What is an Apple MDM server?

If you’re looking into the world of device management, you might have heard of an Apple MDM server. In this blog, we’ll discuss:

• What an Apple MDM server is
• The features that Apple MDM servers need to perform the best
• How to set up an MDM server
• How using an Apple-first MDM is the key to success

Mobile Device Management (MDM)

MDM, or Mobile Device Management, is the way IT admins administer mobile devices like smartphones, laptops and tablets. Servers hosting an MDM can be on-premises or cloud-based. MDM software can:

• Keep an inventory of users and their associated devices
• Monitor a device’s health and security standing
• Deploy software and enforce app and operating system updates
• Administer policies that configure a device’s settings
• Do (much) more!

An Apple MDM server is simply third-party MDM software designed for Apple devices. Apple’s complements to a third-party MDM are Apple Business Manager (ABM) and Apple School Manager (ASM). With MDM and ABM/ASM, admins can:

• Configure iPhone, iPad and Mac devices without having to touch them
• Purchase a large quantity of devices and automatically enroll them into their MDM
• Create Managed Apple IDs unique to their organization
• Deploy apps purchased from the App Store

Key features of an Apple MDM server

Apple lists its recommendations for choosing an appropriate MDM server, summarized here:

• Vendor support access and policies: the support, services and training an MDM vendor provides
• Cloud or local hosting: whether the MDM vendor supports cloud or local hosting, based on your organization’s needs
• Device support: what devices the MDM supports, and if it specializes in the Apple operating systems
• Support for Apple web-based portals: enhanced MDM support for device enrollment and managed distribution, making it possible to have separate enrollment settings for different sets of devices, for example
• User account information: the user account types the MDM supports, like Calendar, Contacts, Extensible single sign-on, Google, LDAP, VPN, 802.1X and more
• MDM framework support: whether the MDM supports necessary profiles and configuration options, including declarative device management
• MDM commands: which MDM commands the MDM solution can relay to enrolled devices
• Query and reporting services: which device information queries the MDM solution can report on
• Education- or business-centric functionality: whether the MDM offers functionality catered to education or business environments, such as compatibility with Apple School Manager or Apple Business Manager or the ability to integrate with LDAP directory services

There are MDM platforms that tout compatibility with both Windows and Apple operating systems. In reality, this generally means the solution was built for one, while retrofitting itself for the other, often leaving gaps in support.

Choosing an MDM specifically designed for Apple provides the best management experience for your Apple devices. Apple-first MDM platforms give admins the power they need to get the most out of their management experience by offering the most MDM commands, framework support and support for Apple’s other features and services. Organizations can rest easy knowing that their Apple-first MDM vendor offers in-depth support for initial setup, configuration, troubleshooting and maintenance of their MDM software.

How to set up an MDM server

Once you’ve chosen your MDM provider, it’s time to set it up! While we won’t go into the nitty-gritty details of an MDM server setup, here’s a (very) simplified overview of the process to give you an idea of what this looks like:

1. Set up Apple Business Manager or Apple School Manager and establish your organization’s domain(s). (For more detailed information, read Apple’s ABM/ASM tutorial.)
2. Ensure you meet the prerequisites for setup; as of the date of this blog publication, they are:
   1. A Mac with macOS 14 or above
   2. An iPhone with iOS 17 or above
   3. A network all devices can connect to that also provides access to Apple authentication servers and Apple Push Notification service (APNs)
3. Link to your MDM in ABM or ASM by uploading your MDM public key certificate provided by your MDM.
4. Download your server token from ABM or ASM and upload it to your MDM.
5. Begin enrolling your devices!

There are multiple ways to enroll devices, depending on how you acquired them or who they are owned by:

• Automated device enrollment is used when an organization is purchasing devices for company use directly from Apple. These devices are eligible for zero-touch deployment — from Apple’s warehouses to the employee, fully configured, without IT having to touch the device.
• Device enrollment is used when an organization acquires Apple devices in a way other than through Apple or authorized Apple retailers. These devices are added manually by anyone with access to your enrollment portal or through Apple Configurator, and the profiles can be removed by the user (unlike with automated device enrollment).
• User enrollment is user-driven enrollment into your MDM on a user-owned device, such as in a Bring-Your-Own-Device (BYOD) program. This method requires a Managed Apple ID, which can be created using your MDM solution and ABM or ASM. Devices enrolled this way can remove the MDM profile as they wish; all apps and settings managed by the MDM are removed as well.

Jamf: Apple-first, Apple-best.

We know there are a number of Apple MDMs available. At Jamf, Apple is at the heart of what we do. We offer MDM solutions designed for Apple in a variety of industries with:

• Jamf Pro for businesses and organizations of various sizes and specialties
• Jamf School for schools
• Jamf Now for small- and medium-sized businesses

Using an Apple-first MDM like Jamf Pro, Jamf School or Jamf Now equips your organization with:

• A robust feature set to configure your device fleet as you need it
• Compatibility with Apple’s features and operating systems (OS) — including support for new Apple OSs the day they are released
• Knowledgable and experienced support technicians
• Best-in-class Apple device management capabilities