Apple devices

This page covers the three things you set up to manage Apple devices with Outpost mobile device management: an Apple push certificate, an optional link to Apple Business Manager, and the enrollment itself. When you finish, iPhone, iPad, Mac, and Apple TV devices for a client can enroll and receive settings from your profiles.

Before you begin

• The mdm:manage permission to manage Apple credentials, and mdm:enroll to create enrollment links. See Roles and permissions.
• The Apple provider must be available for your account. Providers become available as Outpost enables them.
• A Managed Apple Account for the organization, to sign in to the Apple Push Certificates Portal. Use an account the organization keeps, not a technician’s personal Apple Account, because you renew the certificate with the same account every year.
• For Automated Device Enrollment and Apps and Books, an Apple Business Manager account for the organization.

Danger

Every Apple device enrolled for a client is tied to that client’s push certificate. If you replace it with a certificate for a different push topic, every device must enroll again. Renew the existing certificate in Apple’s portal. Do not create a new one.

Choose where the push certificate comes from

Each client has its own Apple push certificate by default. Two alternatives exist, depending on how you use Outpost:

You are	Options
An MSP	A certificate per client, or an MSP-wide fallback certificate that clients without their own use.
An organization managing its own devices	A certificate you upload, or a certificate Outpost generates for you.

Changing from one source to another can change the push topic, which means every enrolled device must enroll again. Outpost asks you to confirm this before it makes the change.

An Outpost-generated certificate is issued by Outpost after a manual step, so it is not available immediately.

Create the push certificate

1. Generate a certificate signing request for the client in the console. Outpost signs it with its Apple MDM vendor certificate. Your Outpost never holds that vendor certificate.
2. Sign in to the Apple Push Certificates Portal with the organization’s Managed Apple Account.
3. Upload the signed request and download the certificate Apple issues.
4. Upload the certificate to the client in the console.

Outpost warns you 60, 30, and 7 days before the certificate expires.

Renew the push certificate

1. In the Apple Push Certificates Portal, select Renew on the existing certificate, signed in with the same Managed Apple Account.
2. Upload the renewed certificate to the client in the console.

If the uploaded certificate is for a different push topic, Outpost refuses it with “This certificate is for a different Apple push topic. Renew the existing certificate in Apple’s portal instead of creating a new one, or every device must enroll again.”

Link Apple Business Manager

Linking Apple Business Manager lets devices the organization buys enroll automatically at setup, and lets you assign Apps and Books licenses.

1. In Apple Business Manager, add an MDM server for Outpost and download its server token.
2. Add the token to the client in the console. Outpost syncs the devices assigned to that server every hour.
3. Create an Automated Device Enrollment profile and assign devices to it. Each token has one default profile, which devices assigned to the server receive unless you assign another.
4. To deploy apps, add the client’s Apps and Books content token. See Deploy apps to mobile devices.

When Apple Business Manager has new terms and conditions that nobody has accepted, syncing stops. Outpost raises an alert so an administrator can sign in and accept them.

Enroll devices

Choose the method that matches the device and who owns it. See Enrollment methods for the full comparison.

• Automated Device Enrollment (corporate, supervised). A device assigned to Outpost in Apple Business Manager enrolls during Setup Assistant. You can require the user to sign in through the client’s identity provider first.
• Account-driven User Enrollment (personal devices). The user signs in with their work account in Settings on the device. This needs a file published at https://<your-domain>/.well-known/com.apple.remotemanagement on the organization’s email domain. Outpost provides the file contents.
• Account-driven device enrollment (corporate). The same sign-in flow, enrolling the whole device.
• Manual profile installation (corporate). The user opens an enrollment link or scans its QR code, and installs the enrollment profile.

Verify

The device appears as one device record for the client, with its enrollment type, ownership, and last check-in time. Request a sync on the device. The sync completes when the device checks in after the request.

Next steps

• Deploy apps to mobile devices
• Profiles and policies
• What IT can see on enrolled devices