Apple MDM Software for iOS, iPadOS, macOS and tvOS

Apple mobile device management (MDM) is the remote management of Apple devices used for work, through the device-management framework Apple builds into its operating systems. Organizations use Apple MDM to enroll devices, configure them, secure corporate data, install apps, control software updates, monitor compliance, troubleshoot problems, and reassign or retire devices, without handling each device in person.

Apple's framework covers iPhone, iPad, Mac, and Apple TV, and Apple has extended management to Apple Watch and Apple Vision Pro. Most organization-owned devices are set up through Apple Business Manager or Apple School Manager, where Automated Device Enrollment places them under management and supervision the first time they're turned on. Employee-owned devices take a different path: User Enrollment manages only work accounts, apps, and data, and keeps the employee's personal content out of IT's reach.

ManageEngine Mobile Device Manager Plus (MDM Plus) manages iPhones, iPads, Macs, and Apple TVs from the same console it uses for Android, Windows, and ChromeOS devices.

This Apple MDM guide covers the following:

• What is Apple MDM?
• How does Apple MDM work?
• Why do organizations need Apple device management?
• Apple device enrollment methods compared
• Supervised vs. unsupervised Apple devices
• Key features of an Apple MDM software
• Traditional Apple MDM vs. Declarative Device Management
• Apple device management lifecycle
• Managing BYOD Apple devices and employee privacy
• Managing iOS and iPadOS updates across enterprise devices
• Reassigning Apple devices with Return to Service
• Apple device management for shared and frontline devices
• Managing Apple devices for remote and distributed workforces
• How to manage Apple devices with ManageEngine MDM Plus
• Why choose ManageEngine Mobile Device Manager Plus for Apple device management?

What Is Apple MDM?

Apple Mobile Device Management is a protocol, built into iOS, iPadOS, macOS, tvOS, watchOS, and visionOS, that lets an organization's MDM server send settings and commands to Apple devices. Because the framework is part of the operating system, the device itself applies the settings rather than relying on a heavy third-party agent.

Several pieces work together. An MDM server, such as MDM Plus, holds the policies. The Apple Push Notification service (APNs) tells a device when the server has something new for it. Configuration profiles carry settings like Wi-Fi, VPN, and restrictions. Commands perform actions like lock or erase. Enrollment is the step that connects a device to the MDM server in the first place, and the enrollment method decides how much control the server gets.

With MDM Plus, organizations can manage iPhones, iPads, Macs, and Apple TVs. To learn more, see our guide on what is iOS MDM.

How Does Apple MDM Work?

• Apple's built-in management framework: Every Apple OS includes the MDM client. The device trusts the MDM server it enrolled with and accepts settings and commands only from that server.
• MDM server: The cloud or on-premises server where admins create profiles, assign apps, and send commands. It never connects to devices directly to push data. It queues work and waits for the device to check in.
• Apple Push Notification service (APNs): When the server has queued work, it sends a lightweight push through APNs. The push contains no data. It only wakes the device so it contacts the server. This is why every Apple MDM needs a valid APNs certificate.
• Enrollment profile: A special profile that registers the device with the MDM server and establishes trust. With Automated Device Enrollment, the device downloads it during Setup Assistant. With other methods, the user installs it or signs in with a Managed Apple Account.
• Configuration profiles: Files that contain payloads such as Wi-Fi, VPN, email, passcode, and restrictions. The MDM installs them over the air and can remove them later.
• Device commands: One-time actions like lock, erase, restart, clear passcode, or install an app.
• Status reporting: The device sends back inventory details, such as OS version, installed apps, and installed profiles, along with the results of each command.
• Supervision: A state set at enrollment, usually through Automated Device Enrollment, that marks a device as organization-owned and unlocks additional controls.
• Declarative Device Management (DDM): An extension to the MDM protocol that lets devices apply configurations on their own and report status changes as they happen, instead of waiting for the server to ask.

Why Do Organizations Need Apple Device Management?

Automate Apple Device Provisioning

Setting up devices by hand doesn't scale past a few dozen. With Automated Device Enrollment, a new iPhone or Mac configures itself during setup, so IT can ship it straight to the employee.

Secure Corporate Data and Devices

A lost iPhone with corporate email on it is a data incident waiting to happen. MDM enforces passcodes, restricts data sharing, and lets IT lock, locate, or erase a device remotely.

Standardize Apple Device Configurations

Profiles assigned to a group reach every device in it, so Wi-Fi, VPN, email, and security settings are the same on the first device and the five-hundredth.

Manage Corporate-Owned and BYOD Devices

Organization-owned devices need broad control. Employee-owned devices need privacy. Apple's enrollment methods support both, and MDM applies the right level of management to each.

Deploy and Manage Business Applications

Apps purchased through Apple Business Manager can be assigned to devices and installed without users signing in with an Apple Account, then configured and updated centrally.

Control OS Updates and Compliance

Untested OS updates can break business apps, while delayed updates leave security holes open. MDM lets IT defer updates for testing, then enforce them by a deadline.

Manage Large and Distributed Apple Fleets

For devices spread across offices, stores, schools, and homes, MDM provides one inventory and one place to act, wherever the devices are.

Apple Device Enrollment Methods Compared

Automated Device Enrollment is the recommended route for organization-owned devices bought through Apple or an authorized reseller and assigned in Apple Business Manager or Apple School Manager, because it supervises them during setup. User Enrollment is designed for BYOD and gives the strongest privacy separation. Apple no longer supports profile-based User Enrollment on iOS 18, iPadOS 18, macOS 15, or later, so BYOD enrollment on current devices uses the account-driven flow.

Supervised vs. Unsupervised Apple Devices

Supervision tells the device that the organization owns it. Supervision depends on the enrollment method, not simply on who bought the device. Devices enrolled through Automated Device Enrollment or prepared with Apple Configurator are supervised. Devices enrolled through User Enrollment, account-driven Device Enrollment, or profile-based Device Enrollment are not.

Key Features of an Apple MDM Software

Apple Device Enrollment and Provisioning

• Apple Business Manager and Apple School Manager: Link MDM Plus to Apple Business Manager or Apple School Manager to assign devices to your MDM server and buy apps in volume.
• Automated Device Enrollment: Enroll and supervise organization-owned devices during setup. Learn how to enroll devices with ADE.
• User Enrollment: Enroll personal devices through account-driven User Enrollment using a Managed Apple Account.
• Device Enrollment: Enroll devices through invites, enrollment links, or self enrollment, authenticated with a one-time passcode or Active Directory credentials.
• Apple Configurator: Add devices bought outside Apple's programs and supervise them. See how to enroll with Apple Configurator and enroll Apple TV into ABM.
• APNs certificate: Required before any Apple device can enroll. Learn how to create an APNs certificate.
• Zero-touch provisioning: Devices assigned to a group at enrollment receive that group's profiles and apps automatically.

Learn more about Apple device enrollment.

Apple Device Configuration and Policy Management

Configuration profiles let IT prepare devices remotely, so users get working access to corporate resources without typing settings by hand:

• Wi-Fi, VPN, and network settings: Connect devices to corporate networks and internal resources automatically, including Global HTTP Proxy on supervised devices.
• Certificates: Distribute certificates and use SCEP for certificate-based authentication.
• Email and accounts: Configure Exchange and email accounts so users don't have to set them up.
• Passcodes: Set complexity, length, and maximum failed attempts.
• Restrictions: Control the camera, Safari, App Store access, screen capture, and more. Restrict AirDrop and iCloud features, such as iCloud Photos, to stop corporate data leaving the device.
• Bluetooth and device-specific controls: Manage settings like Bluetooth modification, and lock devices into apps with App Lock.

Settings vary by platform and enrollment. Many restrictions, including blocking AirDrop and App Store installs, require supervision. Macs, iPhones, iPads, and Apple TVs each support a different set of payloads. User Enrollment allows only a limited set. Learn more about Apple profile management.

Apple Application and Content Management

• App Store apps: Distribute public apps to devices and groups.
• Custom and in-house apps: Distribute custom apps from Apple Business Manager and in-house enterprise apps.
• Managed apps: Apps installed by MDM are managed, so IT can configure them, control data sharing, and remove them along with their data.
• Apple Business Manager app distribution: Buy apps and books in volume through Apps and Books (formerly the Volume Purchase Program, or VPP), and assign licenses to devices so users don't need an Apple Account.
• Location tokens: Use separate tokens to manage licenses by department or location.
• Silent installation: Install apps without user interaction on supervised devices.
• App configuration: Push settings, such as server URLs, to managed apps.
• App updates: Control when apps update, and track license usage in reports.
• App removal: Remove managed apps and their data.
• Allowlisting and blocklisting:Blocklist user-installed and system apps, or allow only approved apps.
• Managed content: Distribute documents securely to managed devices.

Users can also install approved apps on their own from an App Catalog. Learn more about Apple app management.

Apple Device Security and Compliance

• Passcode policies: Enforce passcode strength and the maximum number of failed attempts.
• Encryption: iPhones and iPads encrypt data when a passcode is set. On Macs, MDM Plus manages FileVault encryption.
• Jailbreak detection: The ManageEngine MDM Self Service app detects jailbroken iOS devices. Jailbroken devices can't enroll, and admins can enable a setting to remove detected devices from management automatically.
• Activation Lock: On supervised devices, retrieve the bypass code so a device can be reused even if a user's Apple Account locked it. Learn how to turn off Activation Lock.
• Lost Mode: On supervised devices, lock the device, show a contact message, and locate it with Lost Mode.
• Remote lock: Lock a device immediately.
• Full wipe: Erase all data on a device enrolled through Device Enrollment or Automated Device Enrollment.
• Corporate data removal: Remove managed apps, accounts, and profiles while leaving personal data, which is the only wipe option under User Enrollment.
• Compliance monitoring: Track applied and failed policies, and apply compliance profiles such as geofencing.
• Certificates and device identity: Distribute identity certificates through SCEP for authentication to corporate services.

Learn more about Apple security management and how to secure lost devices.

Apple OS and App Update Management

• Software update policies: Automate OS updates for iOS, iPadOS, and tvOS devices through a single policy that applies to future updates.
• Scheduled updates: Set the enforcement date and time, and notify users ahead of the update.
• Enforced updates: Force critical updates, with the option to clear the passcode so a locked device can install.
• Update deferrals: Delay updates for up to 90 days from the OS release date to test business apps first.
• Supervision requirements: Automated update policies require supervised devices running iOS or iPadOS 10.0 or later, or tvOS 12.0 or later.
• Declarative software update management: On-Demand OS Update Policies target a specific OS version by a deadline on Apple devices running OS 17 or later.
• App update policies: Choose which apps update and when.
• Update compliance: See which devices haven't installed the update a policy requires.

OS update management is available in the Professional, Free, and Trial editions. See Managing iOS and iPadOS updates for details.

Apple Kiosk and Shared Device Management

• Single App Mode: Lock a supervised iPhone or iPad to one app.
• Multi-app kiosk: Allow a small set of approved apps on iPads in kiosk mode.
• Shared iPad: Configure iPads for multiple users, each with their own session.
• Dedicated devices: Set up check-in tablets, digital signage, and POS devices.
• POS and frontline devices: Keep devices on the business app, with settings locked.
• Education and shared devices: Prepare devices that pass between classes or shifts.

Remote Apple Device Management and Troubleshooting

• Remote lock: Available on devices enrolled through Device Enrollment or Automated Device Enrollment.
• Lost Mode: Requires a supervised iPhone or iPad.
• Device wipe: Full erase isn't available on User Enrollment devices. Those support only removal of managed data.
• Passcode clearing: Clear a forgotten passcode on iPhones and iPads enrolled through Device Enrollment or Automated Device Enrollment.
• Restart and shutdown: Available on supervised devices.
• Device information queries: Scan devices on demand for current details.
• Location-related actions: Track device location, and locate supervised devices in Lost Mode.

Apple Device Inventory, Compliance, and Reporting

• Hardware inventory: Model, storage, battery, and network details.
• OS versions: Spot devices behind on updates.
• Installed apps: See which apps are on each device.
• Configuration status: Check which profiles applied successfully.
• Activation Lock status: See whether Activation Lock is on.
• Compliance status: Find devices that don't meet policies.
• Certificate status: Review installed certificates.
• Security posture: Review passcode, encryption, and restriction status.
• Reports and audits: Run built-in or custom reports, and review the audit log of admin actions.

Learn more about reports and asset management.

Traditional Apple MDM vs. Declarative Device Management

Declarative Device Management doesn't replace the MDM protocol. It extends it, and both work side by side on the same device. Apple is moving more capabilities to the declarative model, with software updates the most significant example: Apple has removed the legacy software update commands in favor of declarative enforcement.

DDM in MDM Plus today. MDM Plus turns on DDM automatically for supported devices running iOS 16, iPadOS 16, macOS 13, tvOS 16, or later. The device's DDM status shows as Supported, Unsupported, or In Progress in the inventory. Current DDM features are instant status reporting, which updates the inventory as soon as a device changes, and automatic app status tracking, which shows whether an app is installing, pending, or installed (not yet available on macOS). Learn more about DDM in MDM Plus.

Apple Device Management Lifecycle

Enroll and Provision Apple Devices

Upload the APNs certificate, link Apple Business Manager or Apple School Manager, and assign devices to your MDM server. Associate profiles and apps with a group before devices enroll, so each device is ready when the user reaches the home screen.

Configure Device and Network Settings

Push Wi-Fi, VPN, certificate, email, and passcode profiles. Keep account settings separate from restrictions, so editing a restriction doesn't force users to re-enter credentials.

Deploy and Manage Applications

Assign Apps and Books licenses to devices, push in-house apps, and configure them with managed app settings.

Secure Devices and Corporate Data

Apply restrictions that fit the enrollment type. Supervised devices can take the full set. BYOD devices get controls focused on managed apps and data.

Monitor Device Health and Compliance

Review inventory, OS versions, installed profiles, and Activation Lock status. Schedule reports to catch problems before users raise them.

Manage OS and App Updates

Defer new OS versions for testing, then enforce them by a deadline. Schedule app updates outside working hours.

Troubleshoot and Secure Devices Remotely

Scan devices for current details, clear a forgotten passcode, or lock and locate a missing device.

Reassign, Reset, or Retire Devices

Use Return to Service to erase and re-enroll an iPhone, iPad, or Apple TV for the next user. Retire devices at end of life with a full erase, and turn off Activation Lock first so the device can be reused or resold.

How the lifecycle differs.

• Organization-owned devices go through every stage, from Automated Device Enrollment to Return to Service or retirement.
• BYOD devices skip provisioning and reset. Management covers only managed accounts, apps, and data, and ends when the user unenrolls or IT removes management.
• Shared devices cycle through reset and reassignment often, which makes Return to Service especially useful.
• Supervised devices unlock kiosk mode, Lost Mode, update enforcement, and Activation Lock management at every stage.

Managing BYOD Apple Devices and Employee Privacy

Apple's User Enrollment is designed for employee-owned devices. It limits management to the organization's accounts, apps, settings, and data, and leaves the user's personal Apple Account and content alone. MDM Plus supports account-driven User Enrollment for BYOD device management.

• How it works: The user goes to Settings, chooses to sign in with a work or school account, and enters their Managed Apple Account. The device discovers the MDM server and enrolls.
• Separation of corporate and personal data: Apple creates separate encryption keys for managed data. Managed apps and accounts use the Managed Apple Account, and personal apps use the personal Apple Account.
• Managed Apple Accounts: Organization-owned accounts, formerly called Managed Apple IDs, created in Apple Business Manager or Apple School Manager.
• What IT can see: Managed apps, managed accounts, and the profiles it installed.
• What IT can't see: Personal apps, photos, messages, browsing history, and hardware identifiers such as the serial number.
• What IT can control: Managed apps and their data, managed accounts, and the settings Apple allows under User Enrollment, such as Wi-Fi and per-app VPN.
• Corporate data removal: IT can remove managed apps, accounts, and data, but can't erase the device.
• What happens when a user unenrolls: Managed apps, accounts, and data are removed, and personal content stays.
• User Enrollment vs. Device Enrollment: Device Enrollment gives IT device-wide control, including full erase and passcode clearing. User Enrollment trades that control for privacy. It's the right choice for employee-owned devices.

Managing iOS and iPadOS Updates Across Enterprise Devices

• How IT controls OS updates: Create an OS update policy under Device Mgmt > Automate OS Updates and associate it with device groups.
• Supervision requirements: Automated update policies apply to supervised devices running iOS or iPadOS 10.0 or later, or tvOS 12.0 or later.
• Deferral vs. enforcement: Deferral delays an update for up to 90 days from its release, so you can test apps against it. Enforcement installs a chosen version by a set date.
• Scheduling: On-Demand OS Update Policies set an enforcement date and time, with reminders sent daily for the 14 days before the deadline or once an hour before it.
• Minimum OS requirements: Starting with iOS 17, iPadOS 17, and macOS 14, Apple lets an MDM require a minimum OS version during Automated Device Enrollment, so the device updates before setup can finish.
• Update compliance: The Update View shows devices that haven't installed the version a policy requires.
• Declarative update enforcement: On-Demand OS Update Policies work on Apple devices running OS 17 or later and take precedence over automated policies.
• Managing remote devices: Devices need at least 50 percent battery and a Wi-Fi connection, or Allow More Data on 5G turned on, to install updates. Failed updates are retried automatically.

Learn more about managing OS updates.

Reassigning Apple Devices with Return to Service

Return to Service erases a managed iPhone, iPad, or Apple TV and re-enrolls it in MDM automatically, so it's ready for the next user without anyone stepping through Setup Assistant.

• When to use it: When a device moves to a new user, comes back from repair, or needs a clean reset to fix a problem.
• How it works: MDM sends an erase command with a Wi-Fi profile. After erasing, the device joins that network, skips Setup Assistant, re-enrolls, and receives its groups, user, profiles, apps, and policies again.
• Wi-Fi requirements: The device needs the Wi-Fi profile to reconnect. If it's out of range, the user only needs to select the network, and no credentials are required.
• Apple Business Manager and Apple School Manager integration: Devices assigned to your MDM server in Apple Business Manager or Apple School Manager re-enroll through it.
• Reassignment workflows: In MDM Plus, go to Enrollment > Devices, select the devices, choose Deprovision (Wipe), select Return to Service, and pick the Wi-Fi profile.
• Shared, frontline, and education use cases: Retail and hospitality devices between shifts, classroom iPads between students, and loaner devices between employees.

In MDM Plus, Return to Service requires iOS or iPadOS 17 or later, or tvOS 18 or later, and Activation Lock must be turned off first. The device is typically ready about 15 to 20 minutes after the reset. Apple Account sign-ins aren't restored, so apps not assigned through Apps and Books need the user to sign in again. Learn more about Return to Service in MDM Plus.

Apple Device Management for Shared and Frontline Devices

Shared iPads in schools, check-in tablets in clinics, ordering devices in restaurants, POS devices in stores, and field-service iPhones all pass through many hands. They need to stay consistent and recover quickly when something goes wrong.

Shared iPad Management

Shared iPad lets several users sign in to one supervised iPad with their own Managed Apple Accounts, keeping each person's data separate.

Kiosk and Single-Purpose Devices

Single App Mode and multi-app kiosk keep supervised devices on the job they're meant to do, such as a check-in form or a payment app.

Device Reset and Reassignment

When a device changes hands, a full erase removes the last user's data before the next user starts.

App and Configuration Consistency

Group-based profiles and app assignments make every device in a store or classroom behave the same way.

Return to Service for Shared Devices

Return to Service turns a reset into a hands-off process. The device erases, re-enrolls, and gets its apps and profiles back without IT handling it.

Managing Apple Devices for Remote and Distributed Workforces

• Automated Device Enrollment: Devices enroll during setup, wherever the user is.
• Shipping devices directly to employees: Devices go straight from Apple or the reseller to the employee.
• Remote configuration: Profiles reach devices over the internet.
• App deployment: Apps install silently on supervised devices.
• Wi-Fi and VPN provisioning: Remote users reach internal resources securely.
• Certificate deployment: Certificates authenticate users and devices without manual setup.
• Software update enforcement: Devices update by a deadline, even far from the office.
• Compliance monitoring: Find devices that fall out of policy.
• Lost-device protection and remote wipe: Lock, locate, or erase a device as soon as it's reported missing.

How to Manage Apple Devices with ManageEngine MDM Plus

Step 1: Configure the APNs Certificate

Every Apple device needs a valid APNs certificate before it can enroll. Create an APNs certificate and upload it to MDM Plus. Note its expiry date, because devices stop receiving commands if it lapses.

Step 2: Integrate Apple Business Manager or Apple School Manager Where Required

For organization-owned devices, add MDM Plus as an MDM server in Apple Business Manager or Apple School Manager, and upload the server token to MDM Plus. Add a location token for Apps and Books.

Step 3: Select the Appropriate Enrollment Method

Use Automated Device Enrollment for organization-owned devices in Apple Business Manager, Apple Configurator for devices bought outside Apple's programs, and account-driven User Enrollment for BYOD.

Step 4: Enroll and Assign Devices

Assign devices to groups during enrollment, so profiles and apps follow automatically.

Step 5: Create and Deploy Configuration Profiles

Under Device Mgmt > Profiles, create Wi-Fi, VPN, email, passcode, and restriction profiles, then associate them with groups or devices.

Step 6: Distribute Business Applications and Content

Add App Store and in-house apps to the App Repository, assign Apps and Books licenses, and distribute apps and documents to groups.

Step 7: Apply Security and Compliance Policies

Set passcode and restriction policies, enable jailbreak detection settings, and create OS update and app update policies.

Step 8: Monitor, Update, Troubleshoot, Reassign, or Retire Devices

Track devices in Inventory and reports, roll out updates, troubleshoot with remote commands, and use Return to Service or a full erase when devices change hands or reach end of life.

Why Choose ManageEngine Mobile Device Manager Plus for Apple Device Management?

• Apple Business Manager and Apple School Manager integration for automated enrollment and Apps and Books distribution.
• Automated Device Enrollment and supervision for organization-owned iPhones, iPads, Macs, and Apple TVs.
• Account-driven User Enrollment for privacy-preserving BYOD management.
• Declarative Device Management, turned on automatically for supported devices.
• App and content management covering App Store, custom, and in-house apps, plus documents.
• OS update management with deferral up to 90 days and on-demand enforcement.
• Activation Lock management and Lost Mode for supervised devices.
• Return to Service for iOS, iPadOS, and tvOS devices.
• Multi-platform management of Apple, Android, Windows, and ChromeOS devices from one console.
• Cloud and on-premises deployment to fit your infrastructure.

Learn more about Mac management and iPad management with MDM Plus.