Key Points
- Connect Apple Business or Apple School Manager to an MDM Platform to Enable Zero-Touch Automated Device Enrollment
- Enforce Supervised Mode on Corporate Hardware to Lock the MDM Profile and Unlock Advanced Security Controls
- Adopt Apple User Enrollment for Personally Owned Devices to Cryptographically Isolate Corporate Data from Personal Information
- Use Apple Configurator to Manually Enroll Older, Unmanaged, or Donated Hardware Directly into Apple Business
- Renew the Active Apple Push Notification Service Certificate Every 365 Days Using the Original Apple Account to Maintain Server-to-Device Communication
Apple MDM servers provide tools to manage your employees’ Apple devices, providing remote monitoring and administration capabilities. This benefits your business by keeping data secure. Ultimately, this allows your IT department to operate efficiently and makes employees more productive by ensuring devices are operating correctly.
This guide offers a comprehensive overview of Apple MDM servers: what it is, how it works, and how they can help your team deploy, manage, and maintain Apple devices.
What is an Apple MDM server?
Mobile device management (MDM) is the software tools and practices IT departments use to manage their fleets. These can involve mobile devices, including phones, tablets, and laptops (and, with remote work, these tools are often extended to desktop machines). MDM offers several advantages to enterprise mobility management. This includes remotely monitoring devices to ensure security and compliance, deploying software, and more.
An Apple MDM server is the mobile device management (MDM) software that manages iPhones, iPads, and Macs for an organization. It is not a physical server. Your MDM platform acts as the server, and you link it to Apple Business or Apple School Manager (ASM) so devices can enroll automatically. Not every MDM platform supports Apple’s enrollment process, so confirm that a platform integrates with ABM or ASM before you choose it.
Apple Business and MDM
Integrating MDM with Apple Business or Apple School Manager (ASM) is the recommended method for enrolling company-owned hardware. It eliminates the need for IT to manually email enrollment profiles to end users.
Key features enabled by Apple Business include:
- Automated Device Enrollment: Enrolling and supervising devices automatically out of the box.
- App & Content Deployment: Assigning and distributing app licenses and books via Volume Purchase Program (VPP) integration.
- Managed Apple Accounts: Creating and managing corporate identity credentials.
- Flexible Server Assignment: Assigning specific MDM servers to distinct device types or business units.
What is Supervised Mode?
Supervision is a higher level of device management applied to company-owned hardware. It unlocks advanced management controls, such as disabling AirDrop, enforcing Web Content Filtering, restricting App Store purchases, and preventing end users from removing the MDM profile.
Apple School Manager provides identical core capabilities for educational institutions, along with specialized workflows for managing instructors, classes, and student accounts.
Key features of Apple MDM servers
MDM servers provide several key functionalities to businesses and organizations that streamline the deployment and management of Apple devices. These features include:
- Automatic Device Enrollment (ADE): You can ensure that devices are automatically enrolled in ABM and MDM as soon as they are unboxed and connected by the user. This prevents needing to manually unbox each device, plug it in, and update/configure it. Instead, you simply add your sales information to ABM and ship devices out directly to your employees.
- Configuration management: Ongoing device management after initial setup without MDM involves recalling devices. This is so that they can be updated or reconfigured. Meanwhile, Over-the-Air (OTA) updates allow you to remotely keep device configurations up-to-date and consistent. This is done without having to physically interact with them.
- App management: Similarly, apps and content can be remotely managed via an Apple MDM server. This is so that you can provide employees with access to the apps and materials they require to perform their work duties. App licenses can also be remotely managed using ABM. And the Apple Volume Purchase Program (VPP) can be utilized for the bulk purchase of apps and books.
- Security policies and compliance: Security is an ongoing concern and must be prioritized by organizations. MDM solutions allow you to centrally monitor and manage all of your mobile devices. This is particularly useful to ensure that they have security policies to meet emerging threats. This is important if your business handles sensitive data or personally identifiable information (PII) for your customers, which is increasingly regulated.
- Remote wipe and lock capabilities: The monetary value of a lost or stolen device isn’t the biggest concern for most businesses. The potential for others to gain access to valuable company data or interfere with business operations is a far bigger threat. MDM configured using ABM cannot be removed from a device by end users. Ultimately, this ensures that security policies and authentication measures remain in place and that the device can be remotely locked or wiped.
Can Apple’s built-in device management replace a third-party MDM server?
Apple now offers built-in device management in its business platform, so organizations with Apple-only fleets and small IT teams can manage devices without a separate MDM. You can still link a third-party MDM server, and each device uses a single MDM server at a time. Organizations that also manage Windows, Android, or Linux endpoints often choose a cross-platform MDM server, such as NinjaOne MDM, so that all endpoints are managed from a single console.
How to set up an Apple MDM server
Apple MDM server functionality is usually provided by your third-party MDM solution — it is not a physical server or software that you need to purchase, install, and configure yourself.
Prerequisites for Setting Up an Apple MDM Server:
- An active Apple Business or Apple School Manager (ASM) account.
- A DUNS (Data Universal Numbering System) number for your organization (required for ABM enrollment).
- An active Apple Push Notification service (APNs) certificate (renewed annually via your MDM platform).
- An admin account in your MDM software.
Once you have adopted an MDM platform that supports Apple Business, you can add it to your ABM account and then assign it as the MDM server for your devices based on their type.
How to add iOS, iPadOS, and macOS devices to Apple MDM
The suggested method for enrolling an Apple device in MDM is to add it to ABM. This is the only way to automatically add MDM to mobile Apple devices. When a company-owned device enrolls through ABM in supervised mode, IT can prevent users from removing the MDM profile. This helps maintain security policies and authentication measures, and IT can remotely lock or wipe the device if it is lost or stolen.
Alternatively, you can manually add the devices using Apple Configurator if you have physical access to them or email the MDM enrollment profile to your users so they can install it themselves.
| Method | Best for | Requires | Result |
| Automated Device Enrollment (ADE) | Company-owned devices | ABM or ASM with a linked MDM server | Zero-touch setup with supervised devices |
| Apple Configurator | Devices IT can physically access | Physical access and Apple Configurator | Manual enrollment with supervision |
| Enrollment profile | Users enrolling their own devices | A profile the user installs | User-driven enrollment, no ABM required |
When to Use Apple Configurator:
While ADE is preferred for new corporate purchases, Apple Configurator (available as a Mac or iOS app) is essential for retroactively enrolling older devices that were purchased outside of ABM-authorized resellers, donated to your organization, or previously set up as unmanaged hardware. Adding a device via Apple Configurator retroactively imports it into ABM, applying supervision and linking it to your MDM server.
Once the MDM enrollment profile has been installed on a device, the MDM server will queue up commands to be sent to the device when it is online using Apple’s push notification service (APNs).
Best practices for managing Apple devices with MDM
There are a few Apple-specific best practices you should follow when implementing mobile device management via an MDM server in Apple Business or ASM:
- A device can be assigned to only one MDM server: each enrolled device connects to a single management server at a time.
- Assign MDM servers based on OS or department: You can add multiple MDM servers to ABM and route different hardware types accordingly, such as managing macOS laptops differently from iOS mobile devices, or separating business units with distinct security requirements.
- Lock enrollment settings early: Note that you cannot change your ABM enrollment profile once a device completes the initial Setup Assistant.
- Implement Apple User Enrollment for BYOD: Protect employee privacy while securing corporate data by leveraging Apple’s native User Enrollment (often powered by Account-Driven User Enrollment and Declarative Device Management [DDM]). This creates a cryptographically isolated APFS volume on personal devices, keeping corporate apps, keys, and documents isolated while preventing IT from accessing personal photos, personal apps, browsing history, or personal location data.
- Automate OS updates: Configure policies to automatically apply security patches and OS updates, reducing vulnerabilities caused by end users delaying or deferring them.
- Enact user training and support: Ensure employees understand why certain restrictions exist on company devices and provide clear pathways to resolve access issues.
Critical Warning – Annual APNs Renewal:
The APN certificate linking your MDM platform to Apple must be renewed every 365 days using the exact same Managed Apple Account/Apple ID used to create it. If an APN’s certificate expires or is renewed with a different Apple ID, all enrolled devices will permanently lose their connection to the MDM server and require a complete, manual re-enrollment across your fleet.
MDM is a long-term investment, so it’s important to choose the right tools
Investment in IT infrastructure management and enterprise mobility management is wasted if the selected tools do not meet your current or future requirements. Once devices have been enrolled in Apple Business, it becomes difficult and disruptive to change to a different platform. Rectifying technical debt stalls progress on other IT projects and prevents your IT technicians from addressing new issues in a timely manner.
If you deploy devices from manufacturers other than Apple that run other operating systems, it’s wise to choose a single MDM platform that supports all of your devices.
NinjaOne MDM manages iPhones, iPads, and Macs alongside Windows, Android, and Linux endpoints from a single console, as part of the NinjaOne endpoint management platform. It supports Automated Device Enrollment through ABM or ASM, so employees can power on a company-owned device and sign in to start working. Explore the NinjaOne Apple MDM solution.
