Apple Deployment & Mgmt key terms

A service that lets organizations register Apple devices they purchase from participating resellers, so the devices are automatically assigned to a mobile device management server during Setup Assistant.

The guided first-boot screens a new or erased Apple device shows to configure language, network, Apple ID, and other settings before the user reaches the desktop.

A credential an MDM server uses to authenticate to Apple's device enrollment service and download the list of devices assigned to the organization. It expires periodically and must be renewed.

Apple's program for buying apps and books in volume for organizations and education, delivering redeemable codes or managed distribution licenses tied to an Apple Business Manager account.

A web portal where organizations manage device enrollment, app and book purchases, and managed Apple IDs for their fleet of Apple devices.

The earlier name for the Apple service that assigns purchased devices to an organization's MDM server automatically; it was folded into Apple Business Manager.

A security feature that ties a device to the Apple ID used to enable Find My, preventing reactivation after erase until that credential is supplied or the lock is cleared by the owner.

An Apple device enrolled through Automated Device Enrollment that grants the organization additional management controls, such as restricting pairing, blocking profiles removal, and enforcing certain restrictions.

A file with the .mobileconfig extension containing settings and payloads, such as Wi-Fi, VPN, or restrictions, that an MDM server or user installs to configure a device.

An individual settings block inside a configuration profile, for example a Wi-Fi payload or a restrictions payload, each identified by a type and its own keys.

Policy settings delivered by profile or MDM that limit device capabilities, such as disabling the camera, blocking app installation, or preventing account changes.

A framework and protocol by which a server enrolls Apple devices, pushes profiles and commands, and receives inventory and compliance information over the network.

An Apple-issued certificate an MDM server uses to send silent push notifications that wake managed devices so they check in for commands. It must be renewed before expiry.

A management model where the device itself evaluates and enforces declared configurations and status reports, reducing the need for the server to poll and push commands.

Applications purchased through Apple Business Manager or installed by MDM that the organization can assign, remove, and configure without requiring the user's Apple ID password.

A supervised-device mode that restricts the device to a single app, commonly used for kiosks and shared-use scenarios, and exited with a passcode or MDM command.

An MDM command that locks a supervised device, displays a message and phone number on screen, and reports its location so it can be recovered.

An MDM command that erases all content and settings on a device, returning it to a factory state and removing organizational data.

Apple's full-disk encryption feature on macOS that protects data at rest; organizations commonly enforce it and escrow the recovery key through MDM.

The practice of storing a FileVault recovery key with the MDM server or directory service so administrators can unlock a disk when the user's credentials fail.

A macOS security feature that checks software signatures and notarization before allowing an app to run, helping block identified malicious software.

An Apple automated security check that scans developer software for malicious content and issues a ticket so Gatekeeper can allow it to run.

A macOS protection that restricts even root-level processes from modifying protected system files and folders, reducing the impact of malicious or accidental changes.

An Apple ID created and owned by an organization through Apple Business Manager, used for services like iCloud and FaceTime with organizational control over the account.

An iPad configuration for education and business that lets multiple users sign in to the same device, with each user's data kept separate and cached locally.

An erase-and-reconfigure workflow that resets a device to a ready state for the next user, often combining erase, enrollment, and profile installation.

A startup state on Mac that provides utilities such as Disk Utility and reinstall options when the normal system cannot boot.

A macOS tool, available from Recovery, used to set the security policy and allow external or removable media booting on Apple silicon and T2-equipped Macs.

A mode that makes a Mac's storage appear as an external disk to another computer over a cable, useful for migrating or recovering data.

A macOS and iOS utility that transfers user accounts, apps, settings, and data from another Mac, a Time Machine backup, or a Windows PC to a new device.

A low-level restore state on iOS devices that bypasses the normal boot process, letting a computer reinstall firmware when standard recovery fails.

A record of system and application messages on Apple devices, used to diagnose crashes, profile failures, and MDM check-in problems.

The macOS logging system that collects messages from the kernel and apps into a searchable store, queried with the log command or Console app.

Apple's service for locating, locking, and erasing devices signed in with an Apple ID, and the feature whose activation enables Activation Lock.

Apple's network service that delivers wake-up notifications to devices so they contact their MDM server, and the transport behind MDM push certificates.

A credential derived at enrollment on macOS that lets MDM authorize secure token operations, such as creating local admin accounts, without user interaction.

A macOS authorization granted to a user account that permits unlocking FileVault and performing certain security-sensitive operations on the volume.