Account-Driven Enrollment for iOS/iPadOS BYOD Devices (v15.0+)

What

In 2021, Apple introduced Account-Driven User Enrollment, a new waymethod for initiating Bring Your Own Device (BYOD) enrollments. With the releases of initiating BYOD : Account Driven Enrollment. With iOS 1817 /and iPadOS 18,17, profile profile-based User Enrollment is deprecated, and starting with iOS 18 and iPadOS 18, it is no longer supportedsupported. ;To align with these changes, FileWave 15.5 now supports AccountAccount-Driven DrivenUser Enrollment (ADE)., enabling organizations to securely enroll BYOD devices using this new workflow.

When/Why

When to Use

• BYOD Environments: When employees use their personal iOS or iPadOS devices for work purposes and need access to corporate resources.
• Transitioning from Profile-Based Enrollment: As profile-based User Enrollment is being phased out, organizations should begin migrating to Account-Driven User Enrollment to ensure compatibility with future iOS and iPadOS versions.

Why This Feature Matters

Apple wantsaims to enhance the security and privacy of BYOD todeployments. beAccount-Driven asUser Enrollment offers several benefits:

• Improved Security: Separates personal and corporate data more effectively, protecting user privacy and corporate assets.
• Simplified Enrollment: Users can enroll their devices by signing in with their Managed Apple ID, streamlining the enrollment process.
• Modern Authentication: Utilizes OAuth 2.0 and OpenID Connect for authentication, providing a more secure asand possiblestandardized ;method.
• Organizational Control: Shifts the responsibility of secure enrollment to the organization, allowing for better compliance with ADE,internal thepolicies.
complexity

Account-Driven makeEnrollment it secure is nowrelies on the Organization shoulders. ADE relies on Well-known URI mechanism for Mobile Device Management (MDM) discovery, ensuring that devices can locate the MDM discovery.server securely and efficiently.

How

Enrolling a Device Using Account-Driven User Enrollment

ForTo iOS/enroll an iOS or iPadOS devices,device supportsusing new BYOD workflow based on Apple Account Account-Driven User Enrollment. with FileWave 15.5:

• On their iPhone or iPad, the user navigates to Settings > General > VPN & Device Management and then selects thetaps Sign In to Work or School Account button.Account.

The email entered will beis used by the device to discover the MDM server. IfFor example, if you enter “pn@widget.ch"ch”, the device will queryqueries the widget.ch domain, more specifically at https://widget.ch/.well-known/com.apple.remotemanagement.

This endpoint must return a specific jsonJSON message which containscontaining all the information required to proceed towith MDM BYOD enrollment. This means thatTherefore, organizations must have acontrol way to controlover this url,URL, which could be anyan issue for thethose oneswho completely outsourcingoutsource their website management (see below for potential workarounds).

FileWave Setup

ExistingThe existing User Enrollment option in FileWave now enables both legacy BYOD and the new ADE:Account-Driven Enrollment (ADE):

FileWave can’tcannot manage your domain,domain but provides some helpers:helpful options:

1. Retrieving the Well-knownKnown contentContent (json)JSON):

   can
   be
   • retrieved, so if

     If you wantprefer to host the required file yourself, you can easily getobtain the content.
     Ifnecessary youJSON presscontent from FileWave.

   • Click the “Well-known content” button,button in the FileWave interface. The following jsonJSON will be copied intoto your clipboardclipboard:

     :

     {"Servers": [{"Version": "mdm-byod", "BaseURL": "https://pn.filewave.widget.ch:20445/ios/byod/enroll/"}]} ; you can then create the file which will be served by your web server.
     

   • Another option is to setupCreate a redirectionfile containing this JSON and serve it from your web server at the appropriate URL (https://domain/yourdomain/.well-known/com.apple.remotemanagement).

2. Setting Up a Redirection to the FileWave Server Endpoint:

   • Alternatively, you can configure your web server to redirect requests from https://yourdomain/.well-known/com.apple.remotemanagement to the FileWave server endpointendpoint.

     ;

   • Retrieve the endpoint can be retrievedURL by clicking the.the “Well-known URLURL” button :in FileWave. For example, the endpoint might be:
     

     https://pn.filewave.widget.ch:20445/ios/byod/well-known/ for instance.
     

RewriteRule ^/.well-known/com.apple.remotemanagement https://pn.filewave.widget.ch:20445/ios/byod/well-known/ [R=301,L]

Related Content

• Apple: User Enrollment and MDM
• Well-known URI

Digging Deeper

Device Enrollment Process Workflow

Navigate to Settings, General
Navigate to VPN & Device Management
Tap Sign In to Work or School Account…
Enter your Managed Apple Account, press Continue.
Device The device will now showdisplay the usualstandard authentication page,page if configured ;configured; IDP login is supportedalso as well.supported. Enter your credentials and presstap Sign In.In.
After a few seconds, the device will askprompt useryou to Signsign in to iCloud. PressTap the button and enter your Managed Apple AccountID password.
And then, press Allow Remote Management to start enrollment.
After enrollment, device may prompt to restore iCloud data.

And nowNow the device is ready. As a final stepstep, we justyou need to add the device to FileWave. It will show upappear in the “New Mobile ClientClient” dialogdialog, (or it will be automatically added to the model if Auto-Enrollment is set).enabled.