Automated Device Enrollment: How It Works in iOS 12

This article provides an overview of Apple's Automated Device Enrollment (formerly part of the Device Enrollment Program, or DEP), explaining its core enterprise capabilities and its specific operation on devices running iOS 12. Readers will learn the mechanics of out-of-the-box zero-touch deployments, the security benefits of automatic supervision, and how iOS 12 handles Setup Assistant customization and profile enforcement during initial device activation.

What is Automated Device Enrollment?

Automated Device Enrollment (ADE) is an Apple deployment service integrated within Apple Business Manager (ABM) and Apple School Manager (ASM). It enables organizations to automatically enroll corporate-owned iOS devices into a Mobile Device Management (MDM) solution without requiring IT administrators to physically touch, configure, or stage each device.

When organizations purchase devices directly from Apple or through participating authorized resellers and carriers, those devices are automatically linked to the organization's ABM or ASM account. ADE bridges the gap between hardware procurement and MDM policy enforcement, ensuring that enterprise configurations, restrictions, and applications are installed the moment a device is powered on and connected to the internet.

Key Capabilities of Automated Device Enrollment

  • Mandatory MDM Enrollment: Devices can be configured so that enrollment into the organization's MDM server is mandatory. Users cannot bypass the management step during setup.
  • Supervised Mode Over-the-Air: ADE automatically places devices into Supervised mode wirelessly during activation. Supervision unlocks higher-level management controls, such as silent app installation, web content filtering, and global proxy configurations.
  • Non-Removable Management: Administrators can prevent users from removing the MDM profile, ensuring persistent management and security compliance throughout the device's lifecycle.
  • Streamlined Setup Assistant: IT can customize the setup process by skipping unnecessary configuration screens, drastically reducing onboarding time for the end user.

How Automated Device Enrollment Functions in iOS 12

In iOS 12, Automated Device Enrollment follows a defined lifecycle that transitions a device from a factory-sealed state to a fully secured, enterprise-ready tool.

1. Device Assignment

An administrator logs into Apple Business Manager or Apple School Manager and assigns the serial numbers of the eligible iOS 12 devices to their designated third-party MDM server. Within the MDM console, the administrator configures an enrollment profile defining setup behavior, authentication requirements, and security payloads.

2. Device Activation and Apple Handshake

When an end user powers on a new or factory-reset iOS 12 device, the native Setup Assistant initiates. The user selects a language, region, and connects the device to a Wi-Fi network (or cellular connection).

During the standard Apple activation check, the iOS 12 device contacts Apple’s activation servers. The server identifies the device's serial number as belonging to an enterprise organization enrolled in ADE and redirects the device to the assigned MDM server.

3. Remote Management Enforcement

Rather than proceeding to standard consumer setup steps, the iOS 12 screen presents a Remote Management pane displaying the organization's name. At this stage:

  • The device downloads the enrollment profile directly from the MDM server.
  • If configured by IT, the user must authenticate using corporate credentials (e.g., Active Directory or Azure AD credentials via modern authentication).
  • The MDM profile is applied, making the device immediately Supervised.

4. Setup Assistant Customization in iOS 12

iOS 12 introduced new features to the Setup Assistant, most notably Screen Time. With ADE in iOS 12, administrators can configure MDM payloads to selectively hide or show modern setup panes to streamline user deployment. Skippable screens in iOS 12 include:

  • Apple ID and iCloud setup
  • Touch ID / Face ID configuration
  • Siri configuration
  • Screen Time setup
  • Apple Pay
  • Diagnostics reporting

5. Final Provisioning

Once the Remote Management process completes and the remaining Setup Assistant steps are finished, the user lands on the iOS 12 home screen. The MDM server automatically pushes corporate policies, restrictions, Wi-Fi certificates, email profiles, and managed applications in the background without requiring user intervention.