Apple device management from setup to retirement

Start with a list of every device. Note who uses it, which operating system it runs and which business apps are on it. Include personal phones that open work email and shared devices, such as an iPad in a meeting room. They're the easiest to miss. Also note which identity provider people sign in with, which management service the devices are in today and who handles support.

Carry the settings that work today over as they are, and keep a separate list of any changes you've agreed on. If you move to a new MDM and redesign everything in the same step, the migration grows into a much bigger project than you planned. And when something breaks, it's hard to tell whether the move or the change caused it.

For devices the organisation owns, test Automated Device Enrollment through Apple Business first. A new Mac or iPhone then enrols in your MDM during its first setup, and you can make that step mandatory. Check that your supplier adds the devices to your Apple Business account and that each one is assigned to the right MDM and enrolment profile. If either is missing, the device goes through setup like a private one, without your MDM.

Devices you already own may not be in Apple Business at all. They need a different enrolment route, and some need preparing first.

For personal devices, look at User Enrollment and check that it gives your apps the access they need. It keeps work and personal data apart, and IT gets less control than on a company device. Tell staff what an administrator can and can't see or do on their phone. People enrol their own device more willingly when they know where the limits are. Our guide to personal and company-owned devices covers these choices.

Assign the apps and licences each group needs, then test more than the first install. Updates, removal and any app-specific settings should all work before the app goes to everyone. Where your workflow supports it, assign licences to the device. The app then installs without anyone signing in with an Apple Account.

Set one security baseline for company devices and one for personal devices, because a company Mac and a personal iPhone allow different controls. Then check encryption, access controls and recovery on the devices themselves. A setting the MDM shows as delivered may still not work. A Mac can report FileVault as on while its recovery key never reached the MDM. Some devices will need exceptions. Record each one where everyone can see it, and name the person responsible.

Before go-live, test the everyday requests. Set up a new starter, reset a forgotten password, fix an app that won't install and replace a device. Each one touches enrolment, sign-in or apps, so they show quickly where the setup is weak. Decide who handles each case and what access they need in the MDM. Someone who resets passwords doesn't need full admin rights.

Your MDM depends on certificates and tokens that expire, such as the Apple push certificate and the tokens that connect your MDM to Apple Business. Give each renewal a named owner. If one runs out, the MDM can lose contact with devices, new devices stop enrolling automatically, or apps can't be assigned.

Time a full setup from the moment the device is switched on until the person can work, including app downloads and the first sign-in. The time depends on the network and on how many apps install, so don't promise one fixed setup time.

Roll out updates through a policy you've tested. Start with a small group, set a deadline and keep a way to hold back devices that can't update yet, for example because a business app doesn't support the new version. Watch for failed installs, and tell people what's coming before a deadline forces a restart.

When you retire a device, remove its access to business accounts and data, take back its app licences so they can be reused, and check that it was erased the way your policy requires. Clear Activation Lock through the authorised route, such as your MDM, so the next person can set the device up. Release it from Apple Business only when you sell it, give it to another organisation or dispose of it. After that, it no longer enrols in your MDM automatically.

Apple Platform Deployment · Apple Business · User Enrollment · Software updates