The Apple DEP program can be used to prepare iPads for use in security-critical scenarios. This includes functions such as:
» Using supervised mode
» Making MDM Enrollment mandatory
» Protecting MDM Enrollment from removal1
» Skipping setup steps when setting up the iPad
When devices are manually added to DEP, there is a grace period of 30 days after which the option "Remove administration" from device’s settings menu is removed
To use Relution with DEP, you need:
» A DEP account for corporate customers or education customers, using a separate Apple ID that is enabled for managing DEP devices
» The Apple configurator in its current version (from the Mac App Store)
Since iOS11, iPads can also be added to the DEP program after receiving them - previously, this was only possible through specially authorized dealers or apple directly.
The following screen appears:
Select the device and click "Prepare...".
Then click "Next".
https://and, for example, for the Relution test system
The Apple Configurator stores these settings so that you don’t have to re-enter it when additional devices are added later.
You may need to confirm this by 2-factor authentication (enter a 4-digit code that you receive via SMS).
If you do not select a profile here, after the ipad is restarted, enter the WLAN settings manually (unless the device is connected to a Mac via USB. Click "Prepare" and the ipad will restart. It is then automatically enrolled in the DEP program and can then be assigned to a Relution server in the DEP portal (by default it is assigned to the Apple Configurator).
This completes the initial configuration of the DEP account and the DEP account is displayed:
A DEP profile determines which options are preconfigured on the iOS device before the MDM enrollment happens. By clicking on the "Create" button you will see the following page:
Notice the section with the Buttons "Supervise device" and "User may remove MDM enrollment".
Supervised Mode is a prerequisite that an MDM profile can no longer be removed.
In the lower part of the page, you define the screens to be skipped when the iOS device is reset. This can be used make the device reset Zero Touch (see 5.2).
Save the DEP profile by pressing the "Save" button on the top right.
In order for these devices to be automatically preconfigured when switched on and then connected to the Relution server to enroll, each device must be assigned a DEP profile.
On this screen you can also specify the device’s user. Optionally, you can directly assign a policy and a rule s set, as with a "normal" Relution Enrollment too. The device configuration is saved by pressing the "Save" button.
Pressing the "Save" button will submit the device configuration to Apple. From now on the device will be configured automatically after each reset to factory state.
As long as the mapping of the DEP profile is not changed, resetting the iOS device will always result in a re-enrollment.
Note: To successfully enroll a mobile device, the Relution Client App is required. It can be provided via VPP (see next chapter).
The Volume Purchase Program (VPP) allows to distribute apps from the Apple AppStore via Relution without requiring an Apple ID on the mobile device. It is configured similar to DEP in Apple School Manager / Apple Business Manager. Also, all app licenses have to be bought there, for both free and paid apps.
In order to connect Relution to VPP, go to the Apple Portal and select “Settings”, then “Apps and Books”. On that screen, a Token can be downloaded for each location:
This token is uploaded in Relution under “Settings -> Volume Purchase Program”:
At this point a new menu “Purchased Apps” is added to the “Apps” menu. This menu lists all VPP apps and their licenses.
Note: The Relution Client App is also available from the Apple AppStore. Since it is required for enrolling iOS devices, make sure the required licenses for it are acquired via VPP before starting to enroll iOS devices.
With Relution Version 4.70 it is possible to store several VPP tokens under "Settings" -> "Volume Purchase Program". This is useful if an organization is provided with app licenses by another organization and at the same time is managing its own app licenses. The sum of all app licenses from multiple VPP tokens is displayed in "Apps" -> "Purchased Apps". The available app licenses can be filtered by used VPP token. If an app license is manually assigned to a device under "Purchased Apps", you can select from which of the stored VPP tokens the app license should be used.
When apps are automatically distributed to devices via auto-deployments, Relution checks whether a VPP token is stored for this app license. If this is the case, the app license is automatically assigned to the device. If several VPP tokens are stored for the organization and the app license is present in all of them, the license of the first VPP token available in the list is used. Under "Settings" -> "Volume Purchase Program" the order of the stored VPP tokens can be changed to determine from which VPP token the app license should be used.
DEP Devices that are being managed by another MDM system and that should be transferred to Relution can be migrated by creating a new MDM server in Apple School Manager / Apple Business Manager, connecting it to the desired Relution system and assigning the devices to the new MDM server. Then, do a factory reset of the devices from the old MDM console and upon resetting, the devices will auto-enroll with Relution.
When you reset an iOS device, apps, data, and settings on the device. are deleted. As a DEP device, it then automatically re-enrolls with Relution and receives the associated configuration and apps again.
You can reset iOS devices in several ways:
This type of reset is meant for individual devices that are not locally available. Select the device in the inventory list and assign the "Wipe device" action.
Note: It is important that in the associated DEP profile (see 2.3) the option to skip the location services page during setup is not selected because otherwise the iOS device will be assigned the wrong time zone. This cannot be corrected afterwards on the device.
This method is suitable whenever many iOS devices are to be reset at the same time (e.g. a set of tablets), which are connected to a Mac via an USB hub.
On the Mac, you should have Content Caching and Internet Connection Sharing enabled under System Preferences - Sharing.
Sharing the Internet connection does not work over WiFi - the Mac must be connected by Ethernet cable.
This way, the iOS device does not require WiFi to be configured, and the apps to be installed come from the Mac's cache, which greatly reduces installation times.
Note: For this method, the option to skip the location services page should be set in the DEP profile because the correct time zone is set automatically through the Mac.
Select the device (s) you want to reset, and then click "Prepare…” - “Automatic Registration"
When resetting the devices, no more input on the device itself is required ("zero touch installation").
» Which devices can be added to DEP?
» My device does not appear in the Auto Enrollments in Relution.