Apple Deployment & Mgmt flashcards
Apple Deployment & Mgmt · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Automated Device Enrollment
- An ABM/ASM feature that enrolls devices at Setup Assistant without user interaction and makes them supervised, allowing the organization to retain management control.
- Apple Business Manager
- A web portal for organizations to manage device assignment to MDM servers, purchase apps and books, and create Managed Apple IDs.
- Supervision
- A device state, granted via ADE or Apple Configurator, that enables additional restrictions, MDM commands, and configuration payloads unavailable on unsupervised devices.
- Setup Assistant skip panes
- MDM-issued settings on supervised devices that bypass specified Setup Assistant screens, such as Apple ID or Siri, during initial setup.
- Volume Purchasing
- The Apps and Books program in ABM/ASM that lets organizations buy app licenses and assign them to users or devices without requiring an Apple ID on the device.
- Declarative Device Management
- A management model where the device evaluates declarations (configurations, assets, activations) autonomously, reducing server round-trips compared to legacy MDM commands.
- Enrollment customization
- An ABM/ASM setting that defines which Setup Assistant panes are shown, hidden, or required when a device enrolls via Automated Device Enrollment.
- Apple Configurator supervision
- Manual supervision applied by connecting a device to a Mac running Apple Configurator; it is not linked to ABM/ASM and cannot be released through ABM/ASM.
- APNs push certificate
- An annual certificate that lets an MDM server send silent pushes via Apple Push Notification service; renewal must use the same Apple ID that created it.
- Configuration profile
- An XML property list, delivered as a signed .mobileconfig, containing one or more payloads that configure device settings and restrictions.
- MDM check-in
- The HTTPS request a device makes to its MDM server after receiving an APNs push, during which it fetches pending commands and reports status.
- User Enrollment
- A BYOD enrollment type that creates a separate managed volume or partition, keeping personal data outside MDM control while managing work apps and accounts.
- Lost Mode
- An MDM command for supervised devices that locks the device, displays a custom message and phone number, and can report its location.
- Activation Lock bypass code
- A code available in ABM/ASM for supervised devices that clears Activation Lock without the original Apple ID credentials.
- Managed app configuration
- An AppConfig key-value dictionary delivered by MDM to a managed app, letting admins preconfigure app settings without user interaction.
- Remote wipe
- An MDM command that erases all content and settings from a device; on supervised devices it can also clear Activation Lock.
- Smart group scoping
- An MDM feature that targets profiles and apps to devices or users matching criteria such as OS version, model, or enrollment type.
- FileVault 2
- macOS full-disk encryption using XTS-AES-128; the recovery key can be institutional (escrowed to MDM) or personal (user-generated).
- Gatekeeper
- A macOS security feature that verifies notarization and Developer ID signatures before allowing an app to launch, configurable via the com.apple.security payload.
- System Integrity Protection
- A macOS protection that restricts root-level modification of protected system paths; it can be disabled only from Recovery mode using csrutil.
- Secure Enclave
- A dedicated coprocessor that stores passcode-derived keys and processes biometric data without exposing raw fingerprint or Face ID data to apps.
- Passcode policy payload
- An MDM payload that sets minimum length, complexity, and maximum failed attempts, and can trigger automatic erase after a failed-attempt threshold.
- Managed Device Attestation
- A feature that uses the Secure Enclave to prove device identity and integrity to the MDM server, helping detect compromised or spoofed devices.
- SCEP payload
- An MDM payload that requests an identity certificate from a certificate authority; the private key is generated and kept on the device.
- App Transport Security
- A macOS and iOS feature requiring HTTPS with TLS 1.2 or later by default; exceptions must be declared per-domain in the app's Info.plist.
- APNs connectivity check
- A troubleshooting step verifying the device can reach Apple push ranges on ports 5223 and 443, required for MDM commands to be delivered.
- Apple silicon recovery mode
- A startup environment entered by holding the power button on Apple silicon Macs, used to reinstall macOS or change security settings.
- DFU restore
- A firmware-level restore on Apple silicon performed with Apple Configurator 2 over USB-C, which reinstalls firmware and clears all data.
- Unified logging
- The macOS logging system queried with log show and log stream, used to diagnose MDM, profile, and enrollment issues.
- Remote Management screen
- The Setup Assistant pane shown on an ADE-enrolled supervised device; completing setup requires the MDM server to be reachable and the device assigned in ABM/ASM.
- SMC reset
- A procedure on Intel Macs that resolves power and charging anomalies; Apple silicon Macs have no SMC reset and are restarted instead.
- VPP app install failure
- A troubleshooting case checked by confirming the app is assigned via Apps and Books, the device is supervised if required, and storage is sufficient.