Addigy supports three ways to enroll devices into MDM — Automated Device Enrollment, Device Enrollment, and User Enrollment — each with its own trade-offs around setup effort, control, and platform support. This article covers the key considerations for each so you can choose the right one for your environment.
Automated Device Enrollment
Automated Device Enrollment lets administrators enroll devices in MDM without touching them before they reach the end user. It requires an Apple Business Manager or Apple School Manager account. See Apple's documentation on Automated Device Enrollment and Addigy's guide to configuring ADE.
macOS
- Supervision gives administrators more control over devices. On macOS versions prior to Big Sur, devices must be enrolled via ADE to be eligible for Supervision. Big Sur and newer are automatically supervised after enrolling in MDM via Device Enrollment or ADE.
- macOS devices purchased directly from Apple or an authorized reseller are eligible for ADE.
- Devices not purchased directly can still be prepared for ADE enrollment manually using Apple Configurator on iOS for macOS.
- ADE settings can prevent users from removing the MDM enrollment profile. If the device loses connectivity to the MDM server, though, the profile can't be removed remotely — the only way to remove it is to first disable System Integrity Protection.
iOS/iPadOS/tvOS
- Enable Location Services in your ADE configuration — it's the only way to use Find My to locate these devices.
Device Enrollment
Device Enrollment requires administrators to physically access each device to enroll it. See Overview: Add Devices Page (Enrolling Devices) for the enrollment steps.
macOS
- On Apple Silicon devices, Legacy System Extensions (Kernel Extensions) and System Updates can only be managed after putting the device's security policy into Reduced Security mode. See Kernel Extensions and Software Updates Warning on Apple Silicon.
iOS/iPadOS/tvOS
- Apple Configurator can manually enroll these devices in Supervision or Automated Device Enrollment. Both must begin from the device's initial setup stage, so a device already set up or enrolled manually will need to be wiped first.
User Enrollment
User Enrollment lets end users enroll their personal devices in MDM. Administrators can manage these devices, but with more limited functionality than other enrollment methods. See User Enrollment (BYOD) for details.
Frequently Asked Questions
Which enrollment method gives administrators the most control?
Automated Device Enrollment generally gives the most control, since it's the path that supports Supervision on pre–Big Sur macOS and lets you prevent users from removing the MDM profile. User Enrollment gives the least control, since it's designed for personal (BYOD) devices.
Can I switch a device from manual enrollment to Automated Device Enrollment later?
For iOS/iPadOS/tvOS, no — ADE and Supervision must begin from the device's initial setup stage, so an already-enrolled device needs to be wiped first. For macOS, Big Sur and newer are automatically supervised regardless of whether they enrolled via Device Enrollment or ADE.
What happens if an ADE-enrolled device loses connectivity to the MDM server?
If ADE settings are configured to block profile removal, that profile can't be removed remotely while the device is disconnected. The only way to remove it locally is to first disable System Integrity Protection.