Deploy iOS and macOS devices through Apple DEP

Apple has device enrollment programs for business and education accounts. For business accounts, you enroll in the Apple Deployment Program to use the Apple Device Enrollment Program (DEP) for device enrollment and management in XenMobile. That program is for iOS and macOS devices. For information about signing up for a business Apple Deployment Program account, see this PDF from Apple.

Be aware that the Apple Deployment Program is available for organizations and not individuals. You must provide a considerable amount of corporate details and information to create an Apple Deployment Program account. Thus, it could take time to request and receive approval for accounts.

For education accounts, you create an Apple School Manager account. Apple School Manager unifies the Device Enrollment Program (DEP) and Volume Purchase Program (VPP). Apple School Manager is a type of Education DEP. To create an Apple School Manager account, go to https://school.apple.com/.

Enroll in the Apple Deployment Program

  1. Go to deploy.apple.com to apply for an Apple Deployment Program account. When applying for a DEP account, the best practice is to use an email address for the organization, such as dep@company.com.


    For education accounts, go to https://school.apple.com/.

    Image of Apple DEP setup

  2. After you type your organization information, Apple emails you a temporary password for the new Apple ID.

    Image of Apple DEP setup

  3. You then sign in with your Apple ID and complete the security settings for the account.

    Image of Apple DEP setup

  4. Configure and enable two-step verification, which is required for use with the DEP Portal. During these steps, after you add a phone number, you receive the 4-digit PIN for the two-step verification.

    Image of Apple DEP setup

  5. Log in to the DEP Portal to complete the account configuration using the two-step verification that you set up.

  6. Add your company details and then select from where you purchase devices. For details on purchasing options, see the next section, Order DEP-enabled devices.

    Image of Apple DEP setup

  7. Add the Apple Customer Number or the DEP Reseller ID. Then verify your enrollment details and wait for Apple to approve your account.

    Image of Apple DEP setup

    Image of Apple DEP setup

  8. After you receive your logon credentials from Apple, log in to the Apple DEP Portal.

    Image of Apple DEP setup

    To connect your account to XenMobile, see “Integrate your Apple DEP account with XenMobile” in Bulk enrollment of iOS and macOS devices.

Order DEP-enabled devices

You can order DEP-enabled devices directly from Apple or DEP-enabled authorized resellers or carriers. To order from Apple, provide your Apple Customer ID in the Apple DEP Portal. Your Customer ID enables Apple to associate your purchased devices with your Apple DEP account.

To order from your reseller or carrier, contact your Apple reseller or carrier to check if they participate in the Apple DEP. Ask for the Apple DEP ID of the reseller when purchasing devices. Apple requires that information when you add your Apple DEP reseller to your Apple DEP account. After you add the Apple DEP ID for the reseller, you receive a DEP customer ID. Provide the DEP customer ID to the reseller, who uses the ID to submit information about your device purchases to Apple. For more information, see this Apple website.

Manage DEP-enabled devices

Follow these steps to associate devices with your XenMobile Server by using the DEP Portal to update your Apple DEP account.

  1. Log on to the Apple DEP Portal.

  2. Click Device Enrollment Program and then click Manage Devices. In Choose Devices By, choose the option for which you want to upload and define your Apple DEP-enabled devices: Serial Number, Order Number, or Upload CSV File.

    Image of Apple DEP setup

  3. To assign your devices to a XenMobile Server, under Choose Action, choose Assign to Server. Then, in the list, choose the name of your XenMobile Server. Click OK.

    Image of Apple DEP setup

    Your Apple DEP devices are now associated with the selected XenMobile Server.

    Image of Apple DEP setup

    XenMobile displays a License Expiration Warning when Apple DEP tokens are nearing expiration or have expired.

    Image of Apple DEP setup

Renew your enrollment in the Apple Deployment Program

Step 1: Download a public key from your XenMobile server

  1. In the XenMobile console, go to Settings > Apple Device Enrollment Program (DEP) to download a new public key.

Step 2: Create and download a server token file from your Apple account

  1. Sign in to the Apple Deployment Program Portal to renew the token.

  2. Open Settings > MDM Server Info and click Edit. Upload the new public key you downloaded from XenMobile, and save the changes.

  3. Go back to Settings to download the new token.

Download a server token image

Step 3: Upload a server token file in XenMobile

  1. In XenMobile, go to Settings > Apple Device Enrollment Program (DEP). Select the DEP account, click Edit, and upload your server token file.

  2. Click Next and save the changes.

User experience when enrolling an Apple DEP-enabled device

When users enroll an Apple DEP-enabled device, their experience is as follows.

  1. Users start their Apple DEP-enabled device.

  2. XenMobile delivers the Apple DEP configuration that you configured in the XenMobile console to the Apple DEP-enabled device.

  3. Users configure the initial settings on their device.

  4. The device automatically starts the XenMobile device enrollment process.

  5. Users continue to configure the other initial settings on their device.

  6. In the home screen, users might be prompted to sign in to iTunes so that they can download Citrix Secure Hub.


    This step is optional if XenMobile is configured to deploy the Secure Hub app using the device-based Volume Purchase Program (VPP) app assignment. In this case, you don’t need to create an iTunes account or use an existing account.

    Image of Apple DEP setup

  7. Users open Secure Hub and type their credentials. If required by the policy, users might be prompted to create and verify a Citrix PIN.

    XenMobile deploys any remaining required apps to the device.