XenMobile

Bulk enrollment of Apple devices

You can enroll large numbers of iOS and macOS devices in XenMobile in two ways.

  • Use the Apple Deployment Program to enroll the iOS and macOS devices that you buy directly from Apple, a participating Apple Authorized Reseller, or a carrier. That support includes Shared iPads. XenMobile supports the Apple Deployment Program for Apple Business Manager (ABM) and Apple School Manager (ASM) for Education. This article describes integrating with ABM accounts. For information about Apple School Manager accounts, see Integrate with Apple Education features.

    For enrollment of macOS devices, XenMobile requires that the devices run macOS 10.10 or later.

  • You can also use the Apple Configurator to enroll iOS devices whether you purchased them directly from Apple or not.

With ABM:

  • You do not have to touch or prepare the devices. Instead, you submit device serial numbers or purchase order numbers through ABM to configure and enroll the devices.
  • After XenMobile enrolls the devices, you can give them to users who can start using them right away. When you set up devices with ABM, you can eliminate some of the Setup Assistant steps that users would have to complete when they first start their devices.
  • For more information on setting up ABM, see the documentation available from Apple Business Manager.

With the Apple Configurator:

  • You attach iOS devices to an Apple computer running macOS 10.7.2 or later and the Apple Configurator 2 app. You prepare the iOS devices and configure policies through Apple Configurator 2.
  • After you provision the devices with the required policies, the first time the devices connect to XenMobile, the devices receive policies from XenMobile. You can then start managing the devices.
  • For more information about using Apple Configurator, see the Apple Configurator Help.

Prerequisites

Open required ports for connectivity between XenMobile and Apple. For more information, see Port requirements.

Integrate your Apple Business Manager account with XenMobile

If you do not have an ABM account, see Deploy devices through Apple Deployment Program.

To connect your Apple Business Manager account with your XenMobile server deployment, you enter information in the XenMobile console and the Apple Deployment Program Portal. Follow these steps:

Step 1: Download a public key from your XenMobile server

  1. In the XenMobile console, go to Settings > Apple Deployment Program.

    Apple Deployment Program settings screen

  2. Under Download Public Key, click Download.

Step 2: Create and download a server token file from your Apple account

  1. Using your corporate Apple ID, log on to the Apple Deployment Program Portal.

    Apple Deployment Program Portal

  2. In the Apple Deployment Program portal, click Settings, then Device Management Settings. Click Add MDM Server.

    Apple Deployment Program portal

  3. Type a name for XenMobile. The server name that you type is for your reference and is not the server URL or name. Under Upload Public Key, click Choose File.

    Apple Deployment Program portal

  4. Upload the server key that you downloaded from XenMobile and then click Save.

  5. Generate a server token: Click Download Token and then download the server token file to your computer.

    Apple Deployment Program portal

  6. Under Default Device Assignment click Change. Choose how you want to assign devices and then provide the information requested. For information, see the ABM User Guide.

    Your ABM token information appears in the XenMobile console after you import the token file. You upload the server token file when adding the ABM account to XenMobile.

Step 3: Add an ABM account to XenMobile

You can add multiple ABM accounts to XenMobile. This feature enables you to use different enrollment settings and setup assistant options by country, department, and so on. You then associate ABM accounts with different device policies.

For example, you might centralize all of your ABM accounts from different countries on the same XenMobile server, to import and supervise all ABM devices. By customizing enrollment settings and setup assistant options per department, organizational hierarchy, or other structure, policies provide appropriate functionality across your organization, and users receive the appropriate assistance.

  1. In the XenMobile console, go to Settings > Apple Deployment Program and, under Add Apple Deployment Program Account, click Add.

    Apple Deployment Program settings screen

  2. In the Server Tokens page, specify your server token file and then click Upload.

    Apple Deployment Program settings screen

    Your server token information appears.

  3. In the Account Info page, specify these settings:

    Apple Deployment Program settings screen

    • Apple Deployment Program account name: A unique name for this Apple Deployment Program account. Use names that reflect how you organize Apple Deployment Program accounts, such as by country or organizational hierarchy.
    • Business/Education unit: The business unit or department to which the device is assigned. This field is required.
    • Unique service ID: An optional unique ID to help you further identify the account.
    • Support phone number: A support phone number that users call for help during setup. This field is required.
    • Support email address: An optional support email address available to end users.
  4. In iOS Settings, specify these settings:

    Apple Deployment Program settings screen

    Enrollment settings:

    • Require device enrollment: Whether to require users to enroll their devices. The default is Yes.
    • Require credentials for device enrollment: Whether to require users to enter their credentials during ABM setup. Citrix recommends that you require all users to enter their credentials during device enrollment, thus allowing only authorized users to enroll devices. The default is Yes.

      When you enable ABM before first time setup and you don’t select this option, XenMobile creates the ABM components. This creation includes components such as ABM user, Secure Hub, software inventory, and ABM deployment group. If you do select this option, XenMobile doesn’t create the components. As a result, if you later clear this option, users who haven’t entered their credentials can’t enroll in ABM because these ABM components don’t exist. To add ABM components, in that case, disable and enable the ABM account.

    • Wait for configuration to complete setup: Whether to require users’ devices to remain in Setup Assistant mode until all MDM resources deploy to the device. This setting is available for devices in supervised mode. The default is No.
    • Apple documentation states that the following commands may not work while a device is in Setup Assistant mode:
      • InviteToProgram
      • InstallApplication
      • ApplyRedemptionCode
      • InstallMedia
      • RequestMirroring
      • DeviceLock

    Device settings:

    • Supervised mode: Must be set to Yes if you are using the Apple Configurator to manage ABM enrolled devices or when Wait for configuration to complete setup is enabled. The default is Yes. For details on placing an iOS device in supervised mode, see To place an iOS device in Supervised mode by using the Apple Configurator.
    • Allow enrollment profile removal: Whether to allow devices to use a profile that you can remove remotely. The default is No.
    • Allow device pairing: For devices enrolled through ABM, whether you can manage them through the Apple App Store and the Apple Configurator. The default is No.

    Supervision Identities

    • Add a certificate to support the use of GroundControl. With this certificate, you can do the following:
      • Override pairing restrictions to avoid the “Trust this host” prompt.
      • Escalate managed device actions over USB to perform activities such as profile installation without user interaction. Doing so allows GroundControl to enable single app mode and device lock for checkout.
      • Restore a backup to ABM devices.

    For more information on GroundControl, see The GroundControl website.

  5. In macOS Settings, specify these settings:

    Apple Deployment Program Account settings screen

    Enrollment settings:

    • Require device enrollment: Whether to require users to enroll their devices. The default is Yes.
    • Wait for configuration to complete setup: If Yes, the macOS device doesn’t continue in the setup assistant until the MDM resource passcode gets deployed to the device. That deployment occurs before the creation of the local account. This setting is available for macOS 10.11 and higher devices. The default is No.

    Device settings:

    • Allow enrollment profile removal: Whether to allow devices to use a profile that you can remove remotely. The default is No.
  6. In iOS Setup Assistant Options, select the iOS Setup Assistant steps that your users skip when they start their devices the first time. The default for all items is cleared.

    Apple Deployment Program Account settings screen

    • Location services: Set up the location service on the device.
    • Touch ID: Set up Touch ID on iOS devices.
    • Passcode lock: Create a passcode for the device.
    • Set up as New or Restore: Set up the device as new or from an iCloud or Apple App Store backup.
    • Move from Android: Enable transferring data from an Android device to an iOS device. This option is available only when Set up as New or Restore is selected (that is, the step is skipped).
    • Apple ID: Set up a Managed Apple ID account for the device.
    • Terms and conditions: Require users to accept terms and conditions for use of the device.
    • Apple Pay: Set up Apple Pay on iOS devices.
    • Siri: Use or not use Siri on the device.
    • App analytics: Set up whether to share crash data and usage statistics with Apple.
    • Display zoom: Set up the display resolution (either standard or zoomed) on iOS devices.
    • True Tone: Set up the True Tone Display on iOS devices.
    • Home Button: Set up the Home Button screen sensitivity on iOS devices.
    • New feature highlights: Set up the onboarding informational screens, Access the Dock from Anywhere and Switch Between Recent Apps on iOS 11.0 devices (minimum version).
    • Privacy: Prevent users from seeing the data and privacy pane during setup of ABM devices. For iOS 11.3 and later.
    • SoftwareUpdate: Prevents the user from seeing the mandatory software update screen while setting up ABM devices. For iOS 12.0 and later.
    • ScreenTime: Prevents the user from seeing the Screen Time screen during setup of the ABM devices. For iOS 12.0 and later.
    • SIM Setup: Prevents the user from seeing the Add Cellular Plan screen during setup of the ABM devices. For iOS 12.0 and later.
    • iMessage & FaceTime: Prevents the user from seeing the iMessage and FaceTime screen during setup of the ABM devices. For iOS 12.0 and later.
    • Appearance: Prevents the user from seeing the Choose Your Look screen. For iOS 13.0 and later.
    • Welcome: Prevents the user from seeing the Getting Started screen. For iOS 13.0 and later.

    The ABM account appears on Settings > Apple Deployment Program.

  7. In macOS Setup Assistant Options, select the macOS Setup Assistant steps that your users skip when they start their devices the first time. The default for all items is cleared.

    Apple Deployment Program Account settings screen

    • Set up as New or Restore: Set up the device as new or from an iCloud or Apple App Store backup.
    • Location services: Set up the location service on the device.
    • Apple ID: Set up a Managed Apple ID account for the device.
    • Terms and conditions: Require users to accept terms and conditions for use of the device.
    • Siri: Use or not use Siri on the device.
    • FileVault: Use FileVault to encrypt the startup disk. XenMobile only applies the FileVault setting if the system has a single local user account and that account is signed into iCloud.

      You can use the macOS FileVault Disk Encryption feature to protect the system volume by encrypting its contents (https://support.apple.com/en-us/HT204837). If you run the Setup assistant on a late-model portable Mac that doesn’t have FileVault turned on, you might be prompted to turn on this feature. The prompt appears on both new systems and systems upgraded to OS X 10.10 or 10.11, but only if the system has a single local administrator account and that account is signed into iCloud.

    • App analytics: Set up whether to share crash data and usage statistics with Apple.
    • Privacy: Prevent users from seeing the Data and privacy pane during setup of ABM devices. For macOS 10.13 and later.
    • iCloud Analytics: Prevent users from seeing the iCloud analytics screen during setup of ABM devices. For macOS 10.13 and later.
    • iCloud Documents and Desktop: Prevent users from seeing the iCloud documents and desktop screen during setup of ABM devices. For macOS 10.13 and later.
    • Appearance: Prevents the user from seeing the Choose Your Look screen during setup of the ABM devices. For macOS 10.14 and later.

    • Local account setup options: Specify the settings to create an administrator account on the device. Users log in to their macOS device with this information. XenMobile creates the account, using the specified information.
      • Create primary account as a standard user: Instead of granting this user administrator privileges on the device, XenMobile creates the user with standard permissions. Because macOS requires an administrator account, XenMobile creates an administrator account first, then makes a new standard account and sets it as primary.
      • Admin full name: Type the name the system displays for the administrator account.
      • Admin short name: Type the name the device displays for the home folder and in the shell.
      • Admin password: Type a secure password for the administrator account.
      • Show administrator account in Users and Groups: If marked, the administrator account doesn’t appear in Users and Groups in the macOS settings. If you create the primary account as a standard user, enable this setting to hide the administrator account XenMobile creates first.

Renew your connection between the Apple Deployment Program and XenMobile

If your Automated Device Enrollment server token expires, replace the token from Apple School Manager/Apple Business Manager.

Step 1: Download a public key from your XenMobile server

  1. In the XenMobile console, go to Settings > Apple Deployment Program to download a new public key.

Step 2: Create and download a server token file from your Apple account

  1. Sign in to the Apple Deployment Program Portal to download the token.

  2. Open Settings and select the server from which you need a token. Click Edit.

  3. Upload the new public key you downloaded from XenMobile, and save the changes.

  4. Click Download Token to download the new token.

Download a server token image

Step 3: Upload a server token file in XenMobile

  1. In the XenMobile console, go to Settings > Apple Deployment Program. Select the Deployment Program account, click Edit, and upload your server token file.

  2. Click Next and save the changes.

User experience when enrolling an Apple Deployment Program enabled device

When users enroll an Apple Deployment Program enabled device, their experience is as follows.

  1. Users start their Apple Deployment Program enabled device.

  2. XenMobile delivers the Apple Deployment Program configuration that you configured in the XenMobile console to the Apple Deployment Program enabled device.

  3. Users configure the initial settings on their device.

  4. The device automatically starts the XenMobile device enrollment process.

  5. Users continue to configure the other initial settings on their device.

  6. In the home screen, users might be prompted to sign in to Apple App Store so that they can download Citrix Secure Hub.

    Note:

    This step is optional if you configure XenMobile to deploy the Secure Hub app using the device-based volume purchase app assignment. In this case, you don’t need to create an Apple App Store account or use an existing account.

    Apple Deployment Program setup

  7. Users open Secure Hub and type their credentials. If required by the policy, users might be prompted to create and verify a Citrix PIN.

    XenMobile deploys any remaining required apps to the device.

Configure deployment rules of device policies and apps for ABM accounts

You can associate ABM accounts with different device policies and apps by using the Deployment Rules section under Configure > Device Policies and Configure > Apps. You can specify that a policy or app either:

  • Deploys only for a particular ABM account.
  • Deploys for all ABM accounts except the one selected.

The list of ABM accounts includes only those accounts with a status of enabled or disabled. If the ABM account is disabled, the ABM device doesn’t belong to this account. Therefore, XenMobile doesn’t deploy the app or policy to the device.

In the following example, a device policy deploys only for devices with the ABM account name “ABM Account NR”.

Apple device program settings screen

Configure Apple Configurator settings

  1. In the XenMobile console, go to Settings > Apple Configurator Device Enrollment.

    Apple deployment program settings screen

  2. Set Enable Apple Configurator device enrollment to Yes.

  3. The Enrollment URL to enter in Apple Configurator is a read-only field. This setting is the URL for the XenMobile server that communicates with Apple. Later in these steps, you copy and paste the URL into the Apple Configurator. In Apple Configurator 2, the enrollment URL is the XenMobile server fully qualified domain name (FQDN), such as mdm.server.url.com, or the IP address.

  4. To prevent unknown devices from enrolling, set Require device registration before enrollment to Yes. Note: If this setting is Yes, you must add the configured devices to Manage > Devices in XenMobile manually or through a CSV file before enrollment.

  5. To require users of iOS devices to enter their credentials when enrolling, set Require credentials for device enrollment to Yes. The default is not to require credentials for enrollment.

  6. Note: If the XenMobile server is using a trusted SSL certificate, skip this step. Click Export anchor certs and save the certchain.pem file to the macOS keychain (login or System).

    Apple deployment program settings screen

  7. Start the Apple Configurator and go to Prepare > Setup > Configure Settings.

  8. In the Device Enrollment setting:
    • Paste the MDM server URL from step 4 into the MDM server URL box in the Configurator.
    • Copy the Root Certificate Authority and SSL Servers Certificate Authority to the Anchor certificates, if XenMobile isn’t using a trusted SSL certificate.
  9. Use a Dock Connector-to-USB cable to connect devices to the Mac running the Apple Configurator to configure up to 30 connected devices simultaneously. If you do not have a Dock Connector, use one or more powered USB 2.0 high-speed hubs to connect the devices.

  10. Click Prepare. For more information on preparing devices with the Apple Configurator, see the Apple Configurator help page, Prepare devices.

  11. In the Apple Configurator, configure the device policies you require.

  12. As each device is prepared, turn it on to start the iOS Setup Assistant, which prepares the device for first-time use.

Renew or update certificates when using the Apple Deployment Program

When the XenMobile Secure Sockets Layer (SSL) certificate is renewed, you upload a new certificate in the XenMobile console in Settings > Certificates. In the Import dialog box, in Use as, click SSL Listener so that the certificate is used for SSL. After you restart the server, XenMobile uses the new SSL certificate. For more information about certificates in XenMobile, see Uploading Certificates in XenMobile.

It is not necessary to reestablish the trust relationship between Apple Deployment Program and XenMobile when you renew or update the SSL certificate. You can, however, reconfigure your Apple Deployment Program settings at any time by following the preceding steps in this article.

For more information about the Apple Deployment Program, see the Apple documentation.

To place an iOS device in Supervised mode by using the Apple Configurator

Important:

Placing a device into Supervised mode installs the selected version of iOS on the device, completely wiping the device of any previously stored user data or apps.

  1. Install the Apple Configurator from the App Store.

  2. Connect the iOS device to your Apple computer.

  3. Start Apple Configurator. The Configurator shows that you have a device to prepare for supervision.

  4. To prepare the device for supervision:

    • Set the Supervision control to On. Citrix recommends that you choose this setting if you intend to maintain control of the device by reapplying a configuration regularly.

    • Optionally, provide a name for the device.

    • In iOS, click Latest for the latest version of iOS that you want to install.

  5. When you are ready to prepare the device for supervision, click Prepare.