Apple Deployment & Mgmt cheat sheet

Apple Business Manager (ABM) and Apple School Manager (ASM) automate device enrollment; devices added by serial number or via Apple reseller are assigned to an MDM server in ABM/ASM.

Automated Device Enrollment (ADE, formerly DEP) enrolls Mac, iPhone, iPad, and Apple TV without user interaction and cannot be removed by the user without admin action in ABM/ASM.

Enrollment customization at Setup Assistant can skip panes (e.g., Apple ID, Siri, Location) or require them; skipped panes are not shown to the user during setup.

Volume Purchasing (Apps and Books) licenses are assigned to users or devices in ABM/ASM; device-based assignment does not require an Apple ID on the device.

A Mac enrolled via ADE is supervised; supervision enables additional restrictions, MDM commands, and configuration profile payloads that unsupervised devices cannot accept.

Setup Assistant on iOS/iPadOS can be bypassed to the Home Screen only when the device is supervised and the MDM server issues a skip command; unsupervised devices cannot skip Setup Assistant.

Declarative Device Management (DDM) uses declarations (configurations, assets, activations) that the device evaluates autonomously, reducing round-trips compared to legacy MDM commands.

Apple Configurator can supervise and enroll devices manually, but manual supervision is not tied to ABM/ASM and cannot be released by the organization through ABM/ASM.

Software Update deferral and enforcement are configured via restrictions and DDM; supervised devices can defer visible updates for a specified number of days.

MDM uses the Apple Push Notification service (APNs) to wake devices; the MDM server sends a silent push, and the device then checks in over HTTPS to fetch commands.

An MDM push certificate is tied to a specific MDM vendor/server and expires annually; renewal must use the same Apple ID that created it, or devices must be re-enrolled.

Configuration profiles are XML property lists with a PayloadType per payload; a profile can contain multiple payloads and is delivered as a signed .mobileconfig.

Supervised devices accept additional payloads (e.g., web content filter, single app mode, restrictions) and MDM commands that unsupervised devices reject.

Smart groups and scoping in an MDM let admins target profiles and apps by criteria such as OS version, model, enrollment type, or user group.

Managed Open In and managed app configuration (AppConfig) let MDM pass key-value settings to managed apps without user interaction.

Lost Mode on supervised devices locks the device, displays a message and phone number, and can report location; it is cleared by an MDM command.

Remote wipe vs. erase: a full erase removes all content and settings; for supervised devices an MDM can also clear the Activation Lock via a bypass code or by releasing the device in ABM/ASM.

User Enrollment (BYOD) creates a separate managed APFS volume on Mac and a managed partition on iOS/iPadOS, keeping personal data outside MDM control.

FileVault 2 full-disk encryption on Mac uses XTS-AES-128; a recovery key can be institutional (escrowed to MDM) or personal (user-generated).

Activation Lock binds a device to an Apple ID; on supervised devices it can be cleared by MDM with a bypass code or by removing the device from ABM/ASM.

Gatekeeper on macOS verifies notarization and Developer ID signatures before allowing an app to launch; it can be configured via the com.apple.security payload.

System Integrity Protection (SIP) restricts root-level modification of protected system paths; it is disabled only from Recovery mode using csrutil.

Secure Enclave stores and processes device passcode-derived keys and biometric data; it never exposes raw fingerprint or Face ID data to apps.

Passcode policies via MDM define minimum length, complexity, and maximum failed attempts; on iOS/iPadOS a failed-attempt threshold can trigger an automatic erase.

Managed Device Attestation uses the Secure Enclave to prove device identity and integrity to the MDM server, helping detect compromised or spoofed devices.

Certificate payloads can deploy identity certificates and root CAs; SCEP payloads request certificates from a CA, and the private key stays on the device.

App Transport Security (ATS) requires HTTPS with TLS 1.2+ by default; exceptions must be declared per-domain in Info.plist.

If a device does not receive MDM commands, verify APNs connectivity (ports 5223 and 443 to Apple push ranges) and that the push certificate has not expired.

A Mac that fails to complete ADE enrollment may need the MDM server URL reachable over HTTPS and a valid enrollment profile; re-enrollment can be triggered via Profiles pane or ABM/ASM.

Recovery mode on Apple silicon Macs is entered by holding the power button; on Intel Macs, hold Command-R at startup for local recovery.

DFU restore on Apple silicon uses Apple Configurator 2 with a USB-C cable and the device in DFU mode; it reinstalls firmware and clears data.

Console.app and the unified logging system (log show / log stream) are used to diagnose macOS MDM and profile issues; iOS device logs are available via Xcode Devices window.

If an app install from MDM fails, check whether the app is VPP-assigned, whether the device is supervised (if required), and whether the device has sufficient storage.

A supervised device that shows 'Remote Management' at Setup Assistant is enrolled via ADE; completing setup requires the MDM server to be reachable and the device assigned in ABM/ASM.

Profiles can be inspected on macOS in System Settings > General > Device Management; removal of an MDM enrollment profile on a supervised device may be blocked by the MDM.

Resetting the SMC on Intel Macs resolves power and charging anomalies; Apple silicon Macs do not have an SMC reset procedure (restart instead).