XenMobile

Deploy devices through the Apple Deployment Program

Apple has device enrollment programs for business and education accounts. For business accounts, you enroll in the Apple Deployment Program to use the Apple Business Manager (ABM) or Apple School Manager (ASM) for device enrollment and management in XenMobile. That program is for iOS, iPadOS, and macOS devices.

The Apple Deployment Program is available for organizations and not individuals. You must provide a considerable amount of corporate details and information to create an Apple Deployment Program account. Thus, it might take time to request and receive approval for accounts.

For education accounts, you create an Apple School Manager account. ASM unifies the Apple Deployment Program and Apple volume purchase. To create an Apple School Manager account, go to the Apple School site.

Enroll in the Apple Deployment Program

To enroll in Apple Business Manager, go to business.apple.com. Click Enroll now to apply for a new account. Best practice is to use an email address for your organization, such as deployment@company.com. The enrollment process might take a few days. After you receive your logon credentials, follow the steps provided in Apple Business Manager to create an account.

Note:

For education accounts, see Integrate with Apple Education features.

Connect your Apple Business Manager account with XenMobile

To connect your Apple Business Manager account with your XenMobile deployment, enter information in the XenMobile console and Apple Business Manager. Follow these steps:

Step 1: Download a public key from your XenMobile server

  1. In the XenMobile console, go to Settings > Apple Deployment Program.

    Apple Deployment Program settings screen

  2. Under Download Public Key, click Download.

Step 2: Create and download a server token file from your Apple account

  1. Sign in to Apple Business Manager using an administrator or device enrollment manager account.
  2. At the bottom of the sidebar, click Settings and then click Device Management Settings > Add MDM Server.

    Apple Deployment Program settings screen

  3. In the MDM Server Name setting, type a name for the XenMobile server. The server name that you type is for your reference. It’s not the server URL or name.
  4. Under Upload Public Key, click Choose File. Upload the public key that you downloaded from XenMobile and then save the changes.
  5. Click Download Token to download the server token file to your computer.

    You must upload the server token file when adding the ABM account to XenMobile. Your ABM token information appears in the XenMobile console after you import the token file.

  6. Under Default Device Assignment, click Change. Choose how you want to assign devices and then provide the information requested. For information, see the ABM User Guide.

Step 3: Add an ABM account to XenMobile

You can add multiple ABM accounts to XenMobile. This feature enables you to use different enrollment settings and setup assistant options by country, department, and so on. You then associate ABM accounts with different device policies.

For example, you might centralize all of your ABM accounts from different countries on the same XenMobile server, to import and supervise all ABM devices. By customizing enrollment settings and setup assistant options per department, organizational hierarchy, or other structure, policies provide appropriate functionality across your organization, and users receive the appropriate assistance.

  1. In the XenMobile console, go to Settings > Apple Deployment Program and, under Add Apple Deployment Program Account, click Add.

    Apple Deployment Program settings screen

  2. In the Server Tokens page, specify your server token file and then click Upload.

    Apple Deployment Program settings screen

    Your server token information appears.

  3. In the Account Info page, specify these settings:

    Apple Deployment Program settings screen

    • Apple Deployment Program account name: A unique name for this Apple Deployment Program account. Use names that reflect how you organize Apple Deployment Program accounts, such as by country or organizational hierarchy.
    • Business/Education unit: The business unit or department to which the device is assigned. This field is required.
    • Unique service ID: An optional unique ID to help you further identify the account.
    • Support phone number: A support phone number that users call for help during setup. This field is required.
    • Support email address: An optional support email address available to end users.
  4. In iOS Settings, specify these settings:

    Apple Deployment Program settings screen

    Enrollment settings:

    • Require device enrollment: Whether to require users to enroll their devices. The default is Yes.
    • Require credentials for device enrollment: Whether to require users to enter their credentials during ABM setup. Citrix recommends that you require all users to enter their credentials during device enrollment, thus allowing only authorized users to enroll devices. The default is Yes.

      When you enable ABM before first time setup and you don’t select this option, XenMobile creates the ABM components. This creation includes components such as ABM user, Secure Hub, software inventory, and ABM deployment group. If you do select this option, XenMobile doesn’t create the components. As a result, if you later clear this option, users who haven’t entered their credentials can’t enroll in ABM because these ABM components don’t exist. To add ABM components, in that case, disable and enable the ABM account.

    • Wait for configuration to complete setup: Whether to require users’ devices to remain in Setup Assistant mode until all MDM resources deploy to the device. This setting is available for devices in supervised mode. The default is No.
    • Apple documentation states that the following commands may not work while a device is in Setup Assistant mode:
      • InviteToProgram
      • InstallApplication
      • ApplyRedemptionCode
      • InstallMedia
      • RequestMirroring
      • DeviceLock

    Device settings:

    • Supervised mode: Must be set to Yes if you are using the Apple Configurator to manage ABM enrolled devices or when Wait for configuration to complete setup is enabled. The default is Yes. For details on placing an iOS device in supervised mode, see To place an iOS device in Supervised mode by using the Apple Configurator.
    • Allow enrollment profile removal: Whether to allow devices to use a profile that you can remove remotely. The default is No.
    • Allow device pairing: For devices enrolled through ABM, whether you can manage them through Apple Music and the Apple Configurator. The default is No.

    Supervision Identities

    If you use the GroundControl tool, you can add a certificate to do the following:

    • Override pairing restrictions to avoid the “Trust this host” prompt.
    • Escalate managed device actions over USB to perform activities such as profile installation without user interaction. Doing so allows GroundControl to enable single app mode and device lock for checkout.
    • Restore a backup to ABM devices.

    For more information on GroundControl, see The GroundControl website.

  5. In macOS Settings, specify these settings:

    Apple Deployment Program Account settings screen

    Enrollment settings:

    • Require device enrollment: Whether to require users to enroll their devices. The default is Yes.
    • Wait for configuration to complete setup: If Yes, the macOS device doesn’t continue in the setup assistant until the MDM resource passcode gets deployed to the device. That deployment occurs before the creation of the local account. This setting is available for macOS 10.11 and higher devices. The default is No.

    Device settings:

    • Allow enrollment profile removal: Whether to allow devices to use a profile that you can remove remotely. The default is No.
  6. In iOS Setup Assistant Options, select the iOS Setup Assistant steps that your users skip when they start their devices the first time. The default for all items is cleared.

    Apple Deployment Program Account settings screen

    • Location services: Set up the location service on the device.
    • Touch ID: Set up Touch ID on iOS devices.
    • Passcode lock: Create a passcode for the device.
    • Set up as New or Restore: Set up the device as new or from an iCloud or Apple App Store backup.
    • Move from Android: Enable transferring data from an Android device to an iOS device. This option is available only when Set up as New or Restore is selected (that is, the step is skipped).
    • Apple ID: Set up a Managed Apple ID account for the device.
    • Terms and conditions: Require users to accept terms and conditions for use of the device.
    • Apple Pay: Set up Apple Pay on iOS devices.
    • Siri: Use or not use Siri on the device.
    • App analytics: Set up whether to share crash data and usage statistics with Apple.
    • Display zoom: Set up the display resolution (either standard or zoomed) on iOS devices.
    • True Tone: Set up the True Tone Display on iOS devices.
    • Home Button: Set up the Home Button screen sensitivity on iOS devices.
    • New feature highlights: Set up the onboarding informational screens, Access the Dock from Anywhere and Switch Between Recent Apps on iOS 11.0 devices (minimum version).
    • Privacy: Prevent users from seeing the data and privacy pane during setup of ABM devices. For iOS 11.3 and later.
    • SoftwareUpdate: Prevents the user from seeing the mandatory software update screen while setting up ABM devices. For iOS 12.0 and later.
    • ScreenTime: Prevents the user from seeing the Screen Time screen during setup of the ABM devices. For iOS 12.0 and later.
    • SIM Setup: Prevents the user from seeing the Add Cellular Plan screen during setup of the ABM devices. For iOS 12.0 and later.
    • iMessage & FaceTime: Prevents the user from seeing the iMessage and FaceTime screen during setup of the ABM devices. For iOS 12.0 and later.
    • Appearance: Prevents the user from seeing the Choose Your Look screen. For iOS 13.0 and later.
    • Welcome: Prevents the user from seeing the Getting Started screen. For iOS 13.0 and later.

    The ABM account appears on Settings > Apple Deployment Program.

  7. In macOS Setup Assistant Options, select the macOS Setup Assistant steps that your users skip when they start their devices the first time. The default for all items is cleared.

    Apple Deployment Program Account settings screen

    • Set up as New or Restore: Set up the device as new or from an iCloud or Apple App Store backup.
    • Location services: Set up the location service on the device.
    • Apple ID: Set up a Managed Apple ID account for the device.
    • Terms and conditions: Require users to accept terms and conditions for use of the device.
    • Siri: Use or not use Siri on the device.
    • FileVault: Use FileVault to encrypt the startup disk. XenMobile only applies the FileVault setting if the system has a single local user account and that account is signed into iCloud.

      You can use the macOS FileVault Disk Encryption feature to protect the system volume by encrypting its contents (https://support.apple.com/en-us/HT204837). If you run the Setup assistant on a late-model portable Mac that doesn’t have FileVault turned on, you might be prompted to turn on this feature. The prompt appears on both new systems and systems upgraded to OS X 10.10 or 10.11, but only if the system has a single local administrator account and that account is signed into iCloud.

    • App analytics: Set up whether to share crash data and usage statistics with Apple.
    • Privacy: Prevent users from seeing the Data and privacy pane during setup of ABM devices. For macOS 10.13 and later.
    • iCloud Analytics: Prevent users from seeing the iCloud analytics screen during setup of ABM devices. For macOS 10.13 and later.
    • iCloud Documents and Desktop: Prevent users from seeing the iCloud documents and desktop screen during setup of ABM devices. For macOS 10.13 and later.
    • Appearance: Prevents the user from seeing the Choose Your Look screen during setup of the ABM devices. For macOS 10.14 and later.

    • Local account setup options: Specify the settings to create an administrator account on the device. Users log in to their macOS device with this information. XenMobile creates the account, using the specified information.
      • Create primary account as a standard user: Instead of granting this user administrator privileges on the device, XenMobile creates the user with standard permissions. Because macOS requires an administrator account, XenMobile creates an administrator account first, then makes a new standard account and sets it as primary.
      • Admin full name: Type the name the system displays for the administrator account.
      • Admin short name: Type the name that the device displays for the home folder and in the shell.
      • Admin password: Type a secure password for the administrator account.
      • Show administrator account in Users and Groups: If cleared, the administrator account doesn’t appear in Users and Groups in the macOS settings. If you create the primary account as a standard user, enable this setting to hide the administrator account XenMobile creates first.

Order Deployment Program enabled devices

You can order Deployment Program enabled devices directly from Apple or Deployment Program enabled authorized resellers or carriers. To order from Apple, provide your Apple Customer ID in the Apple Deployment Program Portal. Your Customer ID enables Apple to associate your purchased devices with your Apple Deployment Program account.

To order from your reseller or carrier, contact your Apple reseller or carrier to check if they participate in the Apple Deployment Program. Ask for the Apple Deployment Program ID of the reseller when purchasing devices. Apple requires that information when you add your Apple Deployment Program reseller to your Apple Deployment Program account. After you add the Apple Deployment Program ID for the reseller, you receive a Deployment Program customer ID. Provide the Deployment Program customer ID to the reseller, who uses the ID to submit information about your device purchases to Apple. For more information, see this Apple Use Device Enrollment site.

Manage Deployment Program enabled devices

After your order ships, you can associate iOS, iPadOS, and macOS devices with your XenMobile server.

  1. Sign in to Apple Business Manager using an administrator or device enrollment manager account.
  2. In the sidebar, click Devices. Devices you purchased directly from Apple appear automatically. To assign devices from Apple Configurator 2 to Apple Business Manager, see Apple Business Manager User Guide.
  3. In the list, select a device or the total number of devices and click Edit Device Management. You have two options:
    • To assign a device to an MDM server, under Assign to Server, choose the name of your XenMobile server. Click Continue.

      To assign new devices to Apple Business Manager in bulk, set a default XenMobile server for deployment. For more information, see Set a default server for bulk enrollment.

    • To unassign a device from the XenMobile server, choose Unassign.

Your Apple Deployment Program devices are now associated with the selected XenMobile server.

If you send in an iOS, iPadOS, or macOS device for servicing, you need to remove the device from Apple Business Manager. When you receive the serviced device back, you must reassign the device to the XenMobile server. When you replace the device, you can assign a new device to the XenMobile server using an order number.

To review the history of assigned devices:

  1. Sign in to Apple Business Manager using an administrator or device enrollment manager account.
  2. In the sidebar, click Assignment History. Then choose an assignment to view more information.
  3. Click Download to download a CSV file with the serial numbers of all assigned and unassigned devices.

You can remove iOS, iPadOS, and macOS devices from Apple Business Manager if the device has been sold, stolen, or can’t be repaired.

  1. Sign in to Apple Business Manager using an administrator or device enrollment manager account.
  2. In the sidebar, click Devices and search for a device.
  3. Select a device and click Release Device. In the dialog box, confirm your changes to remove the device from the program. To add iOS and iPadOS devices back, use Apple Configurator 2. You can’t add macOS devices back with Apple Configurator 2.
Deploy devices through the Apple Deployment Program