Apple provisioning overview

Cerberus Enterprise supports enrolling and managing iPhones, iPads and Macs. Apple provisioning requires an APNs certificate and can be performed using different enrollment methods.

Prerequisite: configure Apple Management (APNs)

Before enrolling any Apple device, complete Apple Management setup (APNs).

Choose an enrollment method

Manual enrollment (Enrollment Profile)

This method provides an enrollment URL and a configuration profile file (mobileconfig) that you install on the device. Read Apple manual enrollment.

Automated Device Enrollment (ADE)

This method integrates with Apple Business to automate enrollment for company-owned devices. Read Apple Automated Device Enrollment (ADE).

Account-driven enrollment (sign in with a work account)

Users enroll their iPhone, iPad or Mac by signing in with their Managed Apple Account in the device settings: User Enrollment for personal devices, Device Enrollment for company devices that aren't in Apple Business. Read Apple account-driven enrollment.

On personal iPhones and iPads enrolled with User Enrollment, the App Store apps of the policy are installed with a user license of the Managed Apple Account, which Cerberus assigns by itself; the user is asked to install each app. The Managed Apple Accounts and the Apps and Books token must belong to the same Apple Business organization. Read Apps on personal devices.

Cerberus Enterprise app on iPhone and iPad

After the enrollment, Cerberus installs its Cerberus Enterprise app on iPhones and iPads with iOS or iPadOS 18.4 or later, with or without a policy. The app shares the device location and receives notifications and live tracking requests; on personal devices (User Enrollment) it receives messages and shares the location only if the policy turns on Location and geofences on personal devices and the user allows it. It needs a one-time step: add the free app to your Apple Business library (Apps & Books → App Store, search for "Cerberus Enterprise", Add for all current and future organizational units). Supervised devices install it silently; on other devices the user is asked to install it. If the user already installed it from the App Store, the device asks to let your organization manage the app, and the app keeps its data and permissions. If the user declines, use Retry on the device page. The user can't delete the app, and it stays installed if the Apps and Books token expires. Macs don't get the app.

You can use manual enrollment and ADE in parallel, depending on your device fleet and purchasing process.