iOS / iPadOS iOS and iPadOS are the operating systems developed by Apple for their mobile devices, including iPhones and iPads, respectively. Both operating systems share a similar foundation but have slight variations to cater to the specific form factors and functionalities of their respective devices. iOS and iPadOS provide users with a visually appealing and intuitive interface, seamless integration with Apple services, a vast selection of applications through the App Store, and advanced features like Face ID, Siri, and multitasking capabilities. They offer a secure and reliable platform for communication, productivity, entertainment, and more, empowering users to unleash the full potential of their Apple mobile devices. Block the Apple TV App on Supervised iPhone and iPad Devices Use an iOS/iPadOS Restrictions profile to hide the Apple TV app on supervised iPhone and iPad devices. The profile blocks the app by its bundle identifier, com.apple.tv. Create the Restrictions profile Once in the Filesets view, select New Mobile Fileset at the top and then select the Profile option. Name the profile in the General payload. Other settings in this area are optional. Find the Restrictions payload in the left pane for iOS. Tip: Use the search feature at the top of the window to filter your payloads. Once you have found and selected your Restrictions payload for iOS, click the Configure button on the right pane to enable the payload for this profile. In the profile you will see three tabs across the top. Select the middle Apps tab. Scroll down to the section Restrict App Usage (supervised only) and from the drop down menu select "Don't Allow Some Apps". To create a new object, click the plus sign at the bottom left of the current pane that says: After you have double-clicked the new object, type in the following and then press enter/return to save the entry: com.apple.tv Hit the Save button at the bottom right of the Profile Editor window to save your profile. Please note: If you open this profile after it has been saved you will notice that the entry for com.apple.tv is displayed as "Apple TV" as seen below. You can use the same restriction for another app when you know its bundle identifier. For example, an entry for com.apple.Home is displayed as Home after the profile is saved. Create a test Deployment for a small group of supervised devices. Confirm that Apple TV is unavailable before expanding the Deployment. What iOS and iPadOS App Data Does Inventory Report? FileWave Inventory can report which apps are installed on managed iOS and iPadOS devices. Apple MDM does not provide the per-app usage history that a desktop FileWave Client can collect. Use app inventory to answer which devices have a specific app or which apps a device reports as installed. App details Apple MDM does not report Average Time Used First Launched Date Installed Date Times Launched Total Time Used Why the data differs FileWave manages iOS and iPadOS through Apple's MDM protocol rather than a desktop-style FileWave Client. The MDM inventory response includes installed-app information but does not include these usage metrics. iOS 14 Compatible Devices (Query) Description Details on identifying compatible devices for iOS 14 using the Command Line API to create a Query in FileWave Central and FileWave Anythere.  iOS Inventory Queries to list device compatibility Example query view: Ingredients Administrator Application Token (base 64) FW Admin Inventory Query Compatible Query Incompatible Query ios14_compatible.json ios14_incompatible.json Directions Requires the creation of Inventory Queries.  Two queries are available, one listing incompatible devices and one listing compatible devices.  To upload the queries involves using the FWAdmin CLI (Command Line Interface). Obtain the Administrator Application Token (base 64), then use the following format to upload each Inventory Query to the server.  For example: Token(base 64): eaIaY2Q2MjAkLTVmMzItMGU3AC1kYTcyLTU1NLc4NzNlNDc0An0= Server Address: mdm.filewave.ch File: ios14_compatible.json Command Line API POST You'll have the downloaded file in the same directory as where you run the below command. The below example uses the ios16_compatible.json but you can change that easily. Shell Script: curl -s -k -H "Authorization: eaIaY2Q2MjAkLTVmMzItMGU3AC1kYTcyLTU1NLc4NzNlNDc0An0=" https://mdm.filewave.ch:20445/inv/api/v1/query/ --header "Content-Type: application/json" -X POST -d @ios14_compatible.json PowerShell: $uri = 'https://mdm.filewave.ch:20445/inv/api/v1/query/' $headers = @{ 'Authorization' = 'eaIaY2Q2MjAkLTVmMzItMGU3AC1kYTcyLTU1NLc4NzNlNDc0An0=' 'Content-Type' = 'application/json' } $body = Get-Content -Raw -Path 'ios14_compatible.json' $response = Invoke-RestMethod -Uri $uri -Headers $headers -Method Post -Body $body # Process the response as needed $response Find iOS and iPadOS 27-Compatible Devices with Inventory Reports Description Use the included JSON definitions to import two Inventory Reports (formerly Queries) that identify managed iPhone and iPad devices in Apple’s published iOS 27 and iPadOS 27 compatibility lists. One report lists compatible devices; the other lists managed iPhone and iPad devices that fall outside the published list. Import the files directly in FileWave Central using the Reports interface. iOS 27 and iPadOS 27 are prerelease. These report definitions use Apple’s compatibility lists published with the June 2026 previews. Apple may revise support before the public release, so check the linked Apple pages again before approving a broad upgrade. The compatible report includes devices whose hardware identifier is on the published list or whose reported operating-system version already begins with 27. This means newly released hardware that ships with iOS or iPadOS 27 still appears as compatible before its hardware identifier is added to the report. The incompatible report is limited to iPhone and iPad inventory and intentionally excludes Apple TV and tvOS. Apple’s published compatibility list iPhone: iPhone 11 and later, including iPhone SE (2nd generation and later). iPad Pro: 12.9-inch (4th generation and later), 11-inch (2nd generation and later), and M4 or later models. iPad Air: 4th generation and later, including supported 11-inch and 13-inch M-series models. iPad: 9th generation and later, including iPad (A16). iPad mini: 6th generation and iPad mini (A17 Pro). The iPhone compatibility floor is unchanged from iOS 26. For iPadOS 27, Apple no longer lists iPad Pro 11-inch (1st generation), iPad Pro 12.9-inch (3rd generation), iPad Air (3rd generation), iPad (8th generation), or iPad mini (5th generation). The reports match the current FileWave inventory identifiers iPhone12,* through iPhone18,*, iPad8,9 through iPad8,12, and iPad12,* through iPad17,*. The four supported iPad8 identifiers are listed individually because a broad iPad8,* match would also include older iPad Pro models that are not on Apple’s iPadOS 27 list. Sources: Apple: iOS 27 Preview and Apple: iPadOS 27 Preview. Ingredients FileWave Central access with permission to manage Reports The compatible and incompatible iOS/iPadOS 27 Inventory Report JSON files Compatible report Incompatible report ios27_compatible.json ios27_incompatible.json Historical reference: The original iOS 16 and iOS 17 JSON definitions remain available in this page’s Attachments panel. Use the iOS/iPadOS 27 files above for current compatibility planning. Directions Import in FileWave Central (recommended) Download ios27_compatible.json and ios27_incompatible.json from the table above. Open FileWave Central and select Reports. Choose either Import Reports in the toolbar or right-click in the report list and choose Import Report. Select ios27_compatible.json and complete the import. Repeat the import for ios27_incompatible.json. Open the imported reports in FileWave Central or FileWave Anywhere and compare the results with your current device inventory. Before scheduling upgrades, confirm Apple’s final compatibility lists and pilot iOS/iPadOS 27 on representative hardware. Both controls open the report-import workflow. The toolbar label is Import Reports; the right-click action is Import Report. For general report import and export guidance, see Exporting & Importing Inventory Reports. For automated JSON deployment, see Command Line API (v1): Import an Inventory Report definition from JSON. iOS 26 Compatible Devices (Query) Description Details on identifying compatible devices for iOS 26 using the Command Line API to create a Query in FileWave Central and FileWave Anythere.  iOS Inventory Queries to list device compatibility Example query view: Ingredients Administrator Application Token (base 64) FW Admin Inventory Query Compatible Query Incompatible Query ios26_compatible.json ios26_incompatible.json Directions Requires the creation of Inventory Queries.  Two queries are available, one listing incompatible devices and one listing compatible devices.  To upload the queries involves using the FileWave Command Line API. Obtain the Administrator Application Token (base 64), then use the following format to upload each Inventory Query to the server.  For example: Token(base 64): eaIaY2Q2MjAkLTVmMzItMGU3AC1kYTcyLTU1NLc4NzNlNDc0An0= Server Address: mdm.filewave.ch File: ios26_compatible.json Command Line API POST You'll have the downloaded file in the same directory as where you run the below command. The below example uses the ios26_compatible.json but you can change that easily. Shell Script: curl -s -k -H "Authorization: eaIaY2Q2MjAkLTVmMzItMGU3AC1kYTcyLTU1NLc4NzNlNDc0An0=" https://mdm.filewave.ch:20445/inv/api/v1/query/ --header "Content-Type: application/json" -X POST -d @ios26_compatible.json PowerShell: $uri = 'https://mdm.filewave.ch:20445/inv/api/v1/query/' $headers = @{ 'Authorization' = 'eaIaY2Q2MjAkLTVmMzItMGU3AC1kYTcyLTU1NLc4NzNlNDc0An0=' 'Content-Type' = 'application/json' } $body = Get-Content -Raw -Path 'ios26_compatible.json' $response = Invoke-RestMethod -Uri $uri -Headers $headers -Method Post -Body $body # Process the response as needed $response iOS Guided Access Description Guided Access is a local Apple feature that keeps an iPhone, iPad, or iPod touch in one app and can limit touch input to selected areas of the screen. It is similar in outcome to Single App Mode, but it is configured locally on the device and uses a local passcode. Use Guided Access with iPhone, iPad, and iPod touch Problem The Guided Access passcode is local to the device. MDM cannot read, reset, or manage it. If the passcode is lost, the user cannot exit Guided Access locally. Solution FileWave cannot manage the Guided Access passcode, but an MDM command can interrupt a stuck Guided Access state. Use one of these options: Associate a Single App Mode profile through MDM Set the device into Lost Mode A Single App Mode profile overrides Guided Access while the MDM association is present. After you remove the Single App Mode association and update the model, the device can return to normal app use. Lost Mode can have a similar effect. After Lost Mode is deactivated, verify that the device is usable again. Quick answer: if an iPad or iPhone is stuck in Guided Access and no one knows the passcode, use FileWave to send Single App Mode or Lost Mode through MDM so you can regain control without the local passcode. Related Content MDM Lost Mode (Apple) Unlock Token in iOS 13 FileWave's MDM solution has the ability to unlock devices which are passcode protected. This can be very useful to recover devices without knowing the passcode set by students or users. To achieve this, the device sends FileWave an Unlock Token, which is then sent back to the device with the ClearPasscode request. This ensures security as only the MDM solution where the device is enrolled can unlock the device - and access to user data. Moving forward with security, Apple changed how this token is sent to MDMs in iOS 13: the token is sent only once during enrollment ; therefore it's extremely important to keep this token safe. Apple recently clarified how this change would be effective: the device may still send a TokenUpdate message to the MDM server, but the message will not contain the token anymore. Until FileWave 13.1.3, such a message (TokenUpdate without UnlockToken) was considered to be a message clearing the token ; therefore managing iOS 13 devices with a previous version can lead FileWave to clear stored tokens and then not being able to clear the device passcode. It is therefore highly recommended to: regularly backup your FileWave instance, to keep sensitive data like unlock tokens in a safe place upgrade to FileWave 13.1.3 if you plan to upgrade your devices to iOS 13 ensure iCloud backup is configured on iOS devices You also have the ability to defer software updates by deploying a restriction profile (more information in this KB article) Return to Service feature for iOS/iPadOS What Even though devices can be erased remotely, getting them back into service is a manual process, as it requires someone to physically touch them and take them through Setup Assistant. Apple is removing the additional manual step with the introduction of Return to Service for iOS and iPadOS.  This feature was added in FileWave version 15.1.0 for iOS 17.0 and iPadOS 17.0. As for FileWave version 15.5.0 this was also added for tvOS. When/Why Return To Service is the following process. The MDM server sends an EraseDevice command to the device. The command includes additional information which allows the device to reset, securely erase all data, connect to Wi-Fi, enroll into MDM, and get back to the Home Screen, ready to be used. How With FileWave 15.1.0 support of Return To Service was added. To use Return To Service open Remote Wipe dialog for iOS or iPadOS device. Checkbox Return To Service allows to specify whether feature should be enabled or disabled. It can be checked only if Remove Activation Lock checkbox is checked as well. The feature can be used only if there is at least one configured Wi-Fi profile (fileset containing Network payload with Network Interface “Wi-Fi“). Available Wi-Fi profiles are displayed on combobox. What happens on the device? If Return To Service is enabled on FileWave side and then Wipe Device button is pressed, the device will be wiped and then connected to the Wi-Fi network specified in selected Wi-Fi profile without asking password. Also MDM profile will remain on the device, there will be no need for it to re-enroll in MDM. Related Content FileWave Version 15.1.0 Return to Service feature for tvOS Troubleshooting We have found that on the WiFi profile, setting Security to 'With Authorization' - even with the right password, will break Return to Service. What you will see is that the iPad will not be able to join the WiFi automatically when it boots up though you can manually join the WiFi.  Digging Deeper When Remote Wipe dialog is opened the list of configured Wi-Fi profiles is loaded in format: [(, , , , ),(...)] fileset_id and fileset_name are displayed on the UI, payload_display_name and payload_identifier are used for tool tip. file_id is used as internal data for combobox. When Wipe Device button is pressed, on the backend side is generated MDM command EraseDevice with dictionary field ReturnToService and fields Enabled and WiFiProfileData according to values specified on the UI, then command is added to command queue. When command is grabbed from command queue and is being composed for sending to the device MDMProfileData is added to ReturnToService dictionary. This data matches the final payload that is provided by MDM server when /ios/profile URL is used for OTA enrollment. MDMProfileData is not added for DEP devices. API Command Sending the command to wipe via an API command requires the following data format. '{ "ids": [, ], "command": "EraseDevice", "options": { "DisallowProximitySetup": false, "PIN": "", "PreserveDataPlan": false, "ReturnToService": { "Enabled": true, "WiFiProfileID": } } }' 'ids' is a comma separated list of the Device IDs to be targeted 'WifiProfileID' is the File ID (this is not the Fileset ID) To obtain the WifiProfileID, will require an additional query first.  A full list of all Wi-Fi Profiles can be returned with the following API: curl -X GET "https://${server_dns}/filewave/api/apple/profiles/wifi" -k -H "Content-Type: application/json" -H "authorization: ${auth}" | awk '{ gsub("\\]\\,\\[","\n"); gsub("\\]\\]",""); gsub("\\[\\[",""); print }' Where: ${server_dns} is the server name as seen in FileWave Central -> Preferences -> Mobile ${auth} is the application token as shown in FileWave Central -> Manage Administrators (each user has one or more tokens) The returned list might look something like: 750959,669526,"Profile - HOME WIFI","HOME WIFI","ml1063.lan.4bf6fba8-9cfc-48b5-ad74-a251a65c8759.Configuration.4bf6fba8-9cfc-48b5-ad74-a251a65c8759" 780638,736322,"Profile - WLTC wifi","WLTC wifi","ml1063.local.7a00d6eb-9b4b-4e7e-b68b-7ee7e6414051.Configuration.7a00d6eb-9b4b-4e7e-b68b-7ee7e6414051" 504184,411265,"Profile - Wi-Fi BT 2.4GHz","Wi-Fi BT 2.4GHz","FW1063.local.e285dc3b-9c4b-4a7a-84a9-a3cd5169f92d.Configuration.e285dc3b-9c4b-4a7a-84a9-a3cd5169f92d" 504185,24571,"Profile - Wi-Fi BT 5GHZ","Wi-Fi BT 5GHZ","ML1063.local.02d6d9c3-5a7d-490c-afa8-f160ba9b4e40.Configuration.02d6d9c3-5a7d-490c-afa8-f160ba9b4e40" The first number is the File ID, whilst the second is the Fileset ID. Example Considering the following 3 devices to be wiped using 'Return to Service': Server FQDN from Preferences demo.filewave.ch Authorisation Token e2E1OTU4ZmYyLTg4ZTYtNDEzNC1iZjdhLWE0ZmJmMTViNmI5OH0= "Profile - WLTC wifi" [File ID of Fileset: 'Profile - WLTC wifi'] 780638 iPad001 [FileWave Device ID] 3425 iPad002 [FileWave Device ID] 4342 iPad003 [FileWave Device ID] 3312 The API data block might look like: '{ "ids": [3425, 4342, 3312], "command": "EraseDevice", "options": { "DisallowProximitySetup": false, "PIN": "", "PreserveDataPlan": false, "ReturnToService": { "Enabled": true, "WiFiProfileID": 780638 } } }' and the command: curl -X POST "https://demo.filewave.ch/api/devices/v1/devices/mdm-command" -k -H "Content-Type: application/json" -H "authorization: e2E1OTU4ZmYyLTg4ZTYtNDEzNC1iZjdhLWE0ZmJmMTViNmI5OH0=" -d " iOS/iPadOS BYOD User Enrollment Automatic VPP License Assignment for iOS/iPadOS BYOD What Device-based VPP license assignment is the preferred method for managed iOS and iPadOS devices because it does not depend on a user's Apple Account. BYOD enrollment cannot use device-based assignment, however, and some content such as Apple Books requires user assignment. FileWave's Automatic setting handles both cases: it uses device-based assignment when the device and content support it, then falls back to user-based assignment when they do not. When/Why A VPP app association can assign its license to the device or the user. The VPP preference sets the default for new associations, while the license setting on an individual association can override that default. Select Automatic in Preferences when you want new associations to choose the compatible assignment method. The preference is shown below. You can override that default on an individual association: Automatic first tries device-based licensing. If the device or content cannot use that method, FileWave uses user-based assignment instead. The fallback still needs a FileWave user and VPP user association that can receive the license; Automatic changes the assignment method, not the user identity behind it. Automatic assignment also helps when you do not manage BYOD devices. Apps that support device-based licensing continue to use it. If you later associate an app that lacks device-based licensing or an Apple Book that requires a user, FileWave can use user assignment for that association without forcing you to remember a one-off setting change. How Changing the preference affects new associations. Existing associations keep their current license setting. If a BYOD device receives a device-based association, the app can be associated but cannot install because that enrollment cannot use device-based licensing. Update applicable older associations to Automatic so FileWave can fall back to user assignment. If many existing associations need the same change, use the Associations view to edit them in bulk. iOS BYOD User Enrollment Overview What With Version 14(+) of FileWave, you can now BYOD (bring-your-own-device) enroll a device without giving total management of the device to the system admin.  When/Why Typically, this option works best if the device to be supported is not company owned.  For instance, an employee with their own iPhone may want to BYOD enroll a device to allow distribution of company-owned app licenses, but without giving their company the ability to manage their phone in other ways. How BYOD enrollment is off by default in FileWave, and must be enabled on the Mobile tab in preferences as shown below: Once enabled, a new tab will be added to the "Enroll iOS Device..." Assistant: And, once user enrollment is enabled, you can go to https://my.server.address:20443/ios/byod to see the user enrollment page: Note that by BYOD's very nature the only way you will enroll BYOD devices is through this page. (i.e. it won't be through ADE).  BYOD enrollment does require the use of managed apple ids from either Apple School, or Apple Business, Manager. See below video of a BYOD device enrollment: Unlike a ADE enrollment, you don't have to wipe the device first to BYOD enroll it.  However, trying to enroll a device with a managed Apple ID that is already logged into iCloud on the device will result in an error. Account-Driven User Enrollment for iOS/iPadOS BYOD Devices (v15.0+) What In 2021, Apple introduced Account-Driven User Enrollment, a new method for initiating Bring Your Own Device (BYOD) enrollments. With the releases of iOS 17 and iPadOS 17, profile-based User Enrollment is deprecated, and starting with iOS 18 and iPadOS 18, it is no longer supported. To align with these changes, FileWave 15.5 now supports Account-Driven User Enrollment (ADUE), enabling organizations to securely enroll BYOD devices using this new workflow. When/Why When to Use BYOD Environments: When employees use their personal iOS or iPadOS devices for work purposes and need access to corporate resources. Transitioning from Profile-Based Enrollment: As profile-based User Enrollment is being phased out, organizations should begin migrating to Account-Driven User Enrollment to ensure compatibility with future iOS and iPadOS versions. Why This Feature Matters Apple aims to enhance the security and privacy of BYOD deployments. Account-Driven User Enrollment offers several benefits: Improved Security: Separates personal and corporate data more effectively, protecting user privacy and corporate assets. Simplified Enrollment: Users can enroll their devices by signing in with their Managed Apple ID, streamlining the enrollment process. Modern Authentication: Utilizes OAuth 2.0 and OpenID Connect for authentication, providing a more secure and standardized method. Organizational Control: Shifts the responsibility of secure enrollment to the organization, allowing for better compliance with internal policies. Account-Driven Enrollment relies on the Well-known URI mechanism for Mobile Device Management (MDM) discovery, ensuring that devices can locate the MDM server securely and efficiently. How Enrolling a Device Using Account-Driven User Enrollment To enroll an iOS or iPadOS device using Account-Driven User Enrollment with FileWave 15.5: On their iPhone or iPad, the user navigates to Settings > General > VPN & Device Management and taps Sign In to Work or School Account. The email entered is used by the device to discover the MDM server. For example, if you enter “pn@widget.ch”, the device queries the widget.ch domain, specifically at https://widget.ch/.well-known/com.apple.remotemanagement. This endpoint must return a specific JSON message containing all the information required to proceed with MDM BYOD enrollment. Therefore, organizations must have control over this URL, which could be an issue for those who completely outsource their website management (see below for potential workarounds). FileWave Setup The existing User Enrollment option in FileWave now enables both legacy BYOD and the new Account-Driven Enrollment (ADUE): FileWave cannot manage your domain but provides some helpful options: Retrieving the Well-Known Content (JSON): If you prefer to host the required file yourself, you can easily obtain the necessary JSON content from FileWave. Click the “Well-known content” button in the FileWave interface. The following JSON will be copied to your clipboard: {"Servers": [{"Version": "mdm-byod", "BaseURL": "https://pn.widget.ch:20445/ios/byod/enroll/"}]} Create a file containing this JSON and serve it from your web server at the appropriate URL (https://yourdomain/.well-known/com.apple.remotemanagement). Setting Up a Redirection to the FileWave Server Endpoint: Alternatively, you can configure your web server to redirect requests from https://yourdomain/.well-known/com.apple.remotemanagement to the FileWave server endpoint. Retrieve the endpoint URL by clicking the “Well-known URL” button in FileWave. For example, the endpoint might be: https://pn.widget.ch:20445/ios/byod/well-known/ Consult your web server documentation for details on setting up the redirection. For instance, to configure Apache, add the following directive inside the VirtualHost section:   RewriteRule ^/.well-known/com.apple.remotemanagement https://pn.widget.ch:20445/ios/byod/well-known/ [R=301,L]   Related Content Apple: User Enrollment and MDM Well-known URI Apple MDM Enrolment Methods Digging Deeper Device Enrollment Process Workflow Navigate to Settings, General Navigate to VPN & Device Management Tap Sign In to Work or School Account… Enter your Managed Apple Account, press Continue. The device will now display the standard authentication page if configured; IDP login is also supported. Enter your credentials and tap Sign In. After a few seconds, the device will prompt you to sign in to iCloud. Tap the button and enter your Managed Apple ID password. And then, press Allow Remote Management to start enrollment. After enrollment, device may prompt to restore iCloud data. Now the device is ready. As a final step, you need to add the device to FileWave. It will appear in the “New Mobile Client” dialog, or it will be automatically added to the model if Auto-Enrollment is enabled. Managing BYOD User Enrollment What You have no doubt gotten used to managing supervised iOS devices, where you have the ability to manage most elements of the device.  If you have previously had folks do a manual OTA enrollment, then you know you have less management of those devices than those that are supervised.  BYOD user enrolled devices take that a step further, and even fewer capabilities exist (but for good reason). When/Why If you are going to utilize BYOD enrollment, it is because the devices to be enrolled actually shouldn't be managed by you, but they should have the ability to leverage the organization's resources.  So, with BYOD enrollment, you can distribute VPP apps and licenses: An important feature provided through the Managed Apple IDs is the deployment of apps and media via VPP For User Enrollment, FileWave will automatically register and associate VPP users for each associated VPP asset on demand (because the licenses can't be associated to the device) Configuration profiles, like email settings and VPN settings are supported (to ease customer setup) But there are also restrictions to management: No access to device-identifying information (e.g. serial number, universal device identifier (UDID), IMEI, or mac addresses) No access to personal data No access to personal apps (no taking management or removing) Limited control capability (no remote wipe, no restrictions, device is not supervised so no profiles requiring supervision) Not all profiles are supported (profiles that restrict the user are largely not permitted, e.g strict passcode requirements, configurations that proxy network traffic, restrictions that block content) How Once the devices are enrolled, associations for content are managed like you are used to, but there is one important (and helpful) change to the way FileWave is managing VPP license assignation.  So please make sure and check out the article linked below on VPP License/Association Changes You may be saying to yourself: "If I have to assign these licenses to the user, doesn't that mean I'll have to create VPP users in FileWave and invite them?"  And the answer to that is thankfully, no.  For User Enrollment, FileWave will automatically register and associate VPP users for each associated VPP asset on demand. New Inventory Item -- Enrollment Type What There are now several methods of enrolling devices into FileWave and a new inventory field has been created to record the enrollment method. When/Why This field can be helpful when assigning content to devices.  The field in question is called Enrollment Type as you'll see below: How There is nothing special about access the item...you can do it in any query or smart group, but the following are the breakdown of the values for the field: Displaying information Number Description Enrollment via APK 0 Device was manually enrolled via installation of FileWave application Enrollment via EMM_API 1 Device was enrolled via the Android Management API (through NFC or a QRcode) OTA Enrollment 2 Device was enrolled over-the-air User Enrollment 3 Device was enrolled BYOD DEP Enrollment 4 Device was enrolled via Apple DEP Enrollment via fwcld 5 Device was enrolled via fwcld Enrolled 6 Enrollment of Chromebook User approved enrollment 7 Device was enrolled over-the-air and approved by user Presumed DEP Enrollment 9 Device is supervised iOS client that was enrolled before v14. "Presumed DEP" because there is no absolute concrete criteria to determine if it is DEP or Apple Configurator. Not available 8 Enrollment type is not determined Troubleshooting Apple ID prompt still appears even when Activation Lock Bypass Code is used during Remote Wipe Problem When a supervised iPhone or iPad is remotely wiped with Remove Activation Lock selected, activation should not require the user's Apple ID password. FileWave uses the stored Activation Lock bypass code from FileWave Central > Assistants > Activation Lock Management.... If the Apple ID prompt still appears, use the bypass code as the password instead of entering the user's Apple ID credentials. Environment Supervised iOS/iPadOS devices FileWave MDM Resolution At the Apple ID prompt after Remote Wipe, leave the Apple ID field blank and enter the device's Activation Lock bypass code in the password field. Find the code in FileWave Central > Assistants > Activation Lock Management.... Enter it exactly as shown, including capitalization and dashes. Keep the username (Apple ID) field empty.   Additional information Apple: Use Mobile Device Management and Find My Activation Lock FileWave iOS Kiosk (IPA) Location Tracking Problem We have been made aware of an issue with our FileWave Kiosk Enterprise IPA app with regard to location tracking.  Simply put, iOS no longer allows our application to be approved once, and then allowed to collect geo-location information for all time. Even when location tracking for the app is set to "Allow While Using", the application will re-prompt for permission on each application restart (usually multiple times). We are currently investigating what changes will be required to make the Kiosk IPA less intrusive to your customers and will update here as we have more information.  In the mean time, here are some mitigation suggestions: Don't deploy the Enterprise IPA at all: This may seem an odd suggestion, but this application was initially developed before the concept of "Lost Mode", and has largely outlived it's purpose "Lost Mode" is much more effective at location lookup, because it doesn't suffer from the same pre-requisites that the IPA does, and it works even if the end-user has location services turned off "Lost Mode" does not require the IPA Outside of geo-location in "Tracked" mode, the IPA serves no other purpose, and tracking in this mode is delicate to manage at best, and largely ineffective since the user can disable it at any time Apple, and other privacy advocates, are heavily leaning away from this type of location tracking, and before long it may not be possible at all If you don't want to change how you are deploying the IPA currently, consider setting your devices to "Untracked" The issue of user prompts is only seen if FileWave believes the device is in a "Tracked" state By moving devices to "Untracked" you'll avoid customer complaints while we work on a possible fix for this issue iOS 12+ Profile Installation Failed Description On attempting to enrol iOS 12 devices, we have seen some instances of the profile installation failing.  In these cases it has been related to the server certificate. As of iOS 11 and macOS High Sierra, Apple introduced stricter rules regarding MDM server to device communication: https://support.apple.com/en-gb/HT207828 However, it appears that these have not been fully implemented, until iOS 12, with respect to certificates.  Certificates of RSA key sizes below 2048 have still managed to work on iOS 11.  iOS 12 no longer allow this. Self-Signed Certificate As 3rd party suppliers have been supplying appropriate keys now for some time, this is likely to impact Self-Signed Certificates only. Directions The following command may be used to check the certificate RSA key size. macOS, Linux: openssl x509 -in /usr/local/filewave/certs/server.crt -text -noout | grep Public-Key Windows C:\OpenSSL-Win64\bin\openssl.exe x509 -in C:\ProgramData\FileWave\FWServer\certs\server.crt -text -noout | FINDSTR Public-Key Windows does not have openssl installed as standard so you will need to go to https://slproweb.com/products/Win32OpenSSL.html and download the appropriate version of OpenSSL for your environment. If the output is anything less than 2048, then the server certificate will need to be updated. If you are using a Self-Signed Cert, you will need to either: Re-use your process for generating the certificate to update to ensure it has a RSA key size of 2048 or larger Consider moving to an official 3rd party certificate Please take into consideration the following KB when moving to a new certificate: Root Trusted SSL Certificate (Using and Renewing) Customising iOS Wallpaper Customizing iOS Device Wallpaper with Dynamic Text What FileWave v14.10.0 introduced a new feature that allows customisation of wallpaper on iOS devices. This feature enables the additions of wallpaper text and with FileWave's parameters within Profiles, a single generic profile can be used to display Serial Number, Department and Assigned User, simplistically on all devices. When/Why Some suggestions of using text with wallpaper include: Personalizing the device for an organization, department or individual Identifying a device with its unique Serial Number, which can be helpful in tracking and asset management Providing additional information that may be useful for the end-user or technical support team Displaying room names for wall mounted tablets outside meetings rooms, lecture theatres and hospital surgeries. How To utilise this feature in FileWave v14.10.0: Log in to your FileWave console. Create a new iOS Profile. Select the Command Policy item from the left list of profile types. In the Command Policy, add the desired text, e.g. Department, Telephone Number into the 'Text overlay' box. Note this example demonstrates the use of a parameter to supply the device's Serial Number. Save the configuration and apply it to the chosen, targeted iOS devices. It's that simple! Now your iOS devices will have a customized wallpaper that displays the information configured. If the image's aspect ratio doesn't match the device's screen resolution, iOS or iPadOS will resize the image which may lead to portions of the image being cropped. Even where an images resolution matches the screen resolution in one orientation, when rotated between landscape and portrait, this can no longer be the case.  The consequence is a resize of the image, also leading to cropped edges. The Text is burnt into the image and as such, if not placed with consideration, could also become cropped.  Test the outcome of the image with text in both Portrait and Landscape.   Digging Deeper Extensive details of image sizes with text placement and its impact is highlighted in: Custom iOS Wallpaper Dynamic Text Tips Referencing parameters within all profiles (which can now be used to personalise the text on the wallpaper since FileWave v14.10.0) is also described in: Using parameters in iOS/macOS Profiles   Plan Dynamic Text for iOS and iPadOS Wallpapers What Use this guide to size, position, and test FileWave dynamic text on iPhone and iPad wallpapers without losing text when the device rotates or crops the image. When/Why FileWave provides three font sizes and nine text positions. The best choice depends on the device aspect ratio, wallpaper detail, text length, and expected orientation. The FileWave preview is portrait only. Test the finished wallpaper on representative devices in both portrait and landscape orientations. The Font used is GothicA1-Regular and the sizes refer to: SMALL MEDIUM BIG FONT SIZE 65 80 95 The source image must be smaller than 2 MB before FileWave can add dynamic text. How Start with the screen aspect ratios in your fleet. Prepare a source image for each ratio you need to support, then use inventory such as Product Name to target the matching device models. Apple MDM inventory does not report screen resolution directly. https://www.ios-resolution.com/ Alternatively, a tool like Mactracker lists details for all Apple device types. Smart Groups Since a Wallpaper Profile Command Policy will be required for each screen resolution, devices need to be targeted appropriately. Consider the following method: Obtain the Product Name for a device type to be managed (e.g. iPad6,11).  Cross reference this with something like Mactracker to obtain details. Create a New Smart Group Type: Inventory Query Criteria: Product Name > is > iPad6,11 Group Name: (Something obvious) It may be sensible to include the screen resolution as part of the group name, but not use the Product Name.  There is overlap with device types and resolution.  E.g. both 'iPad 6th Gen' and 'iPad mini 5th Gen' have a resolution of 2048x1536, so one group could be used to target both device types.  Example group name: iOS 2048x1536 Example of multiple device types for the Smart Group which all share the same resolution.  Note the 'one or more expressions must be true' and the 'Main Component': Copy the above process for each required resolution. Image Preparation Busy or high-contrast images can make text unreadable. Test the chosen text color against the darkest and lightest parts of the wallpaper, then adjust the image or color before deployment. Rotation can crop the sides or the top and bottom of the wallpaper. Keep dynamic text inside the safe area that remains visible in both orientations. For an accurate mock-up, install Gothic A1 Regular with Font Book before building the Keynote test file. The walkthrough below uses a 2048 × 1536 target to build a safe-area overlay and test text visibility before upload. Note this image is currently the wrong resolution.  Preview.app can be used to address this landscape image: Open the image in Preview Proportionally alter the height (which is currently too small) to match the height (y value in this example) of the device's screen resolution with the Adjust Size Tool.  The image is now oversized, but will more than fill the entire screen in one axis and match in the other. (In this example, the height should now be 1536 and the width greater than 2048) Zoom out so the entire image may be viewed Select All Move one of the sliders of the selection area, in this example left or right, until it reads 2048. The selection can then be moved to the desired area Copy this selection, open into a new Preview window and save. Add an outline: Alter the size of this new image, such that the smaller axis is set to match the larger.  In this case alter 1536 to 2048 There will now be an image that is 2732x2048.  Make a note of these values and undo. Open Keynote Select the Document button and alter the Document Slide Size to match this newly observed resolution: 2732x2048 From a blank slide, add a rectangle and remove the colour fill Add a border line to the rectangle, choosing an obvious colour (for example bright green) and 5pt width should suffice Alter the size of this rectangle, such that it matches the reverse dimensions of the device: 1536x2048 Centre the rectangle within the slide Copy the rectangle Alter the size of the new copied rectangle to match the resolution of the entire slide and centre: 2732x2048 Edit the Master Slide so that it has no background Export the slide as a PNG with transparent background Open the exported image into Preview Resize the image, matching the resolution back to the target resolution, in this case: 2048x1536 Select All from Preview and Copy Back in Keynote, create a new document and alter the slide size to the desired screen resolution: 2048x1536 Add the desired matching sized image to the slide, in this case the 2048x1536 FileWave building image Paste the copied green boxes from Preview over the top In Keynote there should now be an image, including the green inserted boxes, something like: Since the green lines forming the boxes have a transparent background, the image behind may be altered, simplifying the testing of differing images. Consider duplicating slides to test alternate images, in case the desire to revert is experienced! Test Text Keynote may now be used to test adding some text. Add a text box Set the Font as Gothic A1 Regular and a desired Font size, e.g. 80 Select a colour for the Font Add the chosen text, ensuring it does not cross over the lines when centred If the text does cross the lines, the smaller Font size of 65 could be chosen or reduce the amount of included characters. If using variables, confirm the longest value from FileWave and then test with that value as text in Keynote From Keynote, if the text is unclear, it is easier to adjust the text colour or even make adjustments with the image itself, to enhance the appearance of the text. Once happy, copy the line of text. Create Fileset Remove the text from the Keynote slide and save the slide as an image, using JPG (smaller size).  Remember, the image to be uploaded needs to be less than 2MB. Open up the Profile Editor in FileWave and search for Wallpaper, it should be located in the Command Policy.  As per the directions in the prior KB article, choose the image just saved as the Wallpaper and paste the desired text into the text box.  Clearly, alter the text to include any parameters if necessary.  Don't forget to set the Font colour. As per this example, the middle position is going to be chosen. Save the profile and consider including the screen resolution as part of the name: Test Associate the Profile to a test device and Update Model, observing the Command History.  The IntsallProfile command should appear and then disappear; this is not a permanent profile, but a one off command.  However, the Settings command will persist.  Further details in the following KB: Profile Editor Command Policy Turn the screen to confirm the look for both Portrait and Landscape. Portrait Landscape Additional Info First, it is worth observing how Apple alter an image when the device is rotated between Landscape and Portrait. Apple avoid having black bars around the image.  As such, to alter the image, as can be seen above, The smaller, un-matching aspect is resized to match the size of the device's resolution.  The impact of this is that the large matching aspect is now oversized and the overall effect is the image appears cropped. The green lines from the image above show the crop position that will be seen in portrait when the device is turned from landscape.  This has a consequence with the text.  If the text position were bottom right instead, for example, the green box shows the text that would be lost: Landscape Portrait Indeed, rotating the device into portrait shows the loss of text: With this in mind, best practice would be: Where devices may be rotated For a landscape image, only ever consider using Middle, Top Middle or Bottom Middle For a portrait image, only ever consider using Middle, Left Middle or Right Middle Where devices will not be rotated Any position could be chosen Apple do not provide an option to prevent rotation, however, in some circumstances devices will not be rotated, e.g. wall mounted outside meeting rooms, lecture theatres, hospitals, etc. Conclusion Why use the profile, since the above has just made an image of the correct size and Keynote could have just added the text? This is indeed a good question and the above is to assist with a guide on building out the image, ensuring that the text will display clearly and not be cropped on the image size.  Chances are once you have done this for one resolution, that you need not bother for others and will already be armed with a good approximate example.  However, the Profile still comes into its own! The Profile can use parameters from FileWave, customising the text per device, based either upon built-in inventory or Custom Fields.  This greatly exceeds the above method and is very much the beauty of this feature. App Security on iOS Description Experienced being in a meeting and needing to pass an iOS device to someone else, but with the knowledge that there is sensitive data in some Apps or some Apps that not should be accessed at all? To prevent temporary users of devices from accessing certain Apps, Apple introduced two new concepts: Hide and Lock. Allowance of Hiding Apps was introduced in iOS 18 Allowance of Locking Apps was introduced in iOS 18.1 Hiding an App prevents the App from being visible, whilst Locking an App disallows the opening of a Locked App without an additional layer of security, e.g.  Touch of Face ID.  Hidden Apps are available from a visible folder called 'Hidden' within the App Library.  Access to the Hidden folder and opening Locked Apps is by way of authentication. Further information may be viewed in Apple's KB: Lock or hide an app on iPhone FileWave 16 included management for this feature. Information App Configuration Each VPP App has two new options, one for Lock and one for Hide, allowing MDM to define Apps, on an individual basis, to be set as Locked or Locked and Hidden: Hideable is only an option where Lockable is enabled. As per Apple's above linked KB, not all Apps may be Locked or Hidden.  Please review their KB for a list of Apps which may not be set. Profile Configuration As an addition to the VPP App setting, it is possible to allow/deny users from selecting Apps themselves to be either Locked or Locked and Hidden, by way of additional Profile options, within the iOS Restrictions Payload.