Manual enrollment is available when Apple Management (APNs) is configured. If you have not completed APNs setup yet, read [**Apple Management setup (APNs)**](https://enterprise.cerberusapp.com/docs/books/user-manual/page/apple-management-setup-apns "Apple Management setup (APNs)").
Users can also enroll their iPhone, iPad or Mac without a profile, by signing in with their work account in the device settings. Read [**Apple account-driven enrollment**](https://enterprise.cerberusapp.com/docs/books/user-manual/page/apple-account-driven-enrollment "Apple account-driven enrollment").
## Enrollment tokens An enrollment token has its own Enrollment URL and QR code, and assigns these settings to the devices that enroll with it: - **Policy**: applied to the device as soon as it enrolls. - **User**: assigned to the device. Without a user in the token, the device has no user. - **Ownership**: company-owned or personally-owned. When it's not set, supervised devices are set as company-owned and the others as personally-owned. iPhones and iPads enrolled manually are not supervised; Macs are, so they are set as company-owned. - **Expiration**: after this day the Enrollment URL stops working. A profile downloaded before can still be installed. - **Allowed enrollments**: how many devices can enroll with the token. Leave it empty for no limit. To create a token, open the **Enrollment** section in the dashboard, select the **Apple manual enrollment (Enrollment Profile)** tab and click **New enrollment token**. Set the name and the settings, then click **Create token**: the token page shows its Enrollment URL, QR code and the **Download Enrollment Profile** button. The tokens table shows, for each token, its **Status** (Active, Expired or Used up), the **Expiration**, the **Enrollments** done out of the allowed ones, and **Last used**, the last time a device enrolled with it. Then come the **Policy**, the **User** (hover it to see the email), the **Ownership** and the **Created** date (hover it to see who created the token). The newest tokens come first, and you can sort by any column. Sort by **Last used** to find active tokens nobody uses anymore, and delete them so their Enrollment URL stops working. A policy or user deleted after the token was saved is shown as **Deleted policy** or **Deleted user** with a warning icon: edit the token to choose another one.Changes to a token apply to the next enrollments: devices already enrolled keep their policy and user. When a token is deleted, expires or reaches its allowed enrollments, its Enrollment URL stops working.
## Enrollment without a token The **Enrollment without a token** panel of the same tab has the Enrollment URL of your organization. Devices enrolled with it get no policy and no user: assign them from the device page. The policy and user of a device depend on how it enrolls: the token's policy and user with an enrollment token; the ADE profile's policy with Automated Device Enrollment, keeping the user assigned on the device page; no policy and no user with the enrollment URL, QR code or profile without a token (even if the device has an ADE profile). A device that enrolls again doesn't keep the policy and user of its previous enrollment: the device page shows them only if the new enrollment assigns them. Only a device erased with **Return to Service** enrolls again with its current policy and user. ## Get the enrollment URL and profile - Open the token in the **Apple manual enrollment (Enrollment Profile)** tab of the **Enrollment** section, or expand **Enrollment without a token**. - Copy the **Enrollment URL**, or use the send-by-email action. - Scan the **QR code** shown next to the Enrollment URL with the camera of an iPhone or iPad: it opens the same Enrollment URL on the device. On a Mac, use the Enrollment URL or the profile file. - Download the **Enrollment Profile** (mobileconfig file). ## How to enroll an iPhone or iPad iOS/iPadOS 15.0+ First, download the enrollment profile on the device using one of the following methods: ### Method 1: QR code Open the *Camera* app on the device and point it at the QR code shown next to the Enrollment URL, then tap the link that appears. Safari opens the Enrollment URL and asks to allow the download of a configuration profile: tap *Allow*. ### Method 2: Enrollment URL Send the Enrollment URL to the user (for example with the send-by-email action) and open it in *Safari* on the device, then tap *Allow* to download the configuration profile. ### Method 3: Enrollment profile file Download the enrollment profile file (*enroll.mobileconfig*) and send it to the device, for example as an email attachment or with AirDrop, then open it on the device. Then complete the enrollment on the device: 1. On the device, open *Settings* → *Profile Downloaded* → *Install*, then follow the instructions. 2. After enrollment, you can verify the status in *Settings* → *General* → *VPN & Device Management* (or *Profiles & Device Management*).After the enrollment, iPhones and iPads with iOS or iPadOS 18.4 or later get the **Cerberus Enterprise** app. On a device enrolled manually (not supervised) the user is asked to install it, or to let your organization manage it when it was already installed from the App Store. If the user declines, use **Retry** on the device page. The app needs to be in your Apple Business library once (see **Account settings**).
On iPhone and iPad, a downloaded profile that isn't installed within 8 minutes is removed by the device. In that case, download it again.
## How to enroll a Mac macOS 13.0+ The QR code works only on iPhone and iPad. Download the enrollment profile on the Mac using one of the following methods: ### Method 1: Enrollment URL Send the Enrollment URL to the user (for example with the send-by-email action) and open it in *Safari* on the Mac, then allow the download if asked. If the profile doesn't open by itself, open the downloaded *enroll.mobileconfig* file. ### Method 2: Enrollment profile file Download the enrollment profile file (*enroll.mobileconfig*) and send it to the Mac, for example as an email attachment or with AirDrop, then open it on the Mac. Opening the profile only adds it to the downloaded profiles. Then complete the enrollment on the Mac, logged in as its main user: 1. Open *System Settings* → *General* → *Device Management* (on macOS 13 and 14: *Privacy & Security* → *Profiles*). In the *Downloaded* section, double-click *Enrollment Profile*, click *Enroll* (or *Install*) and follow the instructions. Enter the name and password of an administrator of the Mac if asked. 2. After enrollment, *Enrollment Profile* is listed in the same place. In *Terminal*, `profiles status -type enrollment` shows *MDM enrollment: Yes (User Approved)*.Macs enrolled manually are supervised, and the user who installs the profile is shown in the **Mac users** panel of the device page. Macs don't get the Cerberus Enterprise app. If the profile is no longer in the *Downloaded* section, download it again.
Only install enrollment profiles that you obtained from your Cerberus Enterprise dashboard.