Walkthrough: Add iOS 11+ devices to DEP with Apple Configurator

Last updated April 19, 2019

New Options as of iOS 11

With the release of iOS 11, Apple provided businesses a means to add any existing iOS device to their Device Enrollment Program (DEP) account. Previously, only new device purchases and certain devices purchased through eligible channels were able to be added after the fact. The latter still required assistance from Apple and third party vendors to do so. This new functionality allows adding a device to a DEP account using nothing more than Apple Configurator 2.5 or later and a wired connection to the iOS device.

Why add devices to DEP?

When a device is enrolled with SimpleMDM using Apple DEP, iOS grants you, the administrator, privileges that are unavailable for devices enrolled manually. For instance, the SimpleMDM profile can be marked as unremovable, preventing a user from unenrolling their device manually. Additional customizations of the Setup Wizard screens can be made, hiding steps deemed unneeded by your organization. If the device is wiped in the future, it will automatically enroll with SimpleMDM. The process of enrollment using Apple Configurator is only needed when first adding the device to DEP. To learn more about Apple DEP, read our guide: Explained: The Apple Device Enrollment Program (Apple DEP)

Requirements

To add a device to DEP using Apple Configurator, the device must be running iOS 11 or greater and you must have Apple Configurator software 2.5 or greater. This procedure does not work for macOS computers at this time. Apple Configurator can be downloaded from the Apple App Store.

Walkthrough

If you are familiar with the process of supervising a device using Apple Configurator, you will find this process is very similar.

For this walkthrough, we used a beta version of Apple Configurator 2.5. Your version will likely not include the beta banner.

To start, connect the iOS device to a macOS computer using a USB to lightning cable. Open Apple Configurator 2.5 or newer. If the iOS device is not already running iOS 11 or newer, be sure to first upgrade it or else you will encounter errors during the DEP enrollment steps.

Once the device appears in Apple Configurator, click the “Prepare” button. On the resulting screen, check “Add to Device Enrollment Program” and “Activate and complete enrollment”. The other two options can be checked or unchecked to meet your preference.

The next screen asks you to set up MDM server settings. You can provide enrollment settings for your SimpleMDM account here. These settings will be used for this initial enrollment. If the device is reinitialized at a later time, your DEP account configuration will be used instead. We defined a new MDM server in Configurator and used a group enrollment URL from our SimpleMDM account.

A long standing bug exists in Configurator causes an “Unable to verify the server’s enrollment URL” message to appear. You can safely ignore this message and click “Next”.

You will eventually reach an “Assign to Organization” or “Sign in to the Device Enrollment Program” screen. Your device will be added to the DEP account selected here. Provide the Apple ID and password you use to sign into the DEP Account. You will need to complete a two-factor sign in.

You will be asked whether you would like to generate or choose a supervisor identity. We chose to generate a new identity. If you do not know what this is, you probably want to generate a new identity as well.

Apple Configurator will allow you to customize the Setup Assistant during device initialization. These settings are only for the individual device being prepared and do not affect your DEP configuration.

Configurator will prompt you for a Network Profile. This profile will be used by the device to gain access to the internet and communicate with DEP. If you have not already created a network profile, you can do so by clicking the File menu and selecting “New Profile”. Select the Wi-Fi section, input the necessary information for your network, and then select File and then “Save As” to create the profile.

As a final step, Configurator will ask if any automated enrollment credentials are needed to enroll your device in SimpleMDM. You can leave these fields blank.

At this point, Apple Configurator typically prompts with the following message: “Configurator could not perform the requested action because the device has already been prepared. Click Erase to erase and prepare the device again. All content and settings will be deleted. This cannot be undone.”. While the message is ominous, it is just a warning that this process will erase any existing data on the device. Click “Erase” to proceed.

Configurator will begin the process of initializing your device and enrolling it in DEP. The steps we observed are as follows:

  1. Downloading activation record instance
  2. Activating iOS on the device
  3. Downloading activation record for device
  4. Activating iOS on the device
  5. Downloading and applying cloud configuration
  6. Awaiting final MDM configuration

Once complete, the device will be enrolled in SimpleMDM and added to your DEP account. We found that the serial number appeared in the DEP portal almost immediately.

Common Problem: MobileDeviceKit error

You may receive the following error: “An unexpected error has occurred: The device returned an unexpected status. (CommandFormatError) [com.apple.configurator.MobileDeviceKit.error]”. We observed this error when trying to update to iOS 11 while enrolling with DEP in the same step. We found that we had to complete two separate steps. First, update the device to iOS 11 and then add the device to DEP.

 

Comments (14)

Hi there
After completing this method, the Wi-Fi profile used to set up the iPad is still on the device. How do we remove it?
Thanks

If the profile was installed by Apple Configurator, you will need to remove the profile manually, outside of SimpleMDM.

Hi Nix! I do not know what document you are referring to. You might check whether it is stating that iOS 7.0 devices can be added to DEP *by the customer after purchase*. It’s likely stating that iOS 7.0 devices can be added to DEP by the vendor or by Apple, which is something usually handled during the purchasing process or after the fact by Apple staff.

This article is specifically for adding devices to DEP using Apple Configurator software. Our more general article on adding devices to DEP explains the other methods available, which applies to devices before iOS 11.

Is the Network Profile step required? What if you dont create one and continue? Does it mean the user has to connect manually to WiFi during setup assistant?
And can we remove the device from dep if neccessary?

The device will need a way to connect to the internet in order to complete DEP and MDM enrollment. Feel free to try the process without a WiFi payload; you may be allowed to provide WiFi information during device initialization though this will become cumbersome if setting up more than a single device.

The user of the device can remove themselves from DEP during the initial 30 day “provisional” period by unenrolling from SimpleMDM. After 30 days, the device cannot be removed from DEP by the user. The administrator will be able to “disown” the device through the DEP portal if need be.

What is this “URL from our SimpleMDM” Is this to be the BlackBerry UEM URL or can be just any URL?

“We defined a new MDM server in Configurator and used a group enrollment URL from our SimpleMDM account.”

@LACHLAN HARRIS I use a dedicated profile for this and turn on Automatically Remove Profile on the General Tab.

Select After Interval
Set Days and/or Hours values to your needed removal period. I generally use 1 to 6 hours.

Hello,

I work for an IT reseller and normally purchase Apple from Disty, due to time limits we had to order from Apple direct.

How do I get this DEP registered?

I have all the DEP details just not sure who to ask, any help would be massively appreciated.

Cheers
Matt Thorp

Hi Matt! We recommend contacting your reseller (in this case, Disty) to assist you in getting those devices added in your DEP (or Apple Business Manager) portal.

I was informed by Apple Support that, in order to complete MDM enrollment and to activate remote administration for a given device, the MDM server domain name should have a PTR record that links the underlying IP address to the same domain name. The enrollment process evidently executes a reverse check on the server’s IP address and will not work if the PTR record is missing or is assigned to another domain name.

A reverse check on the SimpleMDM IP address using the ‘host’ command points to us-west-2.compute.amazonaws.com.
I would be interested to know how the SimpleMDM server is able to circumvent the above condition allowing for the mobile device to successfully connect wirelessly and complete the enrollment.

Hi Andy- We are not familiar with this requirement. We suggest asking Apple Support to provide a link to documentation referencing this requirement.

Leave a Reply

Your email address will not be published. Required fields are marked *

See Why Apple Admins Prefer SimpleMDM

Start My FREE 30-Day Trial Now
  • How to Enroll an Apple TV in MDM - 3 Methods

    By on January 24, 2019
    Read more
  • How To Sign macOS PKGs for Deployment with MDM

    By on October 4, 2018
    Read more
  • How To Use Custom Configuration Profiles With Custom Attributes

    By on September 17, 2018
    Read more

See Why Apple Admins Prefer SimpleMDM No strings. No Spam.

Start My 30-Day Free Trial Now