- Reference 2.1 Understanding Apple’s Goals
- Reference 2.2 Device Management and Supervision
- Reference 2.3 Apple ID Considerations
- Reference 2.4 iCloud in Managed Environments
- Reference 2.5 Apple Deployment Programs
- Reference 2.6 Deployment Scenarios
- Exercise 2.1 Configure Your Client Mac
- Exercise 2.2 Create Apple IDs
- Exercise 2.3 Verify Administrator Apple ID Access
- Exercise 2.4 Configure Your iOS Device
From the book
From the book
From the book
Reference 2.2 Device Management and Supervision
Configuring a single Apple device is easy, even for the novice administrator, because most settings can be found in the iOS Settings app or OS X System Preferences. Configuring each device individually, however, doesn’t scale to meet the needs of even the most modest IT organization. Quickly deploying configuration across multiple devices is the best practice for most management tasks. This section describes the core Apple technologies for configuring iOS and OS X devices en masse.
Management via Profiles
Profiles were originally created to provide an easy setup method for iOS devices, but are now also available in OS X. A profile is a document that includes instructions for specific system settings, such as Internet Accounts or Network preferences. An administrator can create a profile that contains settings that would otherwise be difficult for a user to configure. Profile documents can be identified on OS X computers by an icon and the filename extension, .mobileconfig.
)
Opening or selecting a profile in iOS or OS X will install its configuration settings. You can inspect installed profiles on an iOS device in Settings > General > Profiles, and on an OS X computer in System Preferences > Profiles.
)
)
Administrators can distribute profiles just as they would share any other document. For example, an administrator can send a profile via email or make it available as a downloadable link on a website. Alternatively, administrators can automatically push profiles to an OS X system that is enrolled in a Mobile Device Management (MDM) service such as the Profile Manager of OS X Server.
Mobile Device Management
Mobile Device Management (MDM) is an umbrella term for any technologies that allow an administrator to remotely manage devices. MDM is also referred to as over-the-air (OTA) management because MDM functions are delivered over network connections that are commonly accessed via Wi-Fi or cellular connections. Although the terms OTA and MDM are often used interchangeably, OTA more accurately refers to the act of deploying something remotely whereas MDM describes the underlying technology that makes that deployment possible.
From an Apple perspective, MDM is the specific implementation used for remotely managing iOS and OS X devices. Using the developer documentation of MDM implementation, any vendor can create an MDM service to manage Apple devices.
Out of the box, Apple devices do not natively support MDM solutions. The process of configuring an Apple device to use an MDM service is commonly referred to as “enrollment.” This process establishes a secure relationship between the device and the MDM service. After enrollment, most MDM functions are performed automatically, usually with no interruption of the user’s experience. You can inspect a device’s MDM enrollment within the Profile settings on iOS and OS X.
As covered later in this guide, you’ll learn that you have a variety of different MDM enrollment methods to choose from. In fact, you may use multiple different enrollment methods based on your specific organizational needs. The specific MDM enrollment workflows you choose are among the most important aspects of your device management plan.
Device Supervision
Fundamentally, device supervision is a mechanism through which an organization proves its ownership of an iOS device. When an iOS device is supervised, administrators can activate additional management features. In other words, administrators are allowed to perform the most restrictive management actions only on supervised devices that are verifiably owned by their organization.
You can supervise an iOS device using either Apple Configurator or the Apple Device Enrollment program, as detailed later in this guide. You can identify whether an iOS device is supervised in Settings > General > About. The organization providing device supervision will appear directly below the device’s name.
)
The following is a list of some of the popular management functions that can be activated only on supervised iOS devices:
- Restricting iOS device pairing (and syncing) with other Mac computers and PCs
- Automatically installing apps (via Configurator or MDM)
- Engaging (and locking a device to) single app mode
- Delivering settings via MDM to prevent the installation of profiles outside of your MDM
- Delivering settings via MDM to configure global HTTP proxy
- Delivering settings via MDM to restrict iBooks content
- Delivering settings via MDM to disable app removal, AirDrop, and the iMessage service
- Delivering settings via MDM to prevent modification of Siri, Internet Accounts, Find My Friends, and cellular service settings
Given this list of management functions, choosing whether or not to supervise iOS devices has a huge influence on your management plans. Put another way, if your organization requires that IT control these features, your plans must include a workflow that will supervise any iOS devices you intend to manage.