Skip to main content
Apple Business Manager is now Apple Business. Apple School Manager is unchanged. For more information, see Introducing Apple Business and Apple Business Manager is now Apple Business.
Apple Push Notification service must be configured in your Iru Endpoint tenant before Automated Device Enrollment can be configured.

​
About Automated Device Enrollment

Automated Device Enrollment (ADE) is an Apple feature that enrolls devices into Iru Endpoint out of the box. Corporate-owned iPhone, iPad, Mac, and Apple TV devices are managed and supervised as soon as they are activated. If a device is lost, stolen, erased, or restored, it enrolls back into its assigned MDM server.

​
How It Works

Automated Device Enrollment operates through a secure connection between Apple Business or Apple School Manager and Iru Endpoint. When devices are purchased from Apple or authorized resellers, they are automatically added to your organization’s account in the same portal. Once assigned to Iru Endpoint, devices check with Apple during activation to verify organizational ownership and retrieve configuration settings.

​
Prerequisites

  • Apple Push Notification service: Apple Push Notification service must be configured in your Iru Endpoint tenant
  • Apple Business or Apple School Manager access: Ensure you have administrative access to your organization’s portal
  • Device Purchase: Devices must be purchased from Apple or authorized resellers to be automatically added to Apple Business or Apple School Manager
  • Network Connectivity: Ensure devices have internet connectivity during the enrollment process
Some Apple devices can be added using Apple Configurator after purchase. See our Adding Devices to Apple Business or Apple School Manager support article for more information.

​
Automated Device Enrollment Process

Once devices are available in Apple Business or Apple School Manager, you can assign them to an MDM server like Iru Endpoint. This assignment initiates a sync between Apple and Iru Endpoint (handled by the Automated Device Enrollment token), making device serial numbers available in an Awaiting Enrollment status where they can be assigned to an Assignment Map in the Iru Endpoint Web App. When a device is powered on and connected to a network, it checks with Apple to verify organizational ownership, then retrieves and applies the configuration assigned by Iru Endpoint.

​
Configuring Automated Device Enrollment

These steps configure the Automated Device Enrollment token shown on the Apple integrations page. One Iru Endpoint tenant can use more than one ADE token, for example to connect additional Apple Business or Apple School Manager accounts, but additional tokens must be added with the Iru Endpoint API. See Configure multiple ADE tokens using the Iru Endpoint API.
1

Open Integrations

In the sidebar, select the Account Menu Button, then select Integrations.
Screenshot of the account menu with Integrations option highlighted
2

Select Apple

Under Platform integrations, select Apple.
3

Set Up ADE

Under Automated Device Enrollment, select Set up Automated Device Enrollment.
4

Start the wizard and obtain the PEM file

In the setup wizard, continue until Iru Endpoint provides a PEM public key file (download or save it when prompted). You will upload this file to Apple Business or Apple School Manager in the next steps.
5

Sign in to Apple Business or Apple School Manager

Sign in to Apple Business or Apple School Manager with a Managed Apple Account that can manage device management services.
6

Open the Devices tab

Select the Devices tab at the top of the page.
7

Open Management

In the left sidebar, select Management.
8

Add a device management service

Scroll to the bottom of the Management Services list and select Add next to Add device management service.
Apple Business or Apple School Manager Management Services list with Add device management service
9

Enter the service name

In the Service Name field, enter a name for this MDM integration (for example, Iru Endpoint).
10

Optional: Allow this service to release devices

If your organization needs it, select Allow this service to release devices.
11

Upload the PEM file

Upload the PEM file from Iru Endpoint.
12

Select Next

Select Next.
Add device management service form with Service Name, release devices option, and public key upload
13

Download the service token

Select Download Service Token.
Apple Business or Apple School Manager Download Service Token action
14

Select Done in Apple Business or Apple School Manager

Select Done.
15

Upload the token in Iru Endpoint

Return to Iru Endpoint and upload the .p7m service token file when prompted.
16

Complete the wizard in Iru Endpoint

Complete any remaining steps in the wizard and select Done.

​
Renewing Your Automated Device Enrollment Token

Automated Device Enrollment tokens expire and must be renewed to keep assigning and enrolling devices. If the token expires, Iru Endpoint can no longer sync devices from Apple Business or Apple School Manager. Renew Token renews the ADE token shown on the Apple integrations page. If this tenant already has more than one ADE token, renew the additional tokens with the Iru Endpoint API. See Renew, update, or delete ADE tokens using the Iru Endpoint API. To add more tokens, see Configure multiple ADE tokens using the Iru Endpoint API.
You can renew the token at any time. Monitor the expiration date in the Iru Endpoint Web App and renew it before it expires.
1

Open Integrations

In the sidebar, select the Account Menu Button, then select Integrations.
Screenshot of the account menu with Integrations option highlighted
2

Select Apple

Under Platform integrations, select Apple.
3

Renew Token

Under Automated Device Enrollment, select Renew Token.
4

Complete Renewal

Follow the on-screen instructions to renew your Automated Device Enrollment token.

​
Considerations

  • APNs Configuration: Ensure Apple Push Notification service is properly configured before setting up ADE
  • Network Requirements: Verify network connectivity and firewall settings for Apple services
  • Updates: Stay informed about Apple’s ADE requirements and updates
  • Device Assignment: Plan your device assignment strategy for Assignment Maps
  • User Experience: Test the enrollment process to ensure smooth user experience
  • Testing: Test ADE configuration in a controlled environment before production deployment
  • Monitoring: Regularly monitor ADE status and device enrollment success rates
  • Security Policies: Configure appropriate security policies for corporate-owned devices
  • Lost Device Protection: Understand how ADE helps protect against lost or stolen devices
  • Compliance Requirements: Ensure ADE configuration meets your organization’s compliance needs
  • Device Lifecycle: Plan for device management throughout the entire lifecycle
  • Backup Strategy: Have a plan for managing devices if ADE becomes unavailable
  • Documentation: Keep records of ADE configuration and device assignments
  • Support: Contact Iru Endpoint Support for assistance with complex ADE scenarios