undefined | Better HN

0 pointsjoshstrange1y ago0 comments

MDM is not easy but you can enroll devices after the fact, pre-enrollment isn’t the only option. But yes, it’s a PITA to deal with even at the best of times.

0 comments

Avamander1y ago

You can, but that does not give you a supervised device, as I said.

joshstrangeOP1y ago

Ahh, maybe I’m mistaken or maybe iOS works differently. I believe you can enroll it in MDM and then you have 30 or 60 days to kick it out at any time and then it becomes fully locked in. Or perhaps I have my terminology wrong. I only scratch the surface of MDM at my company.

angulardragon031y ago

This is more to do with ABM - you can add a device to ABM that wasn’t put there by a reseller/vendor/Apple. This also enrols the device, and removing the enrolment in the first 30 days also removes it from ABM again.

After the 30-day period, the enrolment profile cannot be removed on the device-side. This workflow applies for both iOS and macOS.

angulardragon031y ago

On macOS the enrolment is supervised either way. You can also get a supervised enrolment on an iOS device that isn’t in any ABM instance - there is more than one path to supervision.

j / k navigate · click thread line to collapse

0 comments

Avamander1y ago

You can, but that does not give you a supervised device, as I said.

joshstrangeOP1y ago

angulardragon031y ago

After the 30-day period, the enrolment profile cannot be removed on the device-side. This workflow applies for both iOS and macOS.

angulardragon031y ago

On macOS the enrolment is supervised either way. You can also get a supervised enrolment on an iOS device that isn’t in any ABM instance - there is more than one path to supervision.

j / k navigate · click thread line to collapse