Skip to main content

Apple Automated Device Enrollment (ADE)

Automated Device Enrollment (ADE) integrates with Apple Business (formerly Apple Business Manager) to automatically enroll company-owned iPhones, iPads and Macs when they are turned on for the first time (or after a factory reset).

ADE requires Apple Management (APNs) to be configured first. If needed, read Apple Management setup (APNs).

How to enroll devices automatically

  1. Add devices to your Apple Business account and assign them to the Cerberus Enterprise device management service: in Apple Business, open Devices → Inventory, select the devices and click Assign Device Management, or assign new devices automatically from Devices → Management Services → Default Device Assignment. See Manage device suppliers and Add devices using Apple Configurator.
  2. After adding new devices to your Apple Business account, sync them in Cerberus Enterprise from the Devices section using the Sync from Apple Business action. Synced devices use a license only once they enroll.
  3. Create an ADE profile in the dashboard from Enrollment → Apple Automated Device Enrollment (ADE) → New ADE profile.
  4. Assign an ADE profile to a device from the device details page using the ADE profile field.

After the enrollment, iPhones and iPads with iOS or iPadOS 18.4 or later get the Cerberus Enterprise app. Devices enrolled with ADE are supervised, so the app installs without asking the user; the setup doesn't wait for it. The app needs to be in your Apple Business library once (see Account settings). Macs don't get the app.

ADE profile settings (overview)

An ADE profile controls how the device is enrolled and how Setup Assistant behaves. In Cerberus Enterprise, an ADE profile includes a name, an optional initial policy, enrollment options, the Setup Assistant panes to skip, support contacts and trusted certificates.

Profile name

A human-readable name for the profile (for example, Default ADE profile).

Policy

The policy applied to the devices when they enroll with Automated Device Enrollment (Setup Assistant). Devices of the profile enrolled with the enrollment URL or QR code get the policy of their enrollment token instead, or no policy without a token. Changing only the policy keeps the profile as it is.

Enrollment options

  • MDM removable: controls whether the MDM payload can be removed from the device.
  • Allow pairing: controls whether pairing is allowed (deprecated by Apple in iOS 13).
  • Auto-advance setup: automatically advances Setup Assistant through its screens (Mac with macOS 11 or later and Apple TV).
  • Await device configured: Setup Assistant waits until the policy of the ADE profile is applied, so that users start with its apps and settings in place. Cerberus Enterprise then lets the device continue, at the latest 4 minutes after the enrollment.
  • Mandatory: prevents skipping profile application during setup.
  • Multi user (Shared iPad): configures the device for Shared iPad.
  • Supervised: requests supervision for the device.

Setup Assistant

  • Department, Support phone and Support email (optional): sent to Apple with the profile. The device may not show them.
  • Panes to skip: Setup Assistant doesn't show the selected panes (for example Apple Account, Siri or Screen Time). Each device shows only the panes of its system (some, such as FileVault or iCloud Documents and Desktop, exist only on Macs); Skip all and Show all select or clear them all.
  • Apple TV: language and region for Apple TV with auto-advance setup.
  • Trusted certificates: only needed if the server uses a certificate that devices don't trust, for example from a private CA. Import the certificate in the Certificates page first.

List of ADE profiles

The list shows the name of each profile, its policy, its devices and its Id, the identifier Apple gives to the profile. A lock after the name marks a mandatory profile whose management users can't remove. No policy or Policy deleted warns that devices enrolled with the profile get no initial policy.

The Devices column counts the enrolled devices of the profile and, next to them, the devices waiting: assigned to the profile in Apple Business but not enrolled yet. Removed devices aren't counted.

Changing a profile

Apple doesn't allow changing an ADE profile. When you change one (except for the policy only), Cerberus Enterprise defines a new profile with the same name and assigns it to the devices of the old one; the old profile is no longer listed once no device uses it. Devices that already completed Setup Assistant use the new profile the next time they're erased.

A profile no device uses, enrolled or waiting, can be deleted from the list of ADE profiles. Apple doesn't allow deleting a profile, so it stays in Apple Business, unused.

After a device has an ADE profile assigned, it is ready to be automatically enrolled.