# Apple DEP (Device Enrollment Program): How to Enroll & Deploy Apple Devices?

Last updated: August 14, 2026

Apple Device Enrollment Program (DEP) is a free Apple service that enables IT admins to automate the bulk enrollment and deployment of corporate iOS, iPadOS, macOS, and tvOS devices. This page explains how DEP works, how to integrate it with your MDM server via the Apple DEP portal, and how to add devices using order number, serial number, or CSV file. It also covers Device Activation Settings, including enabling supervision, restricting MDM removal, and skipping non-mandatory setup steps during device activation.

Apple Device Enrollment Program or Apple DEP, is a **free Apple Deployment Program** or tool that enables IT admins to simplify the bulk enrollment and deployment of Apple devices including iOS, iPadOS, macOS, and tvOS devices in the organization. Essentially, Apple DEP is a tool to enroll Apple devices. Apple DEP enrollment is preferred in most organizations as it makes the enrollment process of corporate-owned iOS devices automated and seamless for IT Admins. Through the Apple Device Enrollment Program (DEP) portal, the IT Admin can enroll Apple devices into MDM without any direct contact with the devices and also, enable Supervision of devices during the initial setup, including the possibility to ease the configuration process by skipping a few initial setup stages which are not mandatory for your organization. For detailed information about Apple Device Enrollment Program or Apple DEP, you can refer to [this](https://www.apple.com/business/docs/DEP_Guide.pdf). **You can enroll devices not purchased directly from Apple or its reseller with Apple DEP, through Apple Configurator as explained** [here](https://www.manageengine.com/mobile-device-management/how-to/add-macs-to-abm-with-ios-configurator.html)**.** Also, the device needs to access the domains [listed here](https://support.apple.com/en-us/HT207516).

**NOTE:** Apple Deployment Program is a free Apple service that simplifies the deployment of corporate Apple in organizations. Apple provides two deployment services under the Apple Deployment Program, one is the Apple Device Enrollment Program (which is now updated to [Apple Business Manager](https://www.manageengine.com/mobile-device-management/help/enrollment/apple_business_manager_enrollment.html)) for enterprises and the [Apple School Manager](https://www.manageengine.com/mobile-device-management/mdm-apple-school-manager.html) for educational institutions.

[![Apple Device Enrollment Program](https://www.manageengine.com/mobile-device-management/help/images/DEP_video_thumbnail.jpg)](https://www.manageengine.com/mobile-device-management/demo/ios-enrollment-with-dep-mdm-video.html)

**We have made your job simpler!**

Learn how to set up Apple Device Enrollment Program (Apple DEP) with MDM, in **just 3 minutes** through [this demo video](https://www.manageengine.com/mobile-device-management/demo/ios-enrollment-with-dep-mdm-video.html).

## How Apple Device Enrollment Program works?

![Working of Apple Device Enrollment Program portal (DEP) or Apple Deployment Program with MDM to manage Apple devices.](https://www.manageengine.com/mobile-device-management/help/images/dep.png)

Apple Device Enrollment Program (Apple DEP) enrollment process first starts, when your organization purchases iOS devices from Apple or from Apple authorized resellers. You have to log into your [Apple Deployment Program Portal (Apple DEP portal)](https://www.apple.com/business/dep/index.html) account or create a new account, by referring to steps given in [Device Enrollment Program Guide](https://support.apple.com/en-in/HT204142). You have to register MDM with the Apple DEP Portal. Once you have registered the MDM server, secure communication is enabled between the MDM server and the Apple DEP Portal. This is used to synchronize the details of devices, purchased using Apple DEP portal. When you find the devices synced from Apple DEP portal, you can assign it to users. Whenever the devices are activated, all restrictions and configurations imposed using MDM are automatically installed on all your devices Over The Air (OTA). By configuring DEP, you can ensure all the devices purchased under DEP, are managed by MDM by default as soon as they are activated.

The best part of the Apple Device Enrollment Program (Apple DEP) enrollment is that once the devices are configured and enrolled with MDM, the devices can never go unmanaged from MDM at any point, even if the device is factory reset. A device must be removed from DEP itself to unmanage it.

### Integrating Apple Device Enrollment Program (Apple DEP) with MDM

After creating your organization's Apple ID and Apple Deployment Program Account by following the steps mentioned in the DEP program Guide, you need to carry out the steps outlined below, to seamlessly enroll and manage your organization's corporate iOS devices using MDM.

First, you need to link the MDM server to Apple Deployment Program (Apple DEP) portal. For this:

1. On the MDM server, navigate to **Enrollment -> Apple -> Apple Enrollment (DEP)**.
2. Download **MDM Public Key** certificate which has to be uploaded on Apple Deployment Program portal while adding MDM Server.
3. Log in to [Apple's DEP portal](https://deploy.apple.com/) using the Apple ID of your organization.
4. Create a new virtual MDM server on Apple's DEP portal by clicking 'Add MDM Server'.
5. Navigate to **Device Enrollment Program -> Manage Servers**.
6. Click **Add MDM Server** and type in a suitable name for your MDM Server.
7. Now, you need to upload **MDM Public Key** certificate, you downloaded earlier from MDM.

![Uploading Public Key to Apple Device Enrollment Program (DEP) portal](https://www.manageengine.com/mobile-device-management/help/images/dep-upload-public-key.png)

1. You can now download the DEP Token generated by Apple.

![Downloading Public Key from the Apple Deployment Program/DEP portal](https://www.manageengine.com/mobile-device-management/help/images/dep-download-server-token.png)

1. Navigate back to your MDM console and then **Upload DEP Token**.
2. Specify the email address, which is to receive notifications regarding DEP token expiry.
3. Click **Upload** to complete the uploading of DEP token. You can configure the device activation settings as explained [here](https://www.manageengine.com/mobile-device-management/help/enrollment/device_enrollment_program_ios_devices.html#Device_Activation_Settings).

### How to enroll/add devices to Apple DEP?

After linking your MDM Server to Apple DEP, you can add devices to MDM using one of the three methods; Serial Number, Order Number, or Uploading CSV File.

- [Using Order Number](https://www.manageengine.com/mobile-device-management/help/enrollment/device_enrollment_program_ios_devices.html#Using_Order_Number)
- [Using Serial Number](https://www.manageengine.com/mobile-device-management/help/enrollment/device_enrollment_program_ios_devices.html#Using_Serial_Number)
- [Uploading CSV File](https://www.manageengine.com/mobile-device-management/help/enrollment/device_enrollment_program_ios_devices.html#Uploading_CSV_File)

#### Using Order Number

You can add devices to Apple DEP using the **order number** of purchases done by your organization from Apple. Your organization would have an Apple Customer Number, which contains the history of all orders or purchases made.

To add all or a specific number of devices purchased under a particular order number from Apple, directly to MDM, follow the steps mentioned below:

1. On your Apple Deployment Program portal, navigate to **Device Enrollment Program -> Manage Devices**.
2. Select the option **Order Number** for choosing devices as shown and mention the required order number.
3. Now you must choose the action **Assign to Server** and specify the name of the MDM server which was configured earlier.

![Adding devices to Apple Device Enrollment Program (DEP) portal through Apple Serial number](https://www.manageengine.com/mobile-device-management/help/images/dep-order-number.png)

MDM Server is now automatically assigned with the iOS devices.

#### Using Serial Number

This method of adding devices can be chosen when the device is in physical proximity to IT Admin and easy to be erased.

To add devices to MDM using Serial Number, follow the steps mentioned below:

1. On your Apple Deployment Program portal, navigate to **Device Enrollment Program -> Manage Devices**.
2. Select the option **Serial Number** for choosing devices and mention the serial numbers of the required devices using comma-separated values as shown.
3. Now you must choose the action **Assign to Server** and specify the name of the MDM server which was configured earlier.

![Adding Devices to Apple Device Enrollment Program (DEP) portal through CSV file](https://www.manageengine.com/mobile-device-management/help/images/dep-serial-number.png)

MDM Server is now automatically assigned with the iOS devices.

#### Uploading CSV File

You can upload a CSV File containing a list of Serial Numbers of the required devices to the Apple Device Enrollment Program portal. To add devices to MDM, by uploading a CSV file, follow the steps mentioned below:

1. On your Apple Deployment Program portal, navigate to **Device Enrollment Program -> Manage Devices**.
2. Select the option **Upload CSV File** for choosing devices, browse and upload the required CSV File containing a list of Serial Numbers of Devices.
3. Now you must choose the action **Assign to Server** and specify the name of the MDM server which was configured earlier.

![Uploading CSV to the Apple Deployment Program portal](https://www.manageengine.com/mobile-device-management/help/images/dep-upload-csv.png)

MDM Server is now automatically assigned with the iOS devices.

![Information note](https://www.manageengine.com/mobile-device-management/help/images/infoicon.png)

An alternative to adding CSV file is to automate the user assignment. Automated user assignment ensures the users are authenticated and self-assigned when the device is enrolled. This option must be enabled when DEP is configured or if already configured, you can enable the option from DEP settings. The only pre-requisite is, AD/Azure must be configured in MDM. When enrolling the device using DEP auto-assignment, the user name to be provided in the device must be in the format: **domain name\user name**

### Device Activation Settings

On completion of adding devices to MDM, all the devices would be enrolled successfully. Before enrolling the devices, you have to create a DEP Profile and apply it to all devices. You can create and apply profile settings over-the-air to all your devices at one go, by following the steps mentioned below:

1. On MDM console, navigate to **Enrollment -> iOS -> Apple Enrollment (DEP)**.
2. Complete the required fields displayed under **Device Activation Settings**.
3. Click **Create.** Now, DEP automatically gets applied to all added devices.

![Managing Device Activation Settings with Apple DEP for Apple devices](https://www.manageengine.com/mobile-device-management/help/images/dep-profile-creation.jpg)

| SETTINGS | DESCRIPTION |
|---|---|
| DEP Settings |  |
| Restrict users from removing MDM | This ensures the user cannot revoke MDM management from the managed device. |
| Supervise devices | Enable Supervision of devices. For detailed information on Supervised Devices, refer [this](https://www.manageengine.com/mobile-device-management/how-to/mdm-supervised-devices.html). |
| Force install MDM during device setup | Make device enrollment with MDM, mandatory during the initial setup of the device |
| Authenticate and auto-assign users on device activation (Applicable only for On-premises) | If you want to automate the user assignment process, enable this option. This allows the user to use his Active Directory credentials and assign the device to himself upon activation. |
| Skip these configurations during device setup | During device activation, you are required to follow some initial setup steps. With MDM, you can optionally skip selective steps or completely skip the setup. Assuming your organization wants to prevent users from setting up Siri during the setup assistant process, you can do so by selecting **Siri** from the list of configuration settings provided. The list of configuration settings is given below. |

Now, all your corporate iOS devices are associated with the DEP Profile created using MDM.

### Syncing Devices

After creating the DEP and applying it to devices, you can choose to **Sync Devices** by navigating to **Enrollment-> iOS -> Apple Enrollment (DEP).** Once the devices are synced, all devices get automatically listed.

**Only when the devices are activated by the user**, it gets enrolled into MDM and is listed under **Settings -> Enrollment-> Devices**

In case the devices are not new, the devices should be factory reset, to be configured using DEP. Users can reset their devices, by navigating to Settings -> General -> Reset -> Erase All Content and Settings on the iOS devices.

### Assigning Users to Devices

You can assign all the devices to individual users. Navigate to **Assign User** tab under **Enrollment -> iOS -> Apple Enrollment (DEP)-> Devices.** You can upload a CSV File containing details of all the users to whom devices have to be assigned. Now, the devices enrolled using Apple Device Enrollment Program get assigned to the appropriate users.

### How to remove Devices from the Apple DEP (Device Enrollment Program) Server?

When a device is enrolled using DEP, one of the most important benefits is that the user cannot unmanage the device even when factory reset. To unmanage the device, the administrator must remove the device (iOS, iPadOS) from the MDM server. Once the device is removed from the MDM server, the device is automatically removed from the Apple DEP portal.

The devices enrolled with one DEP account cannot be enrolled in another. Therefore, you must remove the device from the Apple DEP first before enrolling into another. Follow the steps given below to remove the devices from the Apple DEP portal.

1. Log into the DEP portal and Click **Manage Devices**.
2. Enter either the serial number or order number of the devices. If you are trying to remove multiple devices, you can upload a CSV file with the device details.
3. Under **Choose Actions** select **Unassign device**. This unbinds the device from this DEP account and removes that device from the Apple DEP portal.

**NOTE:** To remove the devices from Apple DEP, always select **Unassign device** and not **Disown device**. Disown device should be used only if the device is lost or permanently damaged and will never be part of any workforce. Disowning devices is a non-reversible action and once disowned the device can never be part of an organization.

### Troubleshooting Tips

1. **MDM server is not able to contact DEP to sync devices.**

   Check if mdmenrollment.itunes.apple.com is allowed along with other [domains](https://www.manageengine.com/mobile-device-management/faq.html#g2) and [ports](https://www.manageengine.com/mobile-device-management/faq.html#g1) listed here. Also, verify the availability of the required [Apple services](https://www.apple.com/support/systemstatus/index.html).

2. **Even after successful sync, the device is not listed in the MDM server on DEP page.**

   Check if the device has been enrolled in the MDM server using an enrollment method other than DEP. Remove the device from management, reset the device and sync again with the server. The device gets listed on the DEP page.

3. **During device activation, you encounter the error message "The configuration can't be downloaded. The configuration is not available".**

   Check your network connectivity. Also, check if the MDM server is reachable using the browser of another device in the same network.

4. **During device activation, you encounter the error message "NSURLErrorDomain error -1012".**

   Check your network connectivity. Also, check if the server certificate was copied correctly to the forwarding server while configuring it.

5. **During device activation, you encounter the error message "A server with the specified hostname could not be found.".**

   Check your network connectivity. Also, check if the MDM server is reachable using the browser of another device in the same network. If not, make the required changes to the server's NAT settings.

6. **If you are trying to enroll devices not purchased from Apple or authorized resellers.**

   Apple now allows adding ios 11 devices not purchased directly from Apple or authorized resellers into DEP. Follow the steps given [here](https://www.manageengine.com/mobile-device-management/how-to/mdm-enroll-any-ios-device-dep.html) to use Apple Configurator to add devices to DEP.

7. **While adding devices to the DEP portal you encounter the error "NOT_ACCESSIBLE".**

   This error is shown if the device is either not eligible for DEP enrollment or is either already enrolled or owned by another organization. Follow the steps given [here](https://www.manageengine.com/mobile-device-management/how-to/mdm-enroll-any-ios-device-dep.html) to add the device to DEP using Apple Configurator if the device is not eligible for DEP. Else, add the device to the correct DEP portal based on the Fully Managed (COSU and COBO, or previously Device Owner).

8. **While adding devices to the DEP portal via Apple Configurator you encounter the error 'Provisional enrollment failed'.**

   This error is shown if the device is unable to contact the DEP server. Factory reset the device and proceed until the Wi-Fi configuration step. Prepare the device using Apple Configurator and [follow the steps for adding it to DEP](https://www.manageengine.com/mobile-device-management/how-to/mdm-enroll-any-ios-device-abm-via-apple-configurator.html).