iOS Store app keeps asking for iTunes sign-in when pushed from HexnodeSolved

The Apple ID or iTunes sign-in prompt usually appears when the app is deployed as a standard App Store app. Standard Store app deployment may require user authentication on the device.

For silent app installation on iOS, two conditions are typically required:

1. Deploy the app as a VPP app through Apple Business Manager.
2. Enroll the device through Automated Device Enrollment (ADE), so the device is supervised and fully managed.

If ADE sync shows 0 devices added and an ADE account already exists in Hexnode, check whether the ADE server token has expired. An expired token breaks the connection between Apple Business Manager and Hexnode, so devices will not sync.

To renew the ADE token:

1. Log in to Apple Business Manager.
2. Go to Devices.
3. Open Device Management Services/Management and select the MDM server used for Hexnode.
4. Click the ellipsis menu and choose Download Token.
5. Confirm by downloading the new server token.
6. In Hexnode, go to Admin > Automated Device Enrollment > Accounts.
7. Edit the corresponding ADE account.
8. Upload the new server token and save the changes.
9. Run an ADE sync again.

After the devices are synced, assign the required ADE profile and reset the iPhones. During setup, once the device connects to the internet, it should show the Remote Management screen and enroll into Hexnode through ADE.

That helps. One thing I’m still confused about: I’ve enrolled other iPhones with a QR code before and they worked fine. Why do these particular iPhones need ADE instead of just QR enrollment?

QR enrollment and ADE enrollment are different management flows. QR code enrollment is a manual, user-driven enrollment method. It can be quick for getting a device into Hexnode, but the management profile may be removable by the user, and the device may not get the same supervised, corporate-owned controls unless it was prepared separately.

ADE is meant for organization-owned Apple devices assigned in Apple Business Manager. When a device is assigned to your MDM server in Apple Business Manager, Apple ties that device to your organization at the hardware level. After a factory reset, the device contacts Apple during setup and displays the Remote Management screen automatically.

ADE provides stronger management capabilities, including supervision, non-removable MDM profiles when configured, and silent installation of VPP apps. That is why it is the recommended path for corporate-owned iPhones that are listed in Apple Business Manager.

So if the iPhone is already assigned to the MDM server in Apple Business Manager and I reset it, can I skip ADE and enroll it with the QR code instead?

No. If the iPhone is assigned to the Hexnode MDM server in Apple Business Manager, it will check in with Apple during setup after the reset. Once it connects to the internet, the Remote Management screen appears and the device is directed to enroll through ADE.

QR enrollment cannot override that Apple Business Manager assignment during setup. To use ADE correctly, renew the ADE token, sync the devices into Hexnode, make sure an ADE profile is assigned, and then factory reset the iPhones so they enroll during the setup assistant.