iOS 12 Features for Apple Business and School Manager

With the release of iOS 12, Apple introduced several management and deployment enhancements designed to optimize device provisioning through Apple School Manager (ASM) and Apple Business Manager (ABM). These updates focused heavily on streamlining the Automated Device Enrollment process, expanding Mobile Device Management (MDM) payload controls, and increasing security restrictions on supervised devices. This article outlines the specific deployment features, Setup Assistant configurations, and supervision capabilities added to iOS 12 for enterprise and education environments.

Enhanced Setup Assistant Customization

iOS 12 introduced new configuration options for Automated Device Enrollment (formerly DEP), allowing administrators to suppress additional setup screens when devices first boot. These options minimize user intervention during deployment:

  • Skip Screen Time: Administrators can suppress the Screen Time introduction pane during initial setup.
  • Skip Software Update Settings: The prompt asking users to enable or disable automatic software updates can be bypassed.
  • Skip SIM Configuration: On supported cellular-enabled hardware, MDM can suppress prompts related to cellular plan setup.
  • Disallow Proximity Setup: Administrators can block the "Quick Start" proximity-based setup screen. This prevents users from migrating personal iCloud settings and data from an existing device to a newly enrolled corporate or institutional device.

Advanced Supervision and Restriction Payloads

Supervised devices managed through ABM or ASM gained several new restriction keys in iOS 12 to enforce security baselines and administrative control:

  • Password Sharing Restrictions: Administrators can prevent users from sharing passwords via AirDrop and disable the AutoFill Passwords feature.
  • Password Autofill Request: MDM can enforce that a device always requires biometric authentication (Face ID or Touch ID) before autofilling credentials.
  • Date and Time Enforcement: Supervised devices can be restricted from manually changing the system date and time, ensuring accurate audit logs and preventing policy bypasses.
  • USB Restricted Mode Management: MDM profiles can configure or enforce USB Restricted Mode, controlling whether USB accessories can connect to a device that has been locked for more than an hour.
  • Bluetooth Modifications: Administrators can prevent end users from toggling Bluetooth settings on supervised hardware.

Network and Authentication Improvements

To simplify device access to enterprise services, iOS 12 brought enhancements to network and credential payload configurations:

  • OAuth for Exchange Accounts: The Mail payload supports OAuth 2.0 authentication for Microsoft Exchange accounts, enabling secure modern authentication workflows during automated account configuration.
  • 802.1X Network Setup: Enhancements were added to allow devices connecting to enterprise networks via 802.1X protocols to handle EAP types and network trust certificates more reliably during zero-touch deployment.

Education and Classroom Deployments

For institutions using Apple School Manager, iOS 12 introduced tighter integration with teaching tools:

  • Classroom App Independence: Unmanaged classes became supported alongside ASM-synced rosters, giving educators flexibility while maintaining management profiles on student iPads.
  • Classroom Permission Controls: Administrators can configure student devices to automatically grant teachers permission to view screens or lock devices without requiring per-session student approval.