Chapter 7 Conguration and management 60
To enable management, Apple devices are enrolled with an MDM server using an enrollment
conguration prole and can be done by the user directly. For company-owned devices, MDM
enrollment can be automated using the Device Enrollment Program (described in this chapter).
When an administrator initiates an MDM policy, option, or command, the Apple devices receive
notication of the action through the APNs. With a network connection, devices can receive
APNs commands anywhere in the world.
Enrollment
Enrolling Apple devices enables cataloging and asset management. The enrollment process
typically leverages Simple Certicate Enrollment Protocol (SCEP), which lets a device create and
enroll unique identity certicates for authentication to an organization’s services.
In most cases, users decide whether or not to enroll their Apple device in MDM, and they can
disassociate from MDM at any time. Organizations should consider incentives for users to remain
managed. For example, require MDM enrollment for Wi-Fi network access by using the MDM
solution to automatically provide the wireless credentials. When a user leaves MDM, their device
attempts to notify the MDM server.
The Device Enrollment Program can also be used to automatically enroll Apple devices your
organization owns in MDM during initial setup. You can also supervise the iOS devices, so users
with these devices won’t be able to bypass MDM or unenroll their devices.
For more information, see Device Enrollment Program.
Congure
Once an Apple device is enrolled, it can be dynamically congured with settings and policies
by the MDM server, which sends conguration proles to the device that are automatically,
and silently, installed by either iOS or OS X.
Conguration proles can be signed, encrypted, and locked—preventing the settings from being
altered or shared—ensuring that only trusted users and Apple devices that are congured to
your specications can access your network and services. If a user disassociates their device from
MDM, all of the settings installed by MDM are removed.
A redesigned user interface for proles in iOS 8 shows users what has been congured
and restricted by MDM. Accounts, apps, books, and restrictions can now be easily viewed.
Provisioning proles are no longer visible to the user in iOS 8 and expired proles are
automatically removed.
Accounts
MDM can help your users get up and running quickly by setting up their mail and other
accounts automatically. Depending on the MDM solution you use and its integration with your
internal systems, account payloads can also be pre-populated with a user’s name, mail address,
and, where applicable, certicate identities for authentication and signing.
MDM can congure the following types of accounts:
•
Calendar
•
Contacts
•
Exchange ActiveSync
•
Identity
•
Jabber
•
LDAP
100% resize factor
