Deployment: Enrollment, Provisioning, and Distribution
Deployment fundamentals
Apple deployment questions reward precision about who owns the device and what stage of setup you are in. Know the difference between Automated Device Enrollment (ADE, formerly DEP), which is driven by device serial numbers registered through Apple Business Manager or Apple School Manager, and manual enrollment, where a user installs a management profile. ADE requires a supervision-capable path: devices enrolled via ADE are supervised by default, which unlocks restricted payloads and commands.
Enrollment tokens and assignment
A key trap: the MDM server talks to Apple through an enrollment (server) token, which must be renewed before it expires - an expired token stops new enrollment and some device queries but does not instantly unenroll existing devices. Separately, devices must be assigned to an MDM server in ABM/ASM. Assignment is not the same as enrollment; a device can be assigned but never enrolled if the user skips or the profile is removed during Setup Assistant.
Distribution
Understand app distribution paths: Volume Purchase Program (Apps and Books) licenses can be assigned to users or to devices; device-based assignment requires no Apple ID and pairs with supervised devices. Custom apps, unlisted apps, and B2B distribution differ from public App Store apps. Configuration profiles can be delivered as .mobileconfig files, and payloads must be signed or the device warns the user.
Worked rule of thumb
If a question says "the device was purchased from a reseller and must enroll with zero touch," the answer chain is: reseller adds serial to ABM → ABM assigns to MDM → Setup Assistant prompts enrollment → device is supervised. If any link is missing, zero touch fails. Watch for answer choices that confuse supervision with enrollment - enrollment alone does not grant supervision for manually enrolled devices.