Jump to:navigation, search
Wiki































De.png
En.png
Fr.png






Device enrollment with the macOS-App using DEP - Apple Device Enrollment Program
Last adaptation to the version: 1.24
New:
Last updated: 
03.2024
notempty
This article refers to a Resellerpreview
Access: portal.securepoint.cloud  Mobile Security iOS/iPadOS

Informations

  • Devices can be assigned to an MDM with the help of the Device Enrollment Program
    • When ordering with the DEP option at appropriate Apple dealers, the serial or order number is sufficient (Zero-Touch, suitable for larger quantities)
    • afterwards using the Apple Configurator
      (For this the device must be connected to a MAC)
  • Profiles assigned to devices with DEP can no longer be removed on the device itself after a waiting period of 30 days, but only through the Securepoint Mobile Security Portal!
  • DEP is a prerequisite for rolling out centrally purchased and licensed software to devices via VPP (Volume Purchase Program).





























Requirements

The following requirements are necessary:


MSP v1.5.3 Infos DEP-Token-en.png

Establish connection to DEP (Device Enrollment Program)

Um Apples DEP (Device Enrollment Program) nutzen zu können, muss eine Verknüpfung des Securepoint Mobile Security Portals mit dem Apple DEP hergestellt werden.

The connection is done in three steps at  Mobile Security Settings Apple DEP  Add profile
1. download the Apple push certificate (*.pem file)
2. upload this certificate in the Apple Business Manager or Apple School Manager menu Settings

  •  ABM: If no corresponding MDM server has been created yet:
  •  ABM: Menu Settings/ Organization Settings / ABM Einstellungen Geräteverwaltung Icon.PNG Device Management Settings / ABM MDM-Server Icon.PNG] Add MDM server
  •  ABM: MDM Server Name Unique name
  •  ABM: MDM Server Settings Select File: Upload the .*.pem file previously downloaded from the Securepoint Mobile Security Portal and Secure
  •  ABM: Selection of the corresponding MDM Server ABM Einstellungen MDM-Server Icon.PNG ttt-point-mdm-Server-123456.sms
  •  ABM: Download the dep token ABM Token Icon.PNG Load token (*.p7m file) in the Apple Business Manager or Apple School Manager in the menu

3. upload the *.p7m file in the dial window opened under point 1 in the Securepoint Mobile Security Portal. Finish with  Done

notempty
DEP tokens have a term of 12 months and must be updated regularly!


Problem / Error message Cause Solution
DEP token has become invalid
  • The account of the Aple Business Manager or Apple School Manager user who created the token is locked or deleted.
  • The ABM/ASM user who created the token has changed his/her password
Renew DEP token with a valid account
Message when logging in to https://portal.securepoint.cloud :
Check your Apple business account
We retrieved an error while fetching your data from Apple
This could happen due to updated software license agreements.
Please check your apple business account, for further information.
Apple has changed its T&Cs. Login to Apple Business Manager or Apple School Manager and confirm the new terms and conditions.

Prepare devices

Prepare new devices

  • New devices must be purchased directly from Apple or a DEP registered dealer.
  • The serial number of the devices is then stored at Apple for DEP.
  • Devices can be sent directly to the device user.
  • When the device is initialized, the MDM information and configuration are automatically loaded.
  • These devices cannot be supplied with WiFi configurations by the factory.
    If the devices do not have a mobile data connection via mobile radio, the user must therefore provide an Internet connection himself once.
  • Prepare existing / used devices

    In order to add existing devices to the DEP at a later date, they must be connected to a MAC and prepared with the Apple Configurator 2.
    The device will be completely reset. All stored information will be lost!

    • Connect the iPhone / iPad to the Mac and trust access through the Apple Configurator 2.
      Select device with mouse click and configure by pressing the button MAC Einstellungen.png Prepare.
    • Selecting an MDM server
    • Login to the device registration program with the credentials for the ABM
    • Create or assign an organization that manages the device.
    • Configuring the iOS Installation Wizard
    • Enter the credentials for automatic registration
      (at the Securepoint Mobile Security Portal).
    • Start preparation



    All devices (new devices as well as existing / used devices) must be added to the DEP in Apple Business Manager (ABM) or Apple School Manager (ASM).

    Add devices to the DEP

    • Login to Apple Business Manager or Apple School Manager with the registered credentials.
    • Opening the Device Assignments menu
    • Devices must be assigned to an MDM server in Apple Business Manager or Apple School Manager
    1. select devices
    • The serial number, the order number or a csv file with serial numbers for one or more devices is specified here.
    2. select action
    • Section perform action
    • Click on Select ActionLink=
      • Server zuweisenLink=
    • Section: MDM Server
      • Click on select MDM serverLink=
      • Select the desired MDM serverLink=
    • With a click on the button Done the device is assigned to the server.

    DEP devices in the Mobile Security Portal

    Devices that have been added to the Device Enrollment Program (DEP) with the Apple Business Manager (ABM) or Apple School Manager (ASM) can be recognized in the Securepoint Mobile Security Portal by the abbreviation DEP in the first line of the device tile.

    With the connection to DEP it is possible to use the Apple Volume Purchase Program (VPP).
    Further notes in the article for Apple VPP Apps.


















































    Login to the portal

    The device is now displayed in the portal with the status not configured. The enrollment must be completed by clicking on the device tile.

    Device Alias

    For better identification, the device should be given an alias name:
    a0a0 (4-digit ID) (in the upper part of the device tile)

    Ownership Selection

    There are two different installation options for the Securepoint Mobile Security App, which result in significant differences in administration:

    Owner 'COPE The following functions are additionally available in the device administration in the Mobile Security Portal:
      Localize notempty
    Only available if the device has been registered in supervised mode.

    at: Operations     Enable Lost Mode
      Clear password at: Operations
      Wipe Data at: Operations  : Deletion of personal data

      Applications Monitoring of installed apps, installation, deinstallation
    Owner BYOD Standard functional range
    • no localization
    • No way to remove the local device password
    • No deletion of personal data
    • No control for installed apps
    Login
    Ownership Selection between
    COPE (Corperate owned, Personal enabled)
    BYOD (Bring-Your-Own-Device)
    MSP v1.4.7 Gerät-anmelden-en.png
    Terms of License and Ownership

    With BYOD additionally:
    User Device user from the user administration

    The user cannot be changed afterwards for BYOD devices.
    Accept the terms of the license and privacy policy
      agree Accepting and saving the settings
    Displays the updated properties




    Apple Re-Enrollment

    notempty
    New as of: 1.24

    Diese Funktion steht erst zur Verfügung, wenn Apple Re-Enrollment unter Einstellungen aktiv ist.
    Neu hinzugefügte DEP-Geräte werden automatisch im Portal registriert und können bereits vor ihrer ersten Nutzung individuell vorkonfiguriert werden. Die so festgelegten Einstellungen für Benutzerprofile, Anwendungen und Tags werden nahtlos bei der ersten Anmeldung des Gerätes angewendet.
    Bei einer Wiederinbetriebnahme eines Gerätes erfolgt eine automatische Übertragung der Konfigurationen des Gerätes, vorausgesetzt, dieses ist noch im Portal vorhanden. Diese Profile werden mit dem Label Signed out markiert.


    Error messages / Troubleshooting

    Error Error message Cause Solution
    Unexpected error 33007 An unexpected error with "iphone" has occurred.
    Provisional Enrollment failed.
    Network communication error.
    [MCCloudConfigErrorDomain - 0x80EF (33007)]
    The device is still managed by another MDM. The device must be given a WiFi profile that can be accessed during the preparation process. Apple Configurator Fehler-33007.png
    The device must be removed in the previous MDM before it can be reconfigured
    Activation lock "iphone" could not be activated.
    The activation lock for the device may be activated. Continue on the device or use Finder to activate it and press "Retry".
    The device is still connected to an Apple account On the device, the connection to the iTunes account must be removed ( Preferences -> iTunes & App Store) Apple Configurator Fehler Aktivierungssperre.png
    At https://icloud.com / Find my iPhone the connection with the Apple-ID must be removed
    DEP Assignment after enrolment The profile has been assigned to the device but will not be applied until the next reset. The boot wizard of the device was run through before the DEP profile was assigned. Delete device in MDM via the tile or in the settings MS DEP-Fehler.PNG