enroll with it:

To create a token, open the Enrollment section in the dashboard, select the Apple manual enrollment (Enrollment Profile) tab and click New enrollment token. Set the name and the settings, then click Create token: the token page shows its Enrollment URL, QR code and the Download Enrollment Profile button.

The tokens table shows, for each token, its Status (Active, Expired or Used up), the Expiration, the Enrollments done out of the allowed ones, and Last used, the last time a device enrolled with it. Then come the Policy, the User (hover it to see the email), the Ownership and the Created date (hover it to see who created the token). The newest tokens come first, and you can sort by any column. Sort by Last used to find active tokens nobody uses anymore, and delete them so their Enrollment URL stops working. A policy or user deleted after the token was saved is shown as Deleted policy or Deleted user with a warning icon: edit the token to choose another one.

Changes to a token apply to the next enrollments: devices already enrolled keep their policy and user. When a token is deleted, expires or reaches its allowed enrollments, its Enrollment URL stops working.

Enrollment without a token

The Enrollment without a token panel of the same tab has the Enrollment URL of your organization. Devices enrolled with it get no policy and no user: assign them from the device page.

The policy and user of a device depend on how it enrolls: the token's policy and user with an enrollment token; the ADE profile's policy with Automated Device Enrollment, keeping the user assigned on the device page; no policy and no user with the enrollment URL, QR code or profile without a token (even if the device has an ADE profile). A device that enrolls again doesn't keep the policy and user of its previous enrollment: the device page shows them only if the new enrollment assigns them. Only a device erased with Return to Service enrolls again with its current policy and user.

Get the enrollment URL and profile

How to enroll an iPhone or iPad

iOS/iPadOS 15.0+

First, download the enrollment profile on the device using one of the following methods:

Method 1: QR code

Open the Camera app on the device and point it at the QR code shown next to the Enrollment URL, then tap the link that appears. Safari opens the Enrollment URL and asks to allow the download of a configuration profile: tap Allow.

Method 2: Enrollment URL

Send the Enrollment URL to the user (for example with the send-by-email action) and open it in Safari on the device, then tap Allow to download the configuration profile.

Method 3: Enrollment profile file

Download the enrollment profile file (enroll.mobileconfig) and send it to the device, for example as an email attachment or with AirDrop, then open it on the device.

Then complete the enrollment on the device:

  1. On the device, open Settings → Profile Downloaded → Install, then follow the instructions.
  2. After enrollment, you can verify the status in Settings → General → VPN & Device Management (or Profiles & Device Management).

After the enrollment, iPhones and iPads with iOS or iPadOS 18.4 or later get the Cerberus Enterprise app. On a device enrolled manually (not supervised) the user is asked to install it, or to let your organization manage it when it was already installed from the App Store. If the user declines, use Retry on the device page. The app needs to be in your Apple Business library once (see Account settings).

On iPhone and iPad, a downloaded profile that isn't installed within 8 minutes is removed by the device. In that case, download it again.

How to enroll a Mac

macOS 13.0+

The QR code works only on iPhone and iPad. Download the enrollment profile on the Mac using one of the following methods:

Method 1: Enrollment URL

Send the Enrollment URL to the user (for example with the send-by-email action) and open it in Safari on the Mac, then allow the download if asked. If the profile doesn't open by itself, open the downloaded enroll.mobileconfig file.

Method 2: Enrollment profile file

Download the enrollment profile file (enroll.mobileconfig) and send it to the Mac, for example as an email attachment or with AirDrop, then open it on the Mac.

Opening the profile only adds it to the downloaded profiles. Then complete the enrollment on the Mac, logged in as its main user:

  1. Open System Settings → General → Device Management (on macOS 13 and 14: Privacy & Security → Profiles). In the Downloaded section, double-click Enrollment Profile, click Enroll (or Install) and follow the instructions. Enter the name and password of an administrator of the Mac if asked.
  2. After enrollment, Enrollment Profile is listed in the same place. In Terminal, profiles status -type enrollment shows MDM enrollment: Yes (User Approved).

Macs enrolled manually are supervised, and the user who installs the profile is shown in the Mac users panel of the device page. Macs don't get the Cerberus Enterprise app. If the profile is no longer in the Downloaded section, download it again.

Only install enrollment profiles that you obtained from your Cerberus Enterprise dashboard.

Apple Automated Device Enrollment (ADE)

Automated Device Enrollment (ADE) integrates with Apple Business (formerly Apple Business Manager) to automatically enroll company-owned iPhones, iPads and Macs when they are turned on for the first time (or after a factory reset).

ADE requires Apple Management (APNs) to be configured first. If needed, read Apple Management setup (APNs).

How to enroll devices automatically

  1. Add devices to your Apple Business account and assign them to the Cerberus Enterprise device management service: in Apple Business, open Devices → Inventory, select the devices and click Assign Device Management, or assign new devices automatically from Devices → Management Services → Default Device Assignment. See Manage device suppliers and Add devices using Apple Configurator.
  2. After adding new devices to your Apple Business account, sync them in Cerberus Enterprise from the Devices section using the Sync from Apple Business action. Synced devices use a license only once they enroll.
  3. Create an ADE profile in the dashboard from Enrollment → Apple Automated Device Enrollment (ADE) → New ADE profile.
  4. Assign an ADE profile to a device from the device details page using the ADE profile field.

After the enrollment, iPhones and iPads with iOS or iPadOS 18.4 or later get the Cerberus Enterprise app. Devices enrolled with ADE are supervised, so the app installs without asking the user; the setup doesn't wait for it. The app needs to be in your Apple Business library once (see Account settings). Macs don't get the app.

ADE profile settings (overview)

An ADE profile controls how the device is enrolled and how Setup Assistant behaves. In Cerberus Enterprise, an ADE profile includes a name, an optional initial policy, enrollment options, the Setup Assistant panes to skip, support contacts and trusted certificates.

Profile name

A human-readable name for the profile (for example, Default ADE profile).

Policy

The policy applied to the devices when they enroll with Automated Device Enrollment (Setup Assistant). Devices of the profile enrolled with the enrollment URL or QR code get the policy of their enrollment token instead, or no policy without a token. Changing only the policy keeps the profile as it is.

Enrollment options

Setup Assistant

List of ADE profiles

The list shows the name of each profile, its policy, its devices and its Id, the identifier Apple gives to the profile. A lock after the name marks a mandatory profile whose management users can't remove. No policy or Policy deleted warns that devices enrolled with the profile get no initial policy.

The Devices column counts the enrolled devices of the profile and, next to them, the devices waiting: assigned to the profile in Apple Business but not enrolled yet. Removed devices aren't counted.

Changing a profile

Apple doesn't allow changing an ADE profile. When you change one (except for the policy only), Cerberus Enterprise defines a new profile with the same name and assigns it to the devices of the old one; the old profile is no longer listed once no device uses it. Devices that already completed Setup Assistant use the new profile the next time they're erased.

A profile no device uses, enrolled or waiting, can be deleted from the list of ADE profiles. Apple doesn't allow deleting a profile, so it stays in Apple Business, unused.

After a device has an ADE profile assigned, it is ready to be automatically enrolled.

Apple account-driven enrollment

With account-driven enrollment, users enroll their iPhone, iPad or Mac by signing in with their work account (a Managed Apple Account, for example name@company.com) in the device settings. No profile to download and no QR code: Cerberus Enterprise finds the user, applies the policy and sets the ownership by itself.

Two modes

You choose the mode for iPhone and iPad and, separately, for Mac: for example User Enrollment for personal iPhones and Device Enrollment for Macs. You can change the ownership of a device later on the device page.

Account-driven enrollment is available when Apple Management (APNs) is configured. If you have not completed APNs setup yet, read Apple Management setup (APNs).

Set up Apple Business

Users sign in with Managed Apple Accounts, which are created in Apple Business. Before you start:

  1. Verify your domain (for example company.com) in Apple Business, in the domains of your organization.
  2. Create the Managed Apple Accounts of your users, or connect Apple Business to Google Workspace or Microsoft Entra ID: then the account of each user is their work e-mail address and they sign in with its password.
  3. For User Enrollment, check in the access management settings that Managed Apple Accounts can sign in on personal devices: when they can sign in only on supervised devices, User Enrollment fails.
  4. Only for the Apple Business option below: open Devices → Management Services → Default Device Assignment (Edit) and choose the Cerberus Enterprise device management service for iPhone, iPad and Mac.

Keep the Cerberus Enterprise device management service and its token in Apple Business while devices are enrolled with Managed Apple Accounts: removing them can stop the accounts from working on the devices.

Set up Cerberus Enterprise

Open the Enrollment section of the dashboard and select the Apple account sign-in tab. A checklist at the top shows what is still missing. Only administrators can change the settings.

The account typed on the device is matched with the Managed Apple Account field of the users, then with their e-mail address. The code is always sent to the e-mail address of the user. A Managed Apple Account set on a user can enroll even when its domain isn't verified in Cerberus, for example an account of the reserved org.appleid.com domain of Apple Business. With Apple Business service discovery users always type their Managed Apple Account.

Verify the domains

After you save the settings, the Domain verification section shows a TXT record for each domain. Add it to the DNS of the domain, then click Verify. DNS changes can take some time to be visible. A verified domain stays verified: you can remove the record afterwards. Users of a domain that isn't verified can't enroll.

Service discovery: how devices find Cerberus Enterprise

When a user signs in, the device asks the domain of the account (for example https://company.com) which server manages it. Set up at least one of these three options. The Service discovery section of the tab shows the discovery URL of your organization and the exact text to copy for each option.

Option 1: Apple Business (recommended)

Click Register in Apple Business: Cerberus Enterprise stores its discovery URL in your Apple Business organization and nothing has to be published on your domains. Check in Apple Business shows the URL Apple Business has now, and Remove from Apple Business removes it.

Apple Business keeps one discovery URL per organization: registering it sends every Managed Apple Account of the organization to this Cerberus Enterprise organization. Don't register it from two Cerberus Enterprise organizations that use the same Apple Business organization.

Option 2: Redirect from your web site

On the web server of each domain, redirect /.well-known/com.apple.remotemanagement to the discovery URL of your organization, keeping the query string (it carries the account typed by the user). This works with every OS version that supports account-driven enrollment, and the mode can be different for iPhone and Mac. Copy the text for Apache or nginx from the tab; it looks like this, with the key of your organization:

Apache (.htaccess or virtual host):

RewriteEngine On
RewriteRule ^\.well-known/com\.apple\.remotemanagement$ https://enterprise.cerberusapp.com/account-enroll/YOUR-KEY/discovery [R=302,L,QSA]

nginx:

location = /.well-known/com.apple.remotemanagement {
    return 302 https://enterprise.cerberusapp.com/account-enroll/YOUR-KEY/discovery$is_args$args;
}

On other web servers or services (IIS, Cloudflare, hosting control panels), create a redirect rule (302) from the same path to the discovery URL with the option that keeps or forwards the query string.

Option 3: Static file on your web site

If you can't add a redirect, publish a file at https://company.com/.well-known/com.apple.remotemanagement (no file extension), served with Content-Type: application/json. Copy its content from the tab. A static file can't choose the mode per device: it uses the same mode for iPhone, iPad and Mac. For User Enrollment it looks like this: 

{"Servers":[{"Version":"mdm-byod","BaseURL":"https://enterprise.cerberusapp.com/account-enroll/YOUR-KEY/byod"}]}

and for Device Enrollment:

{"Servers":[{"Version":"mdm-adde","BaseURL":"https://enterprise.cerberusapp.com/account-enroll/YOUR-KEY/adde"}]}

The mode of the file must also be the mode set in the tab for the device family, otherwise the enrollment is refused.

Check configuration

In Check configuration, choose a domain and a device (iPhone or Mac) and click Check: Cerberus Enterprise asks the domain what a device would ask and shows the answer, each redirect and a verdict. The domain pointing to Cerberus Enterprise means options 2 or 3 work; an error answer (such as "not found") is fine for option 1; a web page or a file pointing elsewhere stops the devices. The check also warns when a redirect drops the query string or the file isn't served as application/json.

Enrollment key

The discovery and enrollment URLs contain a key of your organization. If the URLs were published by mistake, click Regenerate key: the old URLs stop working at once, so update the redirects and static files on your web sites. Cerberus Enterprise registers the new URL in Apple Business by itself when option 1 is used.

How users enroll

  1. iPhone and iPad: open Settings → General → VPN & Device Management → Sign In to Work or School Account. Mac: System Settings → General → Device Management → Sign In (on macOS 14: Privacy & Security → Profiles → Sign In).
  2. Type the Managed Apple Account, or the work e-mail address of the user in Cerberus (for example name@company.com). When the Managed Apple Account of the user is different from what was typed, the device then asks to sign in with that account.
  3. A Cerberus Enterprise page opens: tap Send the code, then enter the 6-digit code received by e-mail. The code expires after 10 minutes; after 5 wrong codes the user must close the page and sign in again.
  4. Sign in with the password of the Managed Apple Account (or with the company's sign-in page when Apple Business is connected to Google Workspace or Microsoft Entra ID), then allow the device management.

Accounts that can't enroll (domain not verified, no matching user when users aren't created automatically, several users with the same e-mail address) see "This account isn't set up for enrollment. Contact your IT administrator." The events are in the system logs of the dashboard.

After the enrollment

Right after the enrollment, some profiles of the policy (certificates, Wi-Fi networks, web clips) can be reported as failed with an unknown error, and the device can show as Non-compliant for a while. The device tries them again by itself and they install after a while, with no action needed. Don't save the policy again or enroll the device again because of this.

Apps on personal devices

iPhones and iPads enrolled with User Enrollment have no serial number, so Apps and Books can't give them a device license. Cerberus Enterprise gives the App Store apps of their policy a user license instead: the license goes to the Managed Apple Account signed in on the device. Nothing changes in the policy: the same policy serves company and personal devices, and Cerberus chooses the license type for each device.

When Apple can't assign a license, for example because a paid app has no license left, the app shows User license failed with Apple's message. Add licenses in Apple Business, then use Request again on the device page; Cerberus also tries again by itself at the daily check. The line above the app list shows the Managed Apple Account and the status of its Apps and Books user; the same status is on the page of the user.

User licenses are used only on iPhones and iPads: on Macs enrolled with User Enrollment the App Store apps of the policy aren't installed. Books and personal Apple Accounts aren't supported.