DEP-2025: Apple Deployment and Management ExamDemo

Apple Declarative Device Management includes activations as a declaration type. Activations group configurations that are applied atomically and can use predicates to determine whether those configurations apply.

Automated Device Enrollment enforces the required operating system version before Setup Assistant can continue. A device below that version is guided through the required software update or upgrade and then resumes Setup Assistant, ensuring it meets the organization’s version requirement before production use.

With Content Caching > Share Internet connection enabled, devices physically connected to the Mac request update content through that Mac, and the content is cached locally on the host Mac.

Use an MDM restriction to stop users from enabling content caching on every managed Mac. Content caching should be enabled only on planned cache hosts; unmanaged caches can download and store Apple-distributed software and users’ iCloud data, creating uncontrolled caching traffic. Apple documents this restriction specifically to prevent a user from turning on content caching.

Apple Business Manager requires a device to be assigned to a device-management service for Setup Assistant to display the MDM enrollment pane. Default device assignments are configured separately for each device type; therefore, a Mac default assignment can exist while iPhones have no default MDM server assignment.

System+User mode authenticates the Mac before login using system credentials, then allows the signed-in user to join and authenticate to the same Wi‑Fi network with user credentials. This mode is appropriate for unbound Macs that require both pre-login network access and post-login user authentication.

When no local-account creation option is available in Setup Assistant, no account is created there. A managed administrator account is also required, and the user signs in with a network account or with another account created outside of Setup Assistant.

Managed Lost Mode locks the current user out of a supervised iPhone, and the device remains locked until an administrator turns off Managed Lost Mode.

Apple’s account-driven User Enrollment creates separate encryption keys to cryptographically separate selected managed data from personal data. The separated content includes notes in the Notes app.

MDM can restrict beta software updates on managed supervised Apple devices, including preventing users from manually enrolling in beta programs. This controls access to beta operating-system releases.

A content token links the MDM service with Apple School Manager or Apple Business Manager for Apps and Books managed distribution, allowing the MDM to assign App Store content to devices or users. Apple identifies the content token as the token required for an MDM solution to communicate and distribute content.

An MDM service can assume management of an app that is already installed by the user. On supervised Apple devices, that unmanaged-to-managed app conversion occurs without user interaction.

An Apps and Books content token is required for license communication between Apple Business/School Manager and an external MDM service. Content tokens expire annually; when one is invalid, app and book license communication stops, so newly purchased apps do not appear for assignment.

Apple Configurator for Mac integrates with the Shortcuts app to create device-configuration workflows and automate them when devices are attached or detached.

The Wi‑Fi payload contains QoSMarkingPolicy, which associates a Wi‑Fi network with Cisco QoS Fast Lane and provides an allow list of application bundle identifiers for L2/L3 QoS marking. Adding the video-conferencing app’s bundle identifier to that policy prioritizes its traffic.

Apple Configurator for Mac can prepare iPads and enroll them with a device management service (MDM), enabling organizational management during deployment.

Return to Service securely erases the device and automates its reenrollment and configuration so that it proceeds automatically to the Home Screen, ready for the next user.

Automated Device Enrollment occurs in Setup Assistant and is intended for new or erased devices. Reassigning a device to another MDM service does not affect its current enrollment, so erasing the device is required before it can enroll through Automated Device Enrollment.

Return to Service can include the Wi-Fi configuration/profile needed for the device to connect to a network after it is erased, activate, and enroll in device management.

Single sign-on (SSO) extensions let identity providers implement modern authentication protocols for users on iOS, iPadOS, and macOS. Apple identifies SAML 2.0, OAuth 2.0, and OpenID Connect as examples of these protocols.

The Return to Service settings of the EraseDevice command can include MDMProfileData, which supplies the MDM enrollment profile to install after erasure, and WiFiProfileData, which supplies a Wi-Fi profile for network connectivity and reenrollment.

Managed Device Attestation validates hardware-backed evidence of a device’s security and boot properties, so a compromised device cannot reliably falsify those properties to management systems. Microsoft documents that TPM-protected attestation data can be trusted even when a device is compromised and that critical properties cannot be spoofed, including in the presence of kernel-level malware or a rootkit.

An MDM solution retains the Activation Lock bypass code generated by the device and can use it to clear Activation Lock. Apple Business Manager and Apple School Manager can manage Activation Lock status, but the stored bypass code resides in the device management service.

Unlisted apps are released on the App Store but do not appear in categories, recommendations, charts, search results, or other listings. They are discoverable only through a direct link.