Automated Device enrollment offers the most efficient solution for keeping devices enrolled,
functional, and secure with Jamf Pro.
Hi, y name is Dyani, and in this video we'll talk about enrolling devices with Apple School
Manager and Apple Business Manager using Jamf Pro and PreStage Enrollments.
Let's begin by talking a bit about enrollment.
Enrollment, simply put, is the process of adding a computer, iPad, iPhone, or Apple
TV to Jamf Pro for management.
To do that, we need the device to communicate with our server so it can receive the correct
settings, configurations, and apps to help its user do their work.
Automated Device Enrollment begins this journey before the user even logs in - right at Setup
Assistant.
When a user first turns on their device, whether it be an iPad, iPhone, or computer, the device
will contact Apple's servers when it activates.
During this process, it will check if the device belongs to an organization like a school
or business.
If it does, it will enroll automatically with the associated server, ensuring the organization's
administrator can manage that device regardless of who physically possesses it.
This behavior does not apply to all Apple devices.
The organization must be enrolled in Apple School Manager or Apple Business Manager,
and the devices must be purchased from Apple or an authorized reseller with the explicit
intention of using Automated Device Enrollment.
There is some configuration that needs to happen on Apple's side before this PreStage
will take effect - either in Apple School Manager or Apple Business Manager.
For more information on adding devices to those servers, see Apple's Use Device Enrollment
article on Apple's support domain.
With few exceptions, personal devices cannot be added to the aforementioned programs, so
make sure your users are aware of this limitation before they purchase devices for work.
With that said, let's take a look configuring Automated Device Enrollment in Jamf.
Log in to Jamf Pro, navigate to Settings, select Global Management, Automated device
enrollment.
Integrating Automated Device Enrollment is as simple as downloading a server token from
Apple School Manager or Apple Business Manager, selecting New in Jamf Pro, providing a display
name, uploading the downloaded token, and optionally selecting a supervision identity
if you're using Apple Configurator 2 to enroll other devices.
Let's see what our user's experience is like:
During Setup Assistant, after iPhone connects to a network, we're notified it will be managed
by our Jamf Pro server.
We're notified that Jamf Software will manage the device, which the user must agree to to
proceed.
Depending on the PreStage Enrollment settings for this device, certain Setup Assistant steps
may be preconfigured or skipped altogether - we'll take a look at how to accomplish that
in a moment.
Proceed through Setup Assistant and we're brought to the Home Screen - just like normal.
However, if we open Settings, tap General, and Device Management in the bottom right,
we'll see the device has an MDM profile from our server.
Back on a computer, select the Devices tab, and search for the device, we'll see it has
enrolled automatically.
So how's this all facilitated?
Let's select PreStage Enrollments on the sidebar to the left, and in my case, this iPhone enrolled
as part of Training Catalog PreStage.
We can select which program instance we want to enroll devices with the Device Enrollment
Program Instance menu - you may have multiple if admins are keeping groups of devices separate.
I've selected the Automatically assign new devices option, so any new devices that join
the fleet will automatically use this PreStage.
Just note, if you use multiple PreStage Enrollments, only one per automated device enrollment instance
can have this option selected.
We can provide support information like an email and phone number, Supervise devices,
and make the MDM profile mandatory.
Continuing down, we have the option to skip certain Setup Assistant steps.
This is helpful for users who may not completely understand parts of Setup Assistant like App
Analytics or Privacy, or if you want the default operating system settings enforced.
There are a few additional tabs along the left that allow us to configure a naming convention,
assign enrolled devices to a location, or providing purchasing information.
Once the PreStage has been configured to our liking, select Scope and add your devices
- in my case, I only have the one, which was recently enrolled.
Save your work, and this devices PreStage Enrollment is ready to go.
Let's look at PreStage Enrollments on the macOS side.
Select Computers from the sidebar, scroll down to PreStage Enrollments, and create a
new enrollment.
Many of the options will look familiar - let's start with our display name, call this General
Enrollment, select a program instance, and in my case Automatically assign new devices
is greyed out.
This is because one of my existing PreStages already has this box selected in this instance,
and only one can leverage this option.
Support information is optional, but we can add a phone number and email address.
We can make the MDM profile installation mandatory, and by deselecting Allow MDM profile removal
we can ensure the profile stays on those computers, preventing users from un-managing them.
Finally, we can suppress parts of the Setup Assistant.
I'm going to select all of these to show just how quickly we can get users up and running.
Like on the devices side, we have additional payloads we can configure, but these are also
optional.
Users created during Setup Assistant will be administrators by default, but if you'd
prefer they have less access to the system we can make them standard users, or skip user
creation altogether, with the Account Settings payload.
We can also deploy configuration profiles, configure location information, and even add
a package to this PreStage.
Let's select Scope, add a computer, and save our work.
Switching to our computer at Setup Assistant, we'll select our country, connect to a network,
and we're notified the computer will be enrolled with Jamf.
We're brought to the Desktop, and if we open System Preferences and select Profiles in
the bottom right, we can see the MDM profile has installed, and the minus button is greyed
out, preventing us from removing it.
There's also an additional, hidden user account that's been created on this computer as well
as a number of additional files which compose the Jamf management framework, which is detailed
on our Jamf Nation article, Components Installed on Managed Computers.
Automated device enrollment and PreStages are powerful tools to secure devices, enhance
the user experience, and ease the provisioning burden for IT.
Thanks for watching, and we'll see you soon.