iPhone Enrollment Profiles: A Complete Guide for MDM

An iPhone enrollment profile, often called the MDM profile, is the configuration profile that connects an iPhone or iPad to a mobile device management (MDM) server. Once it is installed, the MDM can send the device settings, apps and commands. You can see it on the phone in Settings > General > VPN & Device Management, where Apple calls it a management profile and shows the organization's name. A profile gets onto a device in one of three ways: automatically during setup through Automated Device Enrollment in Apple Business (formerly Apple Business Manager), by downloading and installing it on a company device, or by signing in with a Managed Apple Account through account-driven User Enrollment on a personal device. How it got there decides how much the organization can manage and whether the user can remove it.

If you are setting up MDM for company iPhones, or you found a profile on your own phone and want to know what it does, the table of enrollment types and the check-and-remove section below answer it.

What Is an iPhone Enrollment Profile?

An enrollment profile is a small signed file (a .mobileconfig configuration profile) that contains an MDM payload: the address of the MDM server, a certificate the device uses to identify itself, and the access rights the server will have. When the profile is installed, the device checks in with the server and is enrolled. From then on, the MDM can install apps, apply settings such as passcode rules, Wi-Fi and restrictions, and send commands such as lock or erase, within the limits Apple sets for that type of enrollment.

Other configuration profiles, for Wi-Fi, email or VPN for example, can be installed on any iPhone. The MDM profile is the one that gives an organization ongoing management of the device, so it is the one to look for when you want to know whether a phone is managed.

Why iPhone Enrollment Profiles Are Important for MDMs

• They make management possible. Without an enrollment profile, there is no MDM connection and nothing for the organization to manage.
• They decide what IT can do. A device enrolled through Automated Device Enrollment is supervised, which allows restrictions and settings that unsupervised devices ignore. A personal device enrolled with User Enrollment gives the organization much less.
• They decide whether management can be removed. A profile installed during automated setup can be locked so the user cannot remove it; a profile installed by hand can usually be removed by the user.
• They keep setup consistent. Every device that enrolls the same way gets the same settings and apps, without IT configuring each one.

The Three Ways an Enrollment Profile Reaches an iPhone

Apple also offers account-driven Device Enrollment for company devices that sign in with a Managed Apple Account, and it has deprecated the older profile-based User Enrollment in favor of the account-driven method. For the personal-device side in detail, see account-driven user enrollment.

How to Set Up an iPhone Enrollment Profile for MDM

The steps below cover a company rollout. Menu names differ slightly between MDMs.

Step 1: Prepare Your MDM Server

Create the Apple Push Notification service (APNs) certificate in your MDM; Apple uses it to wake devices so they check in. It must be renewed every year with the same Apple Account, or every enrolled device stops receiving commands. If you will use Automated Device Enrollment, connect your MDM to Apple Business with a server token; see how to add MDM to Apple Business Manager. For App Store apps, upload a content token too; see Apple VPP token.

Step 2: Create the Enrollment Profile

In the MDM, create the enrollment settings for each group of devices: which organization name users see, whether the profile can be removed, which Setup Assistant screens to skip, and which settings and apps the device gets once it enrolls. For Automated Device Enrollment, the MDM builds this profile and sends it to Apple; for a profile download, it creates the link or page users will open.

Step 3: Choose Enrollment Methods

Use Automated Device Enrollment for every company iPhone you can, because it is the only method that supervises the device without wiping it by hand and that can keep the profile from being removed. Devices bought from Apple or an authorized reseller with your organization ID appear in Apple Business on their own; assign them to your MDM server there, or set your MDM as the default for iPhone and iPad. Use a profile download for company devices that cannot be added to Apple Business, and account-driven User Enrollment for personal phones.

Step 4: Install the Profile on the iPhone

• Automated Device Enrollment: turn on the new or erased iPhone and go through Setup Assistant. On the Remote Management screen the device shows your organization and enrolls when the user continues.
• Profile download: open the enrollment link in Safari on the iPhone and allow the download. Then open Settings, tap Profile Downloaded (or go to General > VPN & Device Management), tap the profile and choose Install. A downloaded profile that is not installed within about eight minutes is deleted, and the user has to download it again.
• Account-driven User Enrollment: go to Settings > General > VPN & Device Management, choose Sign In to Work or School Account, and sign in with the Managed Apple Account.

Step 5: Verify the Enrollment

On the iPhone, Settings > General > VPN & Device Management should show the management profile with your organization's name. In the MDM, the device should appear with its enrollment type, and supervised devices should show as supervised. Send a harmless command, such as a request for device details, to confirm the connection works.

How to Check or Remove an MDM Profile on an iPhone

To check whether an iPhone is managed, open Settings > General > VPN & Device Management. If you see a management profile (shown as Mobile Device Management or with an organization's name), the device is enrolled in that organization's MDM. Tap it to see what the organization can manage. On a supervised iPhone, the top of Settings also notes that the device is supervised and managed by the organization.

To remove it, tap the management profile and choose Remove Management, then enter the device passcode. Removing it also removes the apps, accounts and settings the MDM installed. On a company iPhone enrolled through Automated Device Enrollment, the remove option may be missing because the organization locked the profile; ask IT, and do not try to work around it, because a wiped company device will enroll again during setup. On a personal phone enrolled with User Enrollment, removing management deletes only the work apps and data.

Troubleshooting Enrollment Profile Problems

"Did not receive an enrollment profile from your MDM server"

This usually appears during Setup Assistant on a device that is in Apple Business but did not get its enrollment settings. Check that the device's serial number is assigned to the right MDM server in Apple Business, that your MDM has synced with Apple since the assignment, that the MDM has an enrollment profile assigned to that device, and that the server token has not expired. Then erase the device and start setup again.

The profile will not install

Make sure the link was opened in Safari, the profile was installed within a few minutes of the download, the date and time on the phone are correct, and the device is not already enrolled in another MDM: an iPhone can be enrolled in only one at a time.

The device enrolled but settings do not apply

Many restrictions apply only to supervised devices. If the device was enrolled with a profile download, it is not supervised, and those settings are ignored. Check the enrollment type in the MDM before you change the policy.

Managing iPhones After Enrollment

Once enrolled, an iPhone is managed through the MDM for the rest of its life with the organization. Typical tasks include installing and updating apps licensed through Apps and Books, enforcing a passcode, pushing Wi-Fi and email settings, applying restrictions on supervised devices, scheduling iOS updates, and acting when a device is lost: remote lock on iPhone or remote wipe. When a company iPhone is retired or reassigned, erase it and release or reassign it in Apple Business, so the next setup enrolls it correctly.

Best Practices for iPhone Enrollment in MDM

• Buy company iPhones through Apple or an authorized reseller with your Apple Business organization ID, so they appear for automated enrollment.
• Set a default MDM server for iPhone and iPad in Apple Business, so new devices are assigned without anyone remembering to do it.
• Make the profile non-removable on company devices, and say so in your device policy.
• Use account-driven User Enrollment for personal phones, so the company manages only work data. See MDM vs MAM if you only need to protect work apps.
• Put the APNs certificate and Apple Business token renewal dates in a shared calendar, and renew them with an account IT keeps.
• Test each enrollment method on one device before a large rollout.

Managing this across many devices

trio.so enrolls company iPhones and iPads automatically through Apple Business, supervised, or with a profile installed on the device when it is not in Apple Business. Personal iPhones and iPads enroll with account-driven User Enrollment, so the company manages work data only. See Apple device management.

Conclusion

The enrollment profile is what makes an iPhone manageable, and the way it is installed decides how much the organization can do. Use Automated Device Enrollment through Apple Business for company devices, a profile download only where that is not possible, and account-driven User Enrollment for personal phones. Check the profile in VPN & Device Management, and keep the certificates and tokens behind it renewed.