Account-Driven Enrollment

This article explains how to configure Account-Driven Enrollment in SimpleMDM and how to enroll devices using this method. Please note that this enrollment method will require changes to your own web server.

Create the Enrollment

1. In SimpleMDM, click 'Devices > Enrollments' on the left side of the screen.
2. Click "Add Enrollment".
3. Select "Group Enrollment".
4. Give the enrollment a name and select the "Initial device group" that you want devices to be assigned to when they enroll.
   • If you would like devices to be enrolled using User Enrollment (BYOD), set "User Enrollment" to "Yes".
   • Otherwise, if you prefer devices to be enrolled as a regular device enrollment, leave this set to "No".
   • Refer to the 3. Choosing An Enrollment Method article for more information about the differences between User Enrollment and regular Device Enrollment.
5. Check the box labeled "Account-driven enrollment".
6. In the "Managed Apple ID domain" field, enter the domain used for Managed Apple IDs in your organization Apple Business Manager or Apple School Manager account.
7. Click "Save".

Configuring the Well-Known Endpoint on Your Web Server

For Account-Driven Enrollment to function, Apple requires a service discovery endpoint to be configured on your domain. The exact steps to configure this may vary depending on your server.

Once you have created the Enrollment, the SimpleMDM admin interface will display embedded instructions for:

• Nginx
• Apache
• Cloudflare
• Other

Click the server type and follow the instructions listed.

Notes on server configuration:

• If your Managed Apple ID looks like user@example.com, the service discovery endpoint should be https://example.com/.well-known/com.apple.remotemanagement
• The specific URL to redirect the well-known endpoint will be displayed in the instructions within your account. It will follow a format like: https://a.simplemdm.com/device/enrollment/well_known/XXXXXX-0000-0000-0000-123456abcdef
• The file should be in JSON format with content-type set to application/json.
• HTTPS is required.
• This configuration must remain on your server for the enrollment to continue to function.
• The enrollment will not work until the configuration has been verified.

Verifying the Server Configuration

Once you have completed the process above, click "Verify Configuration". SimpleMDM will send a test request to this endpoint to verify it is configured correctly.

If successful, the SimpleMDM admin interface will show "Success: This enrollment has been verified. The well-known JSON has been configured correctly."

Alternatively, if it is not configured correctly, you will receive an error message.

Enrolling a Device Using Account-Driven Enrollment

After your server configuration has been verified, you are ready to start enrolling devices. To enroll a device using Account-Driven Enrollment:

1. Open the "Settings" app on your device.
2. Navigate to 'General > VPN & Device Management'.
3. Select "Sign In to Work or School Account".
4. When prompted, enter your Managed Apple ID.
5. You will be prompted with a "Sign In to iCloud" screen – enter your Managed Apple ID password and select "Continue".
6. The next screen will display a "Remote Management" prompt – select "Allow Remote Management" and the enrollment will be complete.

Additional Information

You can optionally enable enrollment authentication and a welcome screen for this enrollment.