Skip to main content

Apple manual enrollment (Enrollment Profile)

Cerberus Enterprise supports manual enrollment for Apple devices using a QR code, an enrollment URL, or an enrollment profile file.

Manual enrollment is available when Apple Management (APNs) is configured. If you have not completed APNs setup yet, read Apple Management setup (APNs).

Enrollment tokens

An enrollment token has its own Enrollment URL and QR code, and assigns these settings to the devices that enroll with it:

  • Policy: applied to the device as soon as it enrolls.
  • User: assigned to the device. Without a user in the token, the device has no user.
  • Ownership: company-owned or personally-owned. When it's not set, supervised devices are set as company-owned and the others as personally-owned;owned. devicesiPhones and iPads enrolled manually are not supervised.supervised; Macs are, so they are set as company-owned.
  • Expiration: after this day the Enrollment URL stops working. A profile downloaded before can still be installed.
  • Allowed enrollments: how many devices can enroll with the token. Leave it empty for no limit.

To create a token, open the Enrollment section in the dashboard, select the Apple manual enrollment (Enrollment Profile) tab and click New enrollment token. Set the name and the settings, then click Create token: the token page shows its Enrollment URL, QR code and the Download Enrollment Profile button.

The tokens table shows, for each token, its Status (Active, Expired or Used up), the Expiration, the Enrollments done out of the allowed ones, and Last used, the last time a device enrolled with it. Then come the Policy, the User (hover it to see the email), the Ownership and the Created date (hover it to see who created the token). The newest tokens come first, and you can sort by any column. Sort by Last used to find active tokens nobody uses anymore, and delete them so their Enrollment URL stops working. A policy or user deleted after the token was saved is shown as Deleted policy or Deleted user with a warning icon: edit the token to choose another one.

Changes to a token apply to the next enrollments: devices already enrolled keep their policy and user. When a token is deleted, expires or reaches its allowed enrollments, its Enrollment URL stops working.

Enrollment without a token

The Enrollment without a token panel of the same tab has the Enrollment URL of your organization. Devices enrolled with it get no policy and no user: assign them from the device page.

The policy and user of a device depend on how it enrolls: the token's policy and user with an enrollment token; the ADE profile's policy with Automated Device Enrollment, keeping the user assigned on the device page; no policy and no user with the enrollment URL, QR code or profile without a token (even if the device has an ADE profile). A device that enrolls again doesn't keep the policy and user of its previous enrollment: the device page shows them only if the new enrollment assigns them. Only a device erased with Return to Service enrolls again with its current policy and user.

Get the enrollment URL and profile

  • Open the token in the Apple manual enrollment (Enrollment Profile) tab of the Enrollment section, or expand Enrollment without a token.
  • Copy the Enrollment URL, or use the send-by-email action.
  • Scan the QR code shown next to the Enrollment URL with the devicecamera camera:of an iPhone or iPad: it opens the same Enrollment URL on the device. On a Mac, use the Enrollment URL or the profile file.
  • Download the Enrollment Profile (mobileconfig file).

How to enroll an iPhone or iPad

iOS/iPadOS 15.0+

First, download the enrollment profile on the device using one of the following methods:

Method 1: QR code

Open the Camera app on the device and point it at the QR code shown next to the Enrollment URL, then tap the link that appears. Safari opens the Enrollment URL and asks to allow the download of a configuration profile: tap Allow.

Method 2: Enrollment URL

Send the Enrollment URL to the user (for example with the send-by-email action) and open it in Safari on the device, then tap Allow to download the configuration profile.

Method 3: Enrollment profile file

Download the enrollment profile file (enroll.mobileconfig) and send it to the device, for example as an email attachment or with AirDrop, then open it on the device.

Then complete the enrollment on the device:

  1. On the device, open Settings → Profile Downloaded → Install, then follow the instructions.
  2. After enrollment, you can verify the status in Settings → General → VPN & Device Management (or Profiles & Device Management).

After the enrollment, iPhones and iPads with iOS or iPadOS 18.4 or later get the Cerberus Enterprise app. On a device enrolled manually (not supervised) the user is asked to install it, or to let your organization manage it when it was already installed from the App Store. If the user declines, use Retry on the device page. The app needs to be in your Apple Business library once (see Account settings).

AOn iPhone and iPad, a downloaded profile that isn't installed within 8 minutes is removed by the device. In that case, download it again.

How to enroll a Mac

 macOS 13.0+

 The QR code works only on iPhone and iPad. Download the enrollment profile on the Mac using one of the following methods:

Method 1: Enrollment URL

 Send the Enrollment URL to the user (for example with the send-by-email action) and open it in Safari on the Mac, then allow the download if asked. If the profile doesn't open by itself, open the downloaded enroll.mobileconfig file.

Method 2: Enrollment profile file

 Download the enrollment profile file (enroll.mobileconfig) and send it to the Mac, for example as an email attachment or with AirDrop, then open it on the Mac.

 Opening the profile only adds it to the downloaded profiles. Then complete the enrollment on the Mac, logged in as its main user:

  1.  Open System Settings → General → Device Management (on macOS 13 and 14: Privacy & Security → Profiles). In the Downloaded section, double-click Enrollment Profile, click Enroll (or Install) and follow the instructions. Enter the name and password of an administrator of the Mac if asked.
  2.  After enrollment, Enrollment Profile is listed in the same place. In Terminal, profiles status -type enrollment shows MDM enrollment: Yes (User Approved).

 Macs enrolled manually are supervised, and the user who installs the profile is shown in the Mac users panel of the device page. Macs don't get the Cerberus Enterprise app. If the profile is no longer in the Downloaded section, download it again.

Only install enrollment profiles that you obtained from your Cerberus Enterprise dashboard.