Relution Signet Customer Hub

Manual enrollment

Enrollment is performed by manually downloading and installing an MDM profile on the iOS devices. This requires either scanning a QR code on the devices or manually accessing the corresponding URL. Subsequently, the MDM profile is installed on the devices.

Advantages

  • Enrollment can be performed without having to reset the devices to factory settings.
  • No Apple Business Manager or Apple School Manager and no Automated Device Enrollment (ADE, DEP in the portal) required; only the APNs certificate has to be stored in Relution.

Disadvantages

  • Enrollment can be removed at any time in the settings on the devices (MDM profile).
  • Only partially suitable for BYOD devices, as administrators can see which apps are installed.
  • Not all actions and policy configurations are possible.
  • Devices are often not supervised (supervised mode).

Create the enrollment in Relution

An APNs certificate stored in Relution is required (APNS Push Certificates →), set up under Settings → Organization Certificates. Without it, the platforms iOS, macOS and tvOS are greyed out and cannot be selected.

To perform a manual enrollment, it must first be created in Relution. To do this, Devices → Enrollments is opened in the menu and Add is clicked.

Enrollments depend on the operating system. For iPhone and iPad, iOS is selected as Platform. Device enrollment is selected as Type via the smartphone icon (tooltip iOS); the person icon (tooltip User Enrollment) stands for User Enrollment →. Ownership (BYOD or COD) is mandatory. Macs are covered by the macOS article Manual enrollment →, Apple TVs by the section Apple TV →.

Optionally, a user can be linked to the device to be enrolled via Select user in the Assignment section. Also optionally, a Device name and a Device description can be specified in the Device section for display in the device inventory; without a device name, Relution generates the name automatically. If custom device properties are enabled, their values can be specified in the Custom device properties section when creating the enrollment.

The Configuration section offers the following options:

  • Claim the device’s serial number to your lifetime license after successful enrollment: Only visible if the organization has a lifetime license. After successful enrollment, the device’s serial number is claimed for the lifetime license. This cannot be undone.
  • Static device groups: The enrolled device is automatically added to these groups and receives the policies and apps assigned to them.
  • Agreements: Selection of agreements whose texts Relution provides to the device during enrollment.

Each enrollment can only be used once, unless the Multi-use enrollment switch in the Expiration section of the Enrollment options is enabled. If this is the case, new devices can be enrolled via the enrollment link until either the date under Valid until has been exceeded or no more device licenses are available in Relution. Valid until defines how long the enrollment can be used (default: seven days after creation, until the end of the day). Multi-use enrollment cannot be changed after the enrollment has been created.

If enrollment notifications by email or SMS are enabled under Settings → Notifications, the enrollment link can be sent directly to the assigned user or to a phone number in the Notification section.

After saving, the list of enrollments is displayed. The QR code can be opened via the icon in the QR Code column. Alternatively, the opened enrollment shows the Enrollment code, the Link and the QR Code under Enrollment information. The QR code is scanned with the iOS device, or the link is entered manually in the device’s browser. The MDM profile is downloaded via the Enrollment button and then installed on the device under Settings → General → VPN & Device Management (see steps below).

Step by step instructions

  1. The enrollment is started by tapping Enrollment.
  2. The download of the MDM profile is confirmed with Allow.
  3. The next window is closed with Close.
  4. On the device, Settings → General → VPN & Device Management is opened. The entry is located at the very bottom of the General section.
  5. The downloaded MDM profile is selected.
  6. After checking the MDM profile, Install is tapped and the dialog is confirmed again with Install.
  7. A security message is displayed, which is also confirmed with Install.
  8. Remote management is accepted with Trust.
  9. Tapping Done completes the installation of the MDM profile.

This completes the enrollment.
A new entry should now appear in the device inventory of the Relution portal. Relution then automatically sends an installation command for the Relution Agent from the App Store to the device, provided the agent is not yet installed there. If Apps and Books (VPP in the portal) licenses are available for the Relution Agent, Relution assigns a license to the device. Without a license, the installation takes place via the App Store, which requires an Apple Account to be signed in on the device. If the agent is missing later, Relution triggers the installation again with the next device information update.

Apple TV

Apple TVs can also be enrolled manually. To do so, an enrollment with the platform tvOS is created under Devices → Enrollments; there is no Type selection for tvOS. This platform is also only available if an APNs certificate is stored. Since Apple TVs have no web browser, the MDM profile is downloaded via the enrollment link on a Mac and installed on the Apple TV using Apple Configurator 2.

Overview of enrollments →