How to Configure Automated Device Enrollment – Addigy

Automated Device Enrollment (ADE) enables administrators to configure and manage corporate-owned Apple devices from the moment they're removed from the shrink-wrapped box.

Addigy provides the ability to associate a unique MDM Server per Policy, allowing for multiple Automated Device Enrollment connections within a single Addigy environment.

Note: To proceed, you must have administrator access in an Apple Business or School Manager account, owner access in Addigy, and have Set up Policy MDM Profiles.

Note: Apple periodically updates the Apple Business/School Manager Terms of Service (ToS). Immediately following an update, you can only enroll devices via Automated Device Enrollment once the new ToS are accepted. For reference: Apple Business / School Manager Terms and Conditions Update and Restoring Automated Device Enrollment Connectivity.

Uploading the Server Token

See Apple's documentation, link to a third-party MDM Server in Apple Business Manager, or follow the instructions below:

In Apple Business/School Manager , sign in with a user that has the role of Administrator or Device Enrollment Manager.
Select your name at the bottom of the sidebar and click Preferences
Click the Add button next to Your MDM Servers, then enter a unique name for the server.

If you don’t want this MDM Server to have the ability to release devices, see Release devices.
Head on over to your Addigy Environment, navigate to the Policies page and select a Policy you'd like devices to enroll in.
Click the Integrations & Settings tab in the policy navigation section and select the Automated Device Enrollment tab.
Select Get Addigy Public Key from the page, and once downloaded, navigate back to ABM/ASM and upload this key by selecting Choose File...
Download the Server Token from your newly created MDM Server in ABM/ASM and upload it into the Upload New Token button within the Addigy Policy's ADE view.

Assigning Devices to Your MDM Server in Apple Business/School Manager

Since a new MDM Server has been made, you will need to assign any pre-existing devices to this new MDM Server. If you do not have any devices in your ABM/ASM portal yet, you can skip this for now.

Note: If you are assigning a new device that has not been set up, these steps should be done before going through Setup Assistant. It can take an arbitrary amount of time for the device to shift to the new server, and if everything is done too quickly, the device may not see the Remote Management screen, which is responsible for performing the enrollment.

Sign in to Apple Business Manager.
Select the Devices > Device to assign > 3 dots "..." > Edit MDM Server and select your MDM Server from the list.
Confirm the assignment. The device will enroll into the policy that contains the MDM Server's token.

Configure the Automated Device Enrollment Profile

For the integration to be considered complete, you must set up an ADE Profile. First, enter all the company information you want to be reflected on devices during ADE enrollment and thereafter.

Then complete the ADE Enrollment Settings and End-User Setup Assistant Experience sections (see below). Note that each Operating System's enrollment behavior and options will vary (e.g., macOS, tvOS, iOS).

ADE Enrollment Settings

These settings will determine what the device does upon setup and enrollment. For a full list of each setting's functions, please refer to Automated Device Enrollment Settings.

End-User Setup Assistant Experience

This section will determine what your end-users see during enrollment. You can configure branding to make it clear where the device is enrolling, configure authentication, and determine which steps of Setup Assistant the user will see.

Authentication

Addigy allows admins to secure how users are able to enroll devices through Automated Device Enrollment. There are currently three authentication methods available for admins:

No Authentication: Authentication is not needed to proceed through Setup Assistant.
Passcode: The user must enter this passcode to complete Setup Assistant. The passcode needs to be a 15-character alphanumeric string. Users who do not have this passcode will not be able to proceed through enrollment.
SSO Enrollment: To complete Set Up Assistant, the user must enter their Identity Provider login. Only users assigned to the application on the identity provider side can complete enrollment. To learn more about this setup, please refer to the following KBs: Okta, Microsoft Entra ID, and Google.

Custom Branding and Content Window

In this section, you can set your own image and a custom message that the user will see before continuing through the ADE process. Here is an example:
Image of Setup Assistant with custom Terms of Service

These are the recommended image settings for optimal formatting:

Image Type: PNG
Max Height Constraint: 96px
Max Width Contraint: 250px

Skip Setup Assistant Screens

If you do not want the user to see anything from Setup Assistant, you can just select the "Skip All" checkbox.

After you've configured everything according to your preferences, click Save Settings at the bottom of the page. Once the Automated Device Enrollment Profile is saved, your Automated Device Enrollment devices will install Addigy during their initial setup.

Ensure Devices are Ready to Enroll

As soon as your Apple Automated Device Enrollment account is linked to the policy, your Automated Device Enrollment enrolled devices will appear in the table below the setup. Before setting up any devices, be sure that they appear as "assigned". For more information on the ADE status meanings, please review the following article: Automated Device Enrollment Profile Status.

You can validate that devices are enrolled in this process when they are powered on for the first time and they reach the Remote Management screen, or the Profile is visible in System Preferences.