The Apple Device Enrollment Program (DEP) allows administrators to pre-provision iOS, iPadOS, and macOS devices to automatically self-enroll into Systems Manager before even touching them, and provides an additional level of management control through bulk device supervision. This greatly simplifies adding and deploying iOS, iPadOS, macOS, and tvOS devices with Automatic Device Enrollment into Meraki Systems Manager. This article will cover how to use the Apple Automatic Device Enrollment with System Manager.
For additional information on DEP, including how to qualify for the program, please review Apple's official deployment guide. Additional information can be found directly from Apple Business Manager portal or Apple School Manager portal.
Not to sound rude, but what the hell? All of the documentation for Apple Configurator 2 is specifically for MAC. Why would this question even come up? Purchase a newer / used Mac and download Apple Configurator 2. Apple Configurator 2.7.1Download You’re now watching this thread and will receive emails when there’s activity. Click again to stop watching or visit your profile to manage your watched threads. Apple Configurator 2 is a free software only available for Mac, that belongs to the category'Utilities & Tools', and created by Apple Inc. More about Apple Configurator 2 This program is available for users with the operating system Mac OS X and more recent versions, and it is available in different languages such as English, Spanish, and German. After I enrolled it via configurator and logged into DEP there was the new Added by Apple configurator listed by by MDM server. I was immediately able to go to assign devices and put in the serial number of the iPad I just enrolled in DEP and assign it to my MDM server. I logged into my MDM and could see the iPad under my DEP devices. What's new in Apple Configurator 2.7.1. Preparing supervised devices for management by Configurator now automatically allows USB accessory connections while device is locked; Configure new supervised-only restriction for iOS 11.4.1: Allow USB accessories while device is locked; Apple Configurator 2.3 Dmg File What's new in Apple Configurator 2.7.
The following video also outlines an example DEP configuration and deployment through Systems Manager:
With the release of iOS 11, you can now add any iOS 11+ device into an existing DEP account through Apple Configurator, even if it was not purchased from Apple or an Apple reseller. For steps on how to do this, see this article.
Linking Systems Manager to Apple DEP
In order to use the Apple DEP with Systems Manager, a Systems Manager deployment must be linked to an organization within DEP. These steps assume an Apple ID for the organization has already been created, as outlined in the Device Enrollment Program Guide. You can also use Apple Business Manager portal or Apple School Manager portal for the same functionality.
- In Dashboard, create an EMM network for Systems Manager.
- Navigate to Organization > Configure > MDM, then scroll down to the Apple Device Enrollment Program section.
- Download the Meraki_Apple_DEP_cert.pem file provided.
- If someone has downloaded the .pem file previously, and the server token has expired, click clear token in order to download the .pem file again.
- In another browser window, go to the Apple Business Manager or Apple School Manager portal and sign in with the Apple ID tied to the desired organization.
- Navigate to Settings > Device Management Settings
- Click Add MDM Server.
- Enter a Name for the MDM server in DEP, then click Next.
- Click Choose File... and upload the .pem public key downloaded in step 3, then click Next.
- Download the server token provided, then click Done.
- Back in Dashboard, click on the Choose File button in the DEP section.
- Select/upload the server token downloaded in step 9.
- Choose the default Systems Manager network where devices tied to this MDM server in DEP will be enrolled.
- Click Save Changes.
If you encounter an error uploading the server token to Dashboard, make sure that the file name ends in 'smime.p7m' without any trailing characters like '(1)' that may appear from downloading multiple copies of the file.
The last downloaded DEP token on the Apple portal is the only one that MDMs can sync with. You may see error 'Sync failed: Unable to connect to Apple's servers at this time.' or 'Sync failed. Please try again later.' in the event that the current token is unable to sync. The Apple portal shows the following warning if someone tries to download a token twice:
In this case, the token would need to be renewed again in order to continue syncing with Meraki Systems Manager.
Renewing a DEP Token
Apple DEP tokens last for one year by design. To continue enrolling via DEP:
- In your Meraki Dashboard navigate to Organization > MDM and click on the Apple DEP Server you want to renew. In the Edit DEP Server window press Update Token.
- Then, press download your public key cert to download the Meraki_Apple_DEP_cert.pem file.
- Log in to the Apple Business Manager or Apple School Manager portal.
- Navigate to Settings > MDM Servers > Click on the MDM server to renew ('Meraki' in the screenshot below).
- Click on Edit and then click on Upload New...
- Upload the Meraki_Apple_DEP_cert.pem file and click Apply to save. Then press on Download Token to download the Meraki_Token_smime.p7m file.
- Now back in your Meraki Dashboard upload the Meraki_Token_smime.p7m file to Meraki to finish updating your DEP token.
After this process is finished, the token is valid for another 365 days.
If the existing DEP token is cleared or the DEP server is deleted instead of renewing the token, all associated DEP settings profiles will be removed from the Systems Manager > DEP page and will have to be re-created manually.
Importing Devices
The following steps will help you import devices into your Apple DEP server and sync them into Systems Manager.
To import devices into your Apple DEP server via Apple Order Number or Serial Number:
- In Apple Apple Business Manager or Apple School Manager, navigate to Devices > Device Assignments
- Choose Order Number, Serial Number, or Upload CSV file and provide the appropriate information.
- Choose the Assign to Server action and select the desired MDM server.
- Click Done.
To sync the devices from your Apple DEP server into System Manager, there are two ways.
- Navigate to Systems Manager > Manage > DEP, this will cause a partial sync between System Manager and Apple DEP server.
- If devices are missing, you can try a full sync by clicking on the full sync button in the top right of the page.
Note: To be eligible, devices must have been purchased directly from Apple within the last three years, or through participating resellers and carriers. This requirement will be changing with iOS 11, which will allow users to add iOS or iPadOS devices from any purchaser into DEP. For more information regarding this and supported countries, please refer to Apple's Device Enrollment Program page.
Applying Settings to Devices
DEP settings are applied during setup assistant, either upon setting up the device for the first time, or after a factory reset for devices already in use.
DEP Enrollment Status
There are 3 states for the 'DEP enrollment' status column. If you've just synced your devices from the DEP server into Systems Manager, they will be labeled 'Empty'.
- Empty: The default state when devices are first synced from DEP into Systems Manager. This means that the device has no DEP settings assigned to them.
- Assigned: This means new DEP settings have been assigned to the device, but not yet applied. Upon initial setup, or after a factory reset, the applied settings will take effect.
- Pushed: This means the device has its DEP settings applied. You can see information on what settings were pushed, and when, on the other columns of the table.
NOTE: DEP Push status is only related to Device Enrollment status, and does not strictly determine it. This means that you may have devices which show their DEP payloads as 'Empty' which have already been enrolled (and therefore, have a valid link to their Device Details page in the Name column), and devices which show their DEP payloads as 'Pushed' but have yet to complete enrollment (most often because they stopped at the authentication step).
Assigning Settings
After devices have been assigned to Systems Manager via DEP, they will automatically be enrolled in the default Systems Manager network upon setup. Additional configurations such as supervising the device or skipping setup steps will further customize and streamline your deployment.
- Navigate to Systems Manager > Manage > DEP within the Systems Manager network.
- Click the checkbox next to any devices that require settings be applied.
- Click Assign settings.
- If you have existing setting presets, select them from the dropdown. Otherwise, complete the fields/selections that appear:
- Name: A friendly name for the group of settings applied.
- Support phone number: A number provided to users during setup if help is required.
- Support email address: An email address provided to users during setup if help is required.
- Department: Display the organization department the iPad is assigned to. This is displayed during setup.
- Supervise: Supervise devices upon enrollment. This is now required for all DEP payloads.
- Supervising host certificate: Devices are only allowed to pair with computers that have the matching keypair.
- Note: If left unconfigured and no pairing restriction payload is assigned, the device will have the ability to pair with any computer.
- Allow pairing: Devices can be paired with a computer. Note that if unchecked, devices will not be able to connect to applications like Xcode or iTunes on a computer, which will limit the ability to troubleshoot or restore the device, especially in cases where it will be locked into single app mode.
- Note: In iOS 13+, this setting has been migrated to the Restrictions profile, and should be considered deprecated on DEP payloads.
- Mandatory: Users are required to complete enrollment during setup, and cannot skip the step.
- Note: In iOS 13+, all devices with assigned DEP settings must go through DEP enrollment setup
- Removable: When checked, the management profile can be removed by the user. When unchecked, the management profile cannot be removed by the user. See here for more info.
- Skip: Allows you to specify pages during the setup process to skip, e.g. hiding the prompt to set or sign into an Apple ID. These can be completed later if needed.
- Shared iPad: Used for shared device deployments with Apple School Manager. Do not select this unless you have ASM provisioned with managed Apple IDs. See official Apple documentation here.
- Await Configuration: If selected, the device will not continue in Setup Assistant until the device is configured.
- Note: Currently, this setting is only scoped to the device receiving the 'Maximum Users' payload.
- Maximum Users: The maximum number of users that can use a Shared iPad
- Click Assign # device(s). You should see the 'DEP enrollment' status update to 'Assigned'.
- In most cases, the device(s) should be factory reset at this point. This is required to ensure the device is activated and configured with DEP settings.
- On a Mac, restart in Recovery Mode and reinstall the operating system. On an iOS or iPadOS device, navigate to Settings > General > Reset, then tap Erase All Content and Settings.
- Confirm by tapping Erase.
- In some cases, this may be required for brand-new device as well, if Apple doesn't correctly push the DEP settings during the initial activation process.
Please choose Set Up as New Device,or skip the 'Restore from Backup' option entirely when assigning the DEP settings. Apple does not recommend restoring from iCloud, iTunes, or Migration Assistance backups if the supervision state of the device is changing. iCloud can be signed into after device setup to sync settings. Apple information related to this can be found here.
To apply configuration profiles and settings to devices, the appropriate tags will need to be applied. These can be configured in advance so that once a device enrolls, the tags configured below are automatically applied. Profiles and apps tied to those tags will then be automatically installed upon enrollment for a seamless experience.
- Navigate to Systems Manager > Manage > DEP .
- Click the checkbox next to any devices the tag must be applied to.
- Click Tag.
- Within the Add box, type the tag that should be applied to the device(s). If it is an existing tag, select it from the list. Otherwise, click Add option create a new tag. Tags must not contain spaces.
- Click Add to apply the tag(s).
Removing Settings from Devices
In the event a device needs to be reset and managed under different conditions, the settings applied via DEP can be removed.
- Navigate to Systems Manager > Manage > DEP.
- Click the checkbox next to the device(s) in question.
- Click Remove settings.
To overwrite existing settings, follow the previous steps for applying settings. Note that the newly assigned settings will not apply until the device has been factory reset.
If tags were applied to a device prior to enrollment, they can also be removed to prevent profiles and apps from associating.
- Navigate to Systems Manager > Manage > DEP.
- Click the checkbox next to the device(s) in question.
- Click Tag.
- In the Remove box, select any tags that should be removed from the device.
- Click Remove.
Show/Hide Settings
To hide unused DEP settings presets from being displayed when applying settings, hit the 'Show/Hide settings' option and uncheck the settings you wish to hide.
Recovering DEP Devices
If a DEP-enrolled device is removed from Systems Manager, it will not automatically reappear without taking additional steps to sync Dashboard with Apple DEP.
For specific instructions on DEP device recovery, please refer to our documentation for more info.
Clearing Apple DEP Token
There are some instances where a DEP token needs to be removed to resolve an issue, or to use a different MDM server on the Apple side. To do this, navigate to the Organization > MDM page. Under Apple Device Enrollment Program, click the Clear Server Token button. This will remove the existing token and allow a new one to be uploaded.
Note: Once the DEP token has been cleared, the client drop-down menu under Systems Manager > Manage > DEP with existing DEP settings will be cleared.
It is important to note that any devices that need to be associated with the organization in Dashboard must also be assigned to the new MDM server within Apple's DEP portal. So if the MDM server is changing, the devices should also be reassigned. Avoid doing this if possible when there are a large number of devices already assigned with settings, as clearing the DEP token will purge these assigned settings in the cloud (but not on devices themselves). It is also recommended that a list of assigned devices be exported to a spreadsheet, within the Apple site, to aid in the reassignment process.
- Apple Configurator 1.7.2 is a recommended update for all Apple Configurator users. This update is available from the Updates pane of the Mac App Store. About Configurator To create or install an iOS configuration profile, use Apple Configurator or a Mobile Device Management (MDM) solution like Profile Manager (included with OS X Server).
- Apple Configurator 2 download location. Posted: by PAC. With the removal of Apple TV 3 support in Apple configurator (AC) 2.5 i am in need of finding AC 2 for i can put it on a spare computer until Apple Developers patch AC2.5 to allow Apple TV 3 support ( they have said they would).
- Apple Configurator 1 Installing Apple Configurator Creating A Backup Using Apple Configurator Creating A Profile Using Apple Configurator Restoring A Backup Using Apple Configurator Applying A Profile Using Apple Configurator Supervising Non-DEP Devices Using Apple Configurator Basic Device Management Using Apple Configurator Install Fonts Using Apple Configurator Manage Website Filters.
- May 25, 2018 Solution: There is no such thing as the Apple Configurator for Windows. Apple made it MacOS only. You can try the iPhone Configuration Utility if you want.
Last updated October 29, 2019
Apple Configurator 1.7.2 is a recommended update for all Apple Configurator users. This update is available from the Updates pane of the Mac App Store. About Configurator. To create or install an iOS configuration profile, use Apple Configurator or a Mobile Device Management (MDM) solution like Profile Manager (included with OS X Server).
What is Apple Configurator?
Apple Configurator is a macOS application that allows administrators to create configurations and apply them to iOS devices. Before Apple Configurator, Apple offered iPhone Configuration Utility. Apple Configurator is the continuation of this sunset utility.
The range of configuration options in Configurator is extensive. Administrators can control minimum security requirements for passcodes, VPN configurations, on-device certificates, and even fonts. Generally, any configurations that can be applied via mobile device management (MDM) are also available in Apple Configurator.
Additionally, Apple Configurator provides the ability for an administrator to select which apps to install to iOS. Sign in with an Apple ID and select any app downloaded or purchased previously under that Apple ID.
How Does it Work?
How do i install dmg files on my mac. Apple Configurator combines these two capabilities to create a blueprint:
- Configurations (aka profiles – made up of individual payloads)
- Apps
An administrator is able to create multiple blueprints. Common groupings include role-based (executive, manager, contributor) or department-based (sales, marketing, support). Blueprints can also be layered on a device, allowing multiple configurations to overlap.
With blueprints configured, place Apple Configurator in ‘prepare’ mode. Then, each iOS device connects via USB or lightning and Apple Configurator pushes the configuration to the device. Also during this time, administrators can wipe devices, upgrade iOS, place into supervision mode, enroll with an MDM, etc.
The process can be time-consuming if one’s upgrading iOS or switching to supervised mode (which requires a system wipe). In these cases, we find many administrators use high-capacity USB hubs. Though we haven’t used it personally, the Cambrionix PowerPad15 is an example of a USB hub for this very purpose.
Sidenote: If looking to purchase a hub, check the capacity of power to the hub. If the wattage is too low, devices may not charge while plugged in. Decide if this is a requirement for your organization.
Why Use Both Configurator and MDM?
After explaining the functionality of Apple Configurator, an often asked question is: So why do I need MDM if I can manage configurations and apps this way? The question is a fair one, and the answer largely depends upon your organizational needs.
Apple Configurator can provide parity with MDM for some organizations with limited requirements. The big difference is the ability to control configurations after deployment. With Configurator, once an administrator unplugs the device, no further communication occurs unless the device plugs back into a computer. With MDM, administrators control configurations via WiFi or cellular connection.
Limited abilities exist to manage apps in Configurator. It only enables the basic process of installing selected apps. However, MDM will allow administrators to distribute company-owned app licenses purchased through Apple Business Manager (formerly Volume Purchase Program – VPP) as well as remotely update and remove apps. MDM is even capable of pushing app-specific configurations.
If you’re interested in how MDM can be used to simplify app deployment, we strongly recommend this read: Install Apps Remotely to iPads and iPhones which provides a comprehensive view of the many ways to deploy apps, each having its own strengths.
MDM provides additional features that an administrator can enable remotely. They can lock a device, wipe its contents, and monitor app installation. MDM also allows an administrator to access advanced functionalities, like forcing a device to only display a single app. A great example is the Square point of sale system.
Organizations learn to establish a balance when using both technologies. Apple Configurator is able to make sure all devices run the latest iOS version, are supervised and have an initial WiFi network connection. MDM is then used for all further configurations and management.
How To Enroll With MDM Using Apple Configurator
Enrolling a device with MDM generally occurs via a link either sent to the device by SMS or email or manually typed into a browser. This is reasonable for only a few devices or if employees will be enrolling their own devices. It absolutely does not scale for companies with a large number of company-owned devices that need to be set up. Instead, an organization will generally use the Apple Device Enrollment Program (read Explained: The Apple Device Enrollment Program) to have devices automatically configured with their MDM out-of-the-box, or they’ll use Apple Configurator.
Apple Configurator App
We’ll now explain how to configure a device with MDM using Apple Configurator. To start, if you haven’t already, download Apple Configurator from the Mac App Store. Install the app and run it.
Once the application is running, plug your device into the computer.
Next, click the ‘Prepare’ button from the top bar of the app.
Configurator will ask you which mode you’d like to use. Select ‘Manual’ unless you have an Apple Business Manager account and want to add devices to it.
Apple Configurator will ask you if you’d like to assign the device to an MDM. Select ‘New server…’ if you haven’t completed this process before. The following screen will allow you to specify a name for your MDM as well as the enrollment URL.
The process for getting an enrollment URL varies between MDM vendors. For SimpleMDM, you must create an Enrollment (either group or one-time) in order to generate the URL as shown below. Paste the enrollment URL into Apple Configurator.
The remaining steps are not MDM-specific. The prompt asks if you’d like to:
- Supervise the device and block other computers from managing it
- Provide information about your organization to display on the device
- Skip certain set-up screens during the initial iOS startup
- Create or use an existing configurator identity. This is essentially a certificate that allows you to re-access these devices down the road with Apple Configurator on the same or on a different computer.
Once you’ve completed these steps, Configurator will begin setting up the devices you selected initially or plugin subsequently. The devices appear automatically in your MDM as they configure.
We run Windows. Can I Use Apple Configurator?
The strict answer is ‘no’. Apple Configurator software is only for macOS; Apple does not distribute a Windows version.
The nitty-gritty answer is ‘sort of’. None of these methods are recommended and may provide more pain than gain, so we generally recommend that organizations in this scenario purchase a Mac Mini to have as a resource for around the office. If interested in going down the rabbit hole, here are some methods that we’ve heard employed:
- Apple used to distribute a Windows version of the iPhone Configuration Utility. It’s still available on c net here. The last software release was January of 2013. At best it’s missing many features and at worse it won’t work at all.
- Run macOS as a virtual machine on Windows. We’re pretty sure this breaks Apple macOS software licensing rules, so we cannot recommend this methodology. We’ve heard some reports that most virtual machine software handles USB emulation in a manner that causes issues when connecting and disconnection iOS devices, but we cannot confirm this.
- Use Apple DEP instead. When using MDM, Apple DEP substitutes for Apple Configurator. Apple DEP devices are ready out-of-the-box, eliminating the need for USB/lightning connections and extra touches. Referenced earlier, you can learn more about Apple DEP via this article. If you’d like to use DEP, apply for an account at deploy.apple.com.
If you aren’t already using MDM, manage your devices with a SimpleMDM account. Feel free to ask questions in the comments section. We’re here to help!
- Checked
27 / 08 / 2016 - Apple
www.apple.com
Apple Configurator is an application developed by Apple Inc. and is available for free download on the Mac App Store It was first launched in March 2012. It replaces the iPhone Configuration Utility
| OS | Mac OS X |
| Language | English |
| License & Price | Free |
| Developer | Apple |
| Official website | www.apple.com |
Free Download
Apple Configurator 1.7.2 Download
Reviewed
by moderators
High quality
localization