Apple DEP Enrollment

Benefits of DEP Enrollment

iOS, tvOS, and macOS can all take advantage of Apple DEP enrollment. DEP enrollments will force a specific set of preferences on the device and force enrollment to FileWave any time the device is Factory Reset. Another huge benefit of DEP is that DEP is the only enrollment option that prevents the end-user from removing the MDM Profile and unenrolling the device. These two aspects can be very helpful in device recovery situations since if the device is wiped after being lost or stolen, the device will automatically enroll back into FileWave where you can lockdown the device and collect Location Tracking information to report to the authorities.

If you have not already created your Apple Push Notification Service Certificate (APNS) or configured DEP to sync with FileWave, please review the Platform Integrations > Apple section before continuing.

Creating DEP Profiles

The first step to enrolling your Apple devices via DEP is to create a DEP Profile. The DEP Profile is what will determine the initial settings applied to the device during enrollment and applies to all Apple platforms. Unless needing explicit seperation of the initial enrollment settings, one DEP Profile can suffice for all of your devices. This is partly possible since we can use FileWave Custom Fields to uniquely name the devices.

Open FileWave Admin and navigate to "Assistants > DEP Association Management". Click the "[+]" button on the right-hand side under "Profiles". Fill out each tab according to your management preferences.

Assigning DEP Profiles

Assigning DEP Profiles is very easy within FileWave, especially if you only have one DEP Profile since you can set a Default DEP Profile. With a Default DEP Profile configured, anytime you assign a new device to the FileWave MDM Server from within Apple School Manager or Apple Business Manager, the DEP Profile will automatically apply and the device will be ready for DEP enrollment. However, if you have multiple DEP Profiles, FileWave will also enable you to create Rule-based DEP Profile assignments or you can always just drag-n-drop a DEP Profile onto a single device or multiple devices onto a DEP Profile.

The "Profile Status" field in the "Devices" pane tells you the current status of the DEP profile on the client device.

Empty - no DEP Profile assigned Assigned - DEP Profile has been assigned but DEP enrollment has not occurred Pushed - Setup Assistant setting has run and settings have been enforced on client device Removed - DEP profile has been unassigned from device, will be changed to "Empty" after DEP sync

Setting Default DEP Profile

Open FileWave Admin and navigate to "Assistants > DEP Association Management". Click "Edit Assignment Rules". Select your recently created DEP Profile from the "Default DEP Profile" dropdown menu. Click "OK". Click "Apply Assignment Rules" to save the changes. Hold the Option or Alt key on your keyboard and click "Synchronize (full sync)" button in lower right-hand corner You should now see that all of your devices have been "Assigned" to your DEP Profile.

DEP Associations.png

Rule-based DEP Profile Assignment

Open FileWave Admin and navigate to "Assistants > DEP Association Management". Click "Edit Assignment Rules". Click "[+]". Select the DEP Profile you'd like to assign based on rules. Drag-n-drop the Inventory data point the devices must meet to be assigned to the DEP Profile into the "Criteria" section. Verify the criteria is correct by viewing the returned devices in the "Fields" section. "Save" the query and "OK" to save rule definition. Click "Apply Assignment Rules" to save the changes. Hold the Option or Alt key on your keyboard and click "Synchronize (full sync)" button in lower right-hand corner. You should now see that your selected devices have been "Assigned" to your DEP Profile.

DEP Assignment Rule.png

Rule DEP Associations.png

As noted in the Screenshot, the first matching rule (top to bottom) will be honoured; automated rules will override a Default Profile. Hence, Default Profile, if set, is considered the fallback if no rules are met.

Manually assign DEP Profile

Open FileWave Admin and navigate to "Assistants > DEP Association Management". Select one or more devices from left pane and drag-n-drop onto a DEP Profile.

or... Select one DEP Profile from the right pane and drag-n-drop it onto one device.

Generate custom FileWave Client for macOS DEP enrollments

During a DEP enrollment, your macOS devices will automatically download and install the FileWave Client. Before enrolling a macOS device via DEP we must first upload a customized FileWave Client PKG to the FileWave Server.

Custom PKG.png

Generate a custom FileWave Client PKG

Visit FileWave Custom Installer Builder Change the following settings to match your FileWave Server. Click "Build" and wait for automatic download of ZIP. Extract ZIP.

Mandatory Settings

Product Version = Your FileWave Server Version Sync Computer Name = macOS Hostname will be FileWave Client Name (recommended) Server Name = Fully Qualified Domain Name of your FileWave Server Server Port = 20015 (do not modify) Client Password = Password used to change individual Client Preferences and to start screen-sharing session Optional Settings

Is Tracking = Is Location Tracking Enabled for macOS Clients Monitor Port = Port used for FileWave Client Monitor (do not modify) Overwrite Configuration = Overwrite any existing FileWave Client configuration with settings entered here (recommended) Remotecontrol Enabled = Screen-sharing enabled for Windows Clients Remotecontrol Prompting = Whether or not to Prompt the end-user before starting screen-sharing session Server Certificate = Only upload certificate is using a Self-Signed Certificate; not required for CA-signed certificate Server Publish Port = 20005 (do not modify) Tickle Interval = Idle time for Windows Clients before checking for new Model Update (do not modify) Vnc Relay Port = 20030 (do not modify) Vnc Server Port = 20031 (do not modify) Booster Settings

Do not configure unless instructed by FileWave SE

macOS Custom Client Import.png

Upload custom FileWave Client PKG to FileWave

Navigate to "FileWave Admin > Preferences > Mobile > macOS". Click "Upload macOS client package" and authenticate. Select the extracted "FileWaveClient_XX.X.XX-FQDN-XX-XXX-XXXX.pkg" from previous section. Wait for the upload confirmation prompt. Optionally, enable "Use for initial enrollment only".

If this box is unchecked, FileWave will deploy any new FileWave Client version uploaded to all MDM enrolled macOS devices. Click "OK" to save the Preferences.

Enrolling Apple devices via DEP

Now that your devices have been "Assigned" to a DEP Profile, they can either be Factory Reset if already configured or taken fresh out of the box from Apple and they will automatically enroll into FileWave.

If getting authentication required during enrollment, please review this section to learn how to disable DEP enrollment authentication.

macOS

iPadOS