Deploy devices through Apple DEP

Apple has device enrollment programs for business and education accounts. For business accounts, you enroll in the Apple Deployment Program to use the Apple Device Enrollment Program (DEP) for device enrollment and management in Endpoint Management. That program is for iOS, macOS, and Apple TV devices. For information about signing up for a business Apple Deployment Program account, see this PDF from Apple.

Be aware that the Apple Deployment Program is available for organizations and not individuals. You must provide a considerable amount of corporate details and information to create an Apple Deployment Program account. Thus, it could take time to request and receive approval for accounts.

For education accounts, you create an Apple School Manager account. Apple School Manager unifies the Device Enrollment Program (DEP) and Volume Purchase Program (VPP). Apple School Manager is a type of Education DEP. To create an Apple School Manager account, go to

If Endpoint Management is integrated with Citrix Workspace, the Workspace App is included in the DEP deployment package as a required app. To support that feature, Endpoint Management requires that you configure your DEP account settings for iOS with required credentials set to off.

Enroll in the Apple Deployment Program

  1. Go to to apply for an Apple Deployment Program account. When applying for a DEP account, the best practice is to use an email address for the organization, such as


    For education accounts, go to

    Apple DEP setup

  2. After you type your organization information, Apple emails you a temporary password for the new Apple ID.

    Apple DEP setup

  3. You then sign in with your Apple ID and complete the security settings for the account.

    Apple DEP setup

  4. Configure and enable two-step verification, which is required for use with the DEP Portal. During these steps, after you add a phone number, you receive the 4-digit PIN for the two-step verification.

    Apple DEP setup

  5. Log in to the DEP Portal to complete the account configuration using the two-step verification that you set up.

  6. Add your company details and then select from where you purchase devices. For details on purchasing options, see the next section, Order DEP-enabled devices.

    Apple DEP setup

  7. Add the Apple Customer Number or the DEP Reseller ID. Then verify your enrollment details and wait for Apple to approve your account.

    Apple DEP setup

    Apple DEP setup

  8. After you receive your logon credentials from Apple, log in to the Apple DEP Portal.

    Apple DEP setup

    To connect your account to Endpoint Management, see “Integrate your Apple DEP account with Endpoint Management” in Bulk enrollment of Apple devices.

Order DEP-enabled devices

You can order DEP-enabled devices directly from Apple or DEP-enabled authorized resellers or carriers. To order from Apple, provide your Apple Customer ID in the Apple DEP Portal. Your Customer ID enables Apple to associate your purchased devices with your Apple DEP account.

To order from your reseller or carrier, contact your Apple reseller or carrier to check if they participate in the Apple DEP. Ask for the Apple DEP ID of the reseller when purchasing devices. Apple requires that information when you add your Apple DEP reseller to your Apple DEP account. After you add the Apple DEP ID for the reseller, you receive a DEP customer ID. Provide the DEP customer ID to the reseller, who uses the ID to submit information about your device purchases to Apple. For more information, see this Apple website.

Manage DEP-enabled devices

Follow these steps to associate devices with your Endpoint Management server by using the DEP Portal to update your Apple DEP account.

  1. Log on to the Apple DEP Portal.

  2. Click Device Enrollment Program and then click Manage Devices. In Choose Devices By, choose the option for which you want to upload and define your Apple DEP-enabled devices: Serial Number, Order Number, or Upload CSV File.

    Apple DEP setup

  3. To assign your devices to an Endpoint Management server, under Choose Action, choose Assign to Server. Then, in the list, choose the name of your Endpoint Management server. Click OK.

    Apple DEP setup

    Your Apple DEP devices are now associated with the selected Endpoint Management server.

    Apple DEP setup

    Endpoint Management displays a License Expiration Warning when Apple DEP tokens are nearing expiration or have expired.

    Apple DEP setup

Renew your enrollment in the Apple Deployment Program

Step 1: Download a public key from your Endpoint Management server

  1. In the Citrix Endpoint Management console, go to Settings > Apple Device Enrollment Program (DEP) to download a new public key.

Step 2: Create and download a server token file from your Apple account

  1. Sign in to the Apple Deployment Program Portal to renew the token.

  2. Open Settings > MDM Server Info and click Edit. Upload the new public key you downloaded from Endpoint Management, and save the changes.

  3. Go back to Settings to download the new token.

Download a server token image

Step 3: Upload a server token file in Endpoint Management

  1. In Citrix Endpoint Management, go to Settings > Apple Device Enrollment Program (DEP). Select the DEP account, click Edit, and upload your server token file.

  2. Click Next and save the changes.

User experience when enrolling an Apple DEP-enabled device

When users enroll an Apple DEP-enabled device, their experience is as follows.

  1. Users start their Apple DEP-enabled device.

  2. Endpoint Management delivers the Apple DEP configuration that you configured in the Endpoint Management console to the Apple DEP-enabled device.

  3. Users configure the initial settings on their device.

  4. The device automatically starts the Endpoint Management device enrollment process.

  5. If Endpoint Management is integrated with Citrix Workspace, the Workspace App is included in the DEP deployment package as a required app. In that case, Secure Hub prompts users to enroll the device in Citrix Workspace before enrolling in Endpoint Management.

  6. Users continue to configure the other initial settings on their device.

  7. In the home screen, users might be prompted to sign in to iTunes so that they can download Citrix Secure Hub.


    This step is optional if Endpoint Management is configured to deploy the Secure Hub app using the device-based Volume Purchase Program (VPP) app assignment. In this case, you don’t need to create an iTunes account or use an existing account.

    Apple DEP setup

  8. Users open Secure Hub and type their credentials. If required by the policy, users might be prompted to create and verify a Citrix PIN.

    Endpoint Management deploys any remaining required apps to the device.