iOS Supervised Mode

What is iOS Supervised mode?

Supervised mode is a feature introduced by Apple in iOS 5 to differentiate institutionally owned iOS devices from personal devices. Supervision offers tremendous benefits to organizations and institutions. Supervised devices are ideal for functioning in Healthcare, Retail, Education and related sectors.

It unlocks additional management features than those available in any Mobile Device Management software. Supervision allows IT departments to restrict many features that are inappropriate for corporate-owned or shared devices, such as AirDrop, Messages, Handoff, and even Erase. Supervision offers the organization an enhanced level of security and a deeper layer of device management.

How to enable iOS supervised mode?

Method 1: Using Apple Configurator

The iPad is increasingly becoming a business tool in many industries with people integrating their iPads into core business and management operations. Since the collective aka fleet management of iPads proved to be difficult, an efficient way of managing the deployment and maintenance of iPads became crucial. This is where the Apple Configurator makes its way into the scenario as a blessing, being a follow-up to Apple’s previous iPhone Configuration Utility (IPU).
The Apple Configurator has three modes:

Prepare

Prepare is used for initial setup and deployment. Preparing a device restores the iOS device and will wipe any data on it. Here, you can configure the basic settings like adding the company logo/wallpaper, default passwords, etc. Import Profile feature can be used to import an already existing profile. Otherwise, one can create a new profile from scratch with Create New Profile. Once the settings are configured, they’re saved locally within an XML file called {profile name}.mobileconf. Once the device has been put together for configuration, click the Prepare button at the bottom of the Configurator window to apply the desired configuration.

Supervise

Supervision can be enabled using the Apple Configurator or by using 3rd party MDM software that support the Apple Device Enrollment Program (DEP). If you use Apple Configurator alone to manage your devices, then they need to be physically connected to a Mac. However, Mobile Device Management software like Hexnode MDM allows you wirelessly enroll, configure, manage and secure those devices. More importantly, you’ll have more granular control over the devices like App management, location tracking, and remote device management capabilities.
After the iPad configuration with Supervision is prepared, it can be re-applied in the future. Supervise will reset the device (removing the unnecessary user-data that was put on the device during its usage including notes, data in apps, phone numbers, etc).

A useful feature in Supervise mode is “Export Info” that will generate a list of all currently supervised devices with UDID, Device Name, Device Capacity, Wi-Fi Mac Address, and Bluetooth Mac address (great for asset management, tracking, loss prevention and upgrade planning).

When one makes changes and one or more devices are not connected, and the changes are applied the next time those devices are connected, this is referred to by Apple as device check-in. When a device or a group of devices is updated, the changes made on them are applied automatically once saved, by clicking the Apple button at the bottom of the Configurator window.

Assign

The Assign pane enables one to create and manage user accounts and to assign devices to specific users. There are two lists in the Assign pane, the user groups to the left and the users list to the right of it. Users can be created by clicking the Add button under the users list. One can organize users into groups by creating a group, naming it, and then dragging users into it.
If your Mac is connected to a corporate directory system like Microsoft’s Active Directory or Apple’s Open Directory, you can create accounts in Configurator based on their existing network accounts (the ones that they use to log into various computers).

To assign or check out a device, select the user and click the Check Out button at the bottom of the Configurator window. Select the group containing the device from the pop-up menu and drag the appropriate device to a user account. Once the devices have been assigned, they are connected to the Mac via USB and Configurator will complete the check-out process.

When users return devices, they can be checked in again by connecting them to the Mac running Configurator, selecting the users in the Assign Pane and clicking the Check In button. Configurator will back up the user data automatically and use it if a different device is to be assigned to that user.

Method 2: Using Device Enrollment Program (DEP)

Apple Device Enrollment Program (DEP) is a deployment program from Apple for the fast deployment of iOS and OS X devices. The configuration of devices which are purchased through DEP can be done over the air in bulk without requiring any physical contact with the device. The device can be enrolled in an MDM and can be supervised from the DEP portal itself. DEP is the only way to supervise devices wirelessly. Any step that usually appears during the initial set up process can be set to skip. Any restrictions can be applied to the device without a single tap through the actual device.
Only the devices which are purchased directly from Apple or from an authorized Apple reseller can be deployed using Device Enrollment Program. Any Mac or iOS device that has been purchased on or after 2011 March 1 can be enrolled in DEP.

Deploying the devices using DEP takes four steps

  1. Enroll
  2. Set up
  3. Configure
  4. Assign

First, you need to enroll your organization in Apple Deployment Programs.

Enrolling organization in DEP

  • In deploy.apple.com create your program agent account, where you are to give your business email, a valid phone number, D-U-N-S number, Apple customer number or reseller ID. The customer number is obtained when a direct purchase is made from Apple. If you are purchasing from a reseller, verify if they are participating in DEP. If they are, they will give you the reseller ID. The Apple ID is created using this email address, so this email address you provide should not be associated with another Apple ID.
  • Once you have entered all the details and clicked next, an email will be sent to your mail containing the Apple ID and temporary password along with further steps for enrollment.
  • You will be prompted for two-step verification. Two-step verification enables additional security to your Apple ID in such a way that any unauthorized access to your account will be prevented even if the password is compromised. A four digit verification code will be sent by SMS. Type this code in and verify your account.

Continue enrollment process by providing information like verification contact, business or institution information, Apple Customer Number, DEP Reseller ID and DEP Customer ID. After submitting the application, Apple will review the information and notify you if verification is completed or not.

When purchasing a device from Apple or a reseller you will need to add the customer number or reseller ID to the Apple DEP account. When reseller ID is submitted you will receive a DEP customer ID and you have to provide this to the reseller who will use it to submit information about your device purchases to Apple. Resellers have the ability to add devices to your DEP account which is purchased after 2011.

Adding more Admins

Once the enrollment is done you can set up the corporate devices from deploy.apple.com

  • Sign in to your account and select Device Enrollment Program.
  • At the top right corner you will see the admin. Clicking on that, you can view the organizational details like your reseller, your DEP customer ID etc.
  • You can have multiple resellers. By clicking on Admins in the side bar and add more admins. The admins can be selected from the list and can be provided with appropriate access for DEP or VPP.

When providing email address for these admins you have to provide one which does not have an Apple ID associated to it.

Enrolling MDM server with DEP

  • Select Device Enrollment Program from the side bar. You will see the Manage Servers page. You can add one or more MDM servers here by clicking Add MDM Server. Then you can give a name to the server and choose to automatically assign devices or not. Selecting this option will result in automatic assigning of devices to this particular MDM server in the future. If you are using multiple MDM servers leave the option unchecked.
  • After the MDM server are set up click next. Here Apple will require you to upload the public key for the MDM server.
  • Download the public key from your MDM server and upload it back in the DEP portal.
  • Click next. And then it will have you download the server token for you MDM server.
  • Download the token and click done.
  • Upload this server token in your MDM server and thus enroll the MDM with DEP.

Now in the DEP portal you can see your MDM server listed.

Adding devices for deploying

For adding devices

  • Click on Manage Devices on the side bar of DEP portal. You can choose devices by serial number or order number or by uploading a CSV file.
  • Assign an MDM server to these devices.
  • Create DEP profile in your MDM and apply it to the devices.
  • You can set the MDM enrollment mandatory or not, choose to supervise, allow pairing with other computers, whether the MDM profile can be removed or not, whether the device is for multiple users etc. You can also select steps that can be skipped during the initial setup of the device. You can provide details on the organization and add contact details for support. Once the settings are saved you can assign this policy to the devices. So when the device is activated for the first time these profile settings will be applied automatically in the background.

    Sign up for 30 day free trial!
    GET STARTED