Enroll Non-DEP iOS 11 devices from Apple Configurator using Enrollment URL

Content

In 10.66 release, MaaS360 extends capabilities to enroll any Non-DEP iOS 11 devices from Apple Configurator. This enrollment is possible by using enrollment URL in MaaS360 portal that supports both enrollment methods such as 'With Authentication' and 'Without Authentication'. Previously, MaaS360 supported only Non-DEP to DEP device enrollment from Apple Configurator.

Supported methods to enroll Non-DEP iOS 11 device from Apple Configurator

MaaS360 offers Enrollment URL that supports Non-DEP iOS 11 device enrollment from Apple Configurator. The workflow supports following methods:

1. With Authentication-The enrollment process involves an authentication step during enrollment. User credentials that are accepted are MaaS360 user/LDAP/AD (Portal admin credentials are NOT supported). Only on successfully completing authentication, you are able to proceed through the authentication step. Without authenticating, enrollment cannot be completed. Note:  Since the method involves user authentication, the iOS device is assigned to the user. 

2. Without Authentication-This enrollment process does not involve user authentication. The workflow is similar to “With Authentication” method except that the URL used in this workflow varies.

How to enroll Non-DEP iOS 11 device from Apple Configurator using Authentication method?

1. From Devices > Enrollments > Other Enrollment Options, select Apple Configurator and choose MDM Server URL.
2. Select Non-DEP only Enrollment URL to get MDM server URL for enrolling Non-DEP iOS device.
3. Choose With Authentication method. Copy MDM Server URL mentioned here and click Close.
   In this method user authentication is involved during enrollment. User credentials that are accepted are MaaS360 user/LDAP/AD (Portal admin credentials are not supported).

4. Connect the iOS device to a Mac and open Apple Configurator 2.5 on the device.
5. Select All Devices, click Prepare and select Manual Configuration method to prepare device.

• Do not check the option ‘Add to Device Enrollment Program’.
• You can choose to make the device as supervise device by checking the option ‘Supervise devices’ or unsupervised by not checking this option. If you choose to supervise, you also get an option to make the device pair with other Mac devices (other than the one being used to enroll the iOS device) by checking ‘Allow devices to pair with other computers’ or not allow by not checking the option. Click Next.

6. Choose MDM Server from the list if you have already added a server, Click Next and continue to step 7. If you want to define a new server, follow the steps to add a new server.

How to add a new Server?

1. Select New Sever from the list.
2. Enter the server Name, Host name or URL that is obtained from step 3. (With Authentication or Without Authentication URL based on the enrollment method selected.)
3. Click Next and continue to step 7.

Result: New MDM Server is added.

7. Add trust anchor certificates for the MDM server by selecting the *.m.dm server and click Next.

8. Assign the device to an organization that is used to supervise the device from the list, click Next and continue to step 9. If you want to add a new organization, follow the steps to add new organization.

How to add a new organization?

1. Select New Organization from the list.
2. Skip Sign in to the Device Enrollment Program, continue to step 3.
3. Enter information about your organization.

4. If it is the first time that you are enrolling a device from Apple Configurator, select “Generate a new supervision identity”. If you have already created a supervision identity, select “Choose an existing supervision identity”. Click Next. Continue to step 9.
   Note: If you chose “Choose an existing supervision identity”, select an identity file and click Next. 

Result: New organization is added.

9. Configure iOS Setup Assistant as needed. Choose from the options whether to show all steps, only some steps, or do not show any of these steps for further configuration and click Next.
   Option Show only some steps is selected in the illustrated image.
   Note: Based on the setup assistant configurations that are selected here, you see the same setup steps on the device for further configuration. 

10. You would see warning message as illustrated in the image on the device. Click Erase if you want to proceed, else, click Stop. Note: The warning message occurs if the device is prepared previously.

11. After the device is prepared, following screens would be shown on the device. Enter user credentials when you see the prompt for credentials. Note: Customizable Setup screens are not included.

Result: The enrollment setup by using 'With Authentication' method is completed once you see “Welcome to iPad” screen.

How to enroll Non-DEP iOS 11 device from Apple Configurator using Without Authentication method?

The enrollment process 'Without Authentication' is similar to 'With Authentication'. In the 'Non-DEP Only Enrollment', the expiry time of the URL for 'Without Authentication' enrollment can be  customized as needed. You need to contact IBM MaaS360 Customer Support team to customize URL expiry time. It can be 7 days, 30 days, 60 days, 90 days, 180 days or 365 days. Default expiry time of the URL is 30 days.

Follow the steps under enrolling Non-DEP device using authentication method except for the following changes:

• In step 3, you must copy the URL under “Without Authentication” section as illustrated in the image.

• In step 11, authentication step is not applicable on the device. Following screens would be shown on the device. Prompt to enter user credentials on the device is not applicable for 'Without Authentication' enrollment method.

Result: The enrollment setup by using 'Without Authentication' method is completed once you see “Welcome to iPad” screen.