iOS Supervised Mode

What is iOS Supervision?

Supervision is a specialized mode for institutionally owned iOS devices that grants administrators deeper control over device configurations. It unlocks advanced restrictions, enables silent app installations, and supports specific features like Autonomous Single App Mode (Kiosk) and Global Proxy that are unavailable on unsupervised devices.

Why supervise iOS devices?

Supervision is essential for corporate environments requiring strict compliance and automation.

• Silent Installations: Deploy apps without user interaction.
• Advanced Restrictions: Allowlist/blocklist apps, force web content filtering, and prevent account modification.
• Kiosk Mode: Lock a device to a single application.
• Global Proxy: Route all device traffic through a specific proxy server.

Methods to supervise iOS devices

There are two primary methods to enable supervision:

1. Apple Configurator: Requires a Mac and a physical USB connection. Best for small batches.
2. Automated Device Enrollment (ADE) / Apple Business Manager (ABM): Entirely over-the-air. Best for bulk deployments and “zero-touch” configuration.

Method 1: Supervision via Apple Configurator 2 (Mac Only)

This method involves physically connecting devices to a Mac.

Step 1: Create a Wi-Fi Profile

1. Open Apple Configurator.
2. Navigate to File > New Profile.
   
3. Enter a profile name. Set Security Type to “With Authorization” and provide a password. Also, set Automatically Remove Profile to “Never”.
   
4. Select Wi-Fi from the left menu and click Configure.
   
5. Enter the Service Set Identifier (SSID) and select Auto Join.
6. Configure Proxy Setup and Security Type.
7. Enter the Wi-Fi password.
8. Select Network Type as Standard.
   
9. Go to File > Save to save the profile.
   
   

Step 2: Create a Blueprint

1. Click File > New Blueprint.
   
2. Name the blueprint.
   
3. Select the new Blueprint and click Add > Profiles, select the Wi-Fi profile created in Step 1, and click Add.
   
   
   

Step 3: Prepare the Device

1. Select the Blueprint and click Prepare.
2. Set Configuration type to Manual and click Next.
   
3. Select New server and click Next.
   
4. Enter the Server name and Server URL:
   
   • Go to Hexnode portal: Enroll > Platform-Specific > iOS > Apple Configurator.

     

   • Copy the URL from the portal and paste it into Apple Configurator, and click Next.
     
5. Anchor certificates are added automatically. Click Next.
   
   
6. Enter organizational details to create an organization and click Next.
   
7. Select Generate a new supervision identity and click Next.
   
8. Choose which iOS Setup Assistant steps to show or hide, then click Prepare.
   
   

Step 4: Apply Blueprint

1. Connect the iOS device to the Mac via USB.
2. In Apple Configurator, right-click the device.
3. Select Apply > [Your Blueprint Name].
   
4. Click Apply.
   
   
5. Result: The device will reboot with MDM enrollment, Wi-Fi, and Supervision settings applied.
   

Method 2: Supervision via Automated Device Enrollment (ADE)

This method automates supervision over-the-air during the initial device setup (out-of-the-box experience). It requires the organization to be enrolled in Apple Business Manager (ABM) or Apple School Manager (ASM).

Step 1: Configure ADE Profile in Hexnode

1. Log in to Hexnode UEM.
2. Navigate to Enroll > All Enrollments > No-Touch > Apple Business/School Manager > Enrollment Profiles.
3. Select Create Enrollment Profile.
4. Configure the parameters in the enrollment profile.
5. Click Save.

Step 2: Create an ADE Account (Link Hexnode to ABM)

1. On the Hexnode UEM portal, go to Enroll > All Enrollments > No-Touch > Apple Business/School Manager.
2. Click Add ADE Account.
3. Enter an Account Name and download the certificate file (Hexnode_Apple_DEP_cert.pem).
4. Log in to Apple Business Manager.
5. Go to Preferences > MDM server assignment > Add MDM Server.
6. Upload the Hexnode certificate (public key) and click Save.
7. Click Download Token to get the server token.
8. Return to Hexnode and upload the token in the Upload ADE server token field.
9. Optionally, you can enable Add as Pre-approved device to pre-approve the ADE devices that you want to enroll using Hexnode.
10. Select the Default Configuration Profile. Either use the default ADE profile or choose another from the dropdown.
11. Configure the User Authentication Mode:
    • Use global authentication settings: Follows the settings under Admin > Enrollment > Authentication Modes.
    • No authentication: Allows enrollment without user verification; specify the user to assign the device to.
      • Domain: Choose the directory domain (Hexnode local or an integrated directory).
      • Default user: Assigns all ADE devices in this account to the selected user in that domain.
12. Click Next to finish.

Step 3: Assign Devices to the MDM Server

Once the ADE configuration is complete, you can assign Apple devices individually or in bulk to the device management server.

Individual Device Assignment

1. On the Devices page, select the device to assign, and click on Edit MDM server.



2. In the dropdown, choose Assign to the following MDM and select the desired server. Click Continue.

   

3. Click Confirm to finalize the assignment.

Bulk Device Assignment

Option 1: Manually select devices

1. On the Devices page, hold the Command key (Mac) or Control key (Windows) to select multiple devices.

Option 2: Apply Filters

1. Use filters like Device Management, Source, Order number, Device type, and Storage size to narrow down your device list.
2. Click Filters below the search bar, select the criteria, and click Search.

   

3. From the filtered list, select All devices or individual devices.
   
4. Click Edit next to Edit MDM server.
   
5. Select Assign to the following MDM from the dropdown and choose the MDM server.

   

6. Click Continue, then click Confirm to assign the devices to the management server.

The assigned device details, including order number, MDM server, assignment date, and device type, will be visible in the Assignment History.

Step 4: Sync Devices with Hexnode

Devices added to the Hexnode-specific MDM server in the Apple Business Manager (ABM) portal need to be synced with Hexnode. This process imports information about newly added devices into the integrated ADE account.

1. On the Hexnode UEM portal, go to Enroll > All Enrollments > No-Touch > Apple Business/School Manager > Accounts.
2. Click Sync all ADE accounts.
3. Verification: Check Devices to see the synced list. To filter devices by a specific ADE Account, change the device filter from All Devices to the desired ADE Account.

Renew ADE Server Token

The ADE server token is valid for one year. After the token expires, there is no need to upload a new public key to Apple ADE, as the public key is permanently stored. To renew the token, simply click Generate new token.

Device End-User Experience

• New/Wiped Devices: Upon boot and internet connection, the device detects the ADE profile. It will automatically enroll in Hexnode and apply Supervision settings.
• Provisional Period: Devices added to ABM manually (via Apple Configurator) have a 30-day provisional period. Users can remove management via Settings during this time. After 30 days, management can become permanent.
• Renewing Token: The ADE server token expires yearly. Use Generate new token in ABM and upload it to Hexnode to renew without re-enrolling devices.

When the user opens the Settings app, a banner will appear showing your organization’s name, along with a link to the Device Supervision manual.

Troubleshooting Tips

• Common errors while enrolling in Apple Business Manager.
• Common errors while enrolling iOS devices using Apple Configurator.