Week 1: Whose iPad is this?

What MDM is, and why it matters to you

Mobile device management (MDM) is a server the company uses to send settings, apps and commands to Apple devices. A device joins it by installing an enrollment profile (the MDM profile). Other configuration profiles carry the settings: Wi-Fi, VPN, mail, certificates, restrictions. When a setting is dimmed and says it was configured by a profile, only the MDM admin can change it. So before you troubleshoot, find out who controls the device.

Exam tip A configuration profile alone does not mean MDM. Someone can install a Wi-Fi profile by hand. The enrollment (MDM) profile is what makes a device managed.

Where to look on iPhone and iPad

Open Settings > General > VPN & Device Management. A managed device lists its MDM profile under Device Management. Tap it to see what the organization installed: apps, restrictions, certificates, More Details. A supervised device also shows a line at the top of Settings, such as "This iPad is supervised and managed by Kibble & Co."

Settings > General
  > VPN & Device Management
DEVICE MANAGEMENT
  Kibble & Co. MDM     >
    Restrictions
    Apps
    More Details

Exam tip No profile under VPN & Device Management and no supervision line = not managed. Then you, not the MDM admin, can change its settings.

Where to look on a Mac

Choose Apple menu > System Settings > General > Device Management (macOS Ventura and later, including Tahoe 26). Double-click a profile for its settings. System Information > Software > Profiles shows the same list. In Terminal, profiles status -type enrollment answers in two lines whether the Mac is enrolled and how.

% profiles status -type enrollment
Enrolled via DEP: Yes
MDM enrollment: Yes (User Approved)

Sam: I run profiles status on every Mac that comes back from a repair. Takes two seconds.

Exam tip "DEP" is the old name for Automated Device Enrollment. "Yes" there means Apple Business assigned the Mac to the company's MDM.

Settings, restrictions, apps and commands

MDM can push payloads (Wi-Fi, VPN, email, certificates, passcode rules), set restrictions (no camera, no AirDrop, no App Store), install and remove managed apps, manage software updates, and send commands such as lock or erase. A restricted feature can vanish: when the camera is not allowed, the Camera app disappears from the Home Screen.

• Tap the profile > Restrictions to read what is blocked
• Dimmed settings with a profile message are locked by MDM
• MDM cannot turn on camera or microphone access for an app; the user grants that

Supervision unlocks more control

A supervised device is one the organization owns, usually set up through Automated Device Enrollment (ADE). Supervision allows extra restrictions and features: block AirDrop or the App Store, install apps silently, filter web content, manage updates without the user, and keep the user from removing management. An unsupervised device gets fewer restrictions.

Exam tip Exam pattern: "which restriction needs supervision?" Think of anything that takes control away from the owner, like blocking AirDrop or the App Store.

What MDM cannot see

MDM is not spyware. It cannot read personal email, messages, photos or browsing history. On a company-owned device it can see things like the device name, serial number, OS version, installed apps and storage. On a personal device enrolled with User Enrollment it sees even less: no personal apps, no device serial number, and it can only remove the work data, not erase the whole device.

Rosa: So it can't see my cat photos?

Priya: Not a whisker. It manages the work side only.

Automated Device Enrollment

Devices bought from Apple or a participating reseller can be added to Apple Business (formerly Apple Business Manager) or Apple School Manager and assigned to the company's MDM server. When one is turned on and reaches the internet, Setup Assistant learns it belongs to Kibble & Co. and shows a Remote Management screen. The device enrolls during setup, and comes out supervised.

Exam tip The Remote Management screen cannot be skipped for an ADE device. A personal device that shows it is still assigned to someone's organization.

Skipping and adding Setup Assistant panes

The MDM's enrollment settings choose which Setup Assistant panes users see. Skipped panes (for example Siri, Screen Time, Apple Pay, Location Services or Terms) are set to the more privacy-preserving choice. MDM can also ask users to sign in with work credentials before enrolling, and on Mac it can control how the first local account is created.

• Skipped pane = setting left at its private default; user may change it later unless restricted
• Await configuration: the device waits in Setup Assistant until MDM finishes sending settings
• Make enrollment non-removable so users can't delete the MDM profile
• Enforce a minimum OS version: the device must update before enrolling (iOS 17 / macOS 14 and later)

Why setup looks different on company devices

This is why a new shop iPad never asks about Siri, and a driver's iPhone goes straight to the Home Screen after an erase (Return to Service, for supervised devices). If a user reports a "missing" setup screen, it's usually an MDM choice, not a bug. Devices added to Apple Business by hand with Apple Configurator get a 30-day provisional period in which the user can still remove management.

Sam: If a setup pane is missing, ask me before you open a ticket with Apple.