Relution Signet Customer Hub

Supervising retroactively

An unsupervised iOS device can retroactively be enrolled via Automated Device Enrollment (ADE, DEP in the portal) without users losing their data and content. According to Apple documentation, restoring a backup on the same device restores the device management status from the backup — an unsupervised device cannot be converted into a supervised ADE state directly from its own backup. The following workaround therefore routes the backup through a second, temporary device: the restore then counts as a restore to a different device, so Apple takes the device management status from Apple School Manager or Apple Business Manager instead.

Apple describes this behavior as follows:

  • Restoring from a backup to the same iPhone or iPad restores device management status from the backup.
  • Restoring from a backup to a different iPhone or iPad obtains device management status from Apple School / Business Manager.

Example

If a device is configured to be supervised and automatically enrolled in MDM, but is restored from a backup created when that same device was unsupervised, the device becomes unsupervised. An unsupervised device cannot be directly restored from its own backup if the device is to be supervised and enrolled via ADE — which is why routing through a second device is required.

Preparing the DEP Recovery Profile

A dedicated, temporary DEP profile is created in Relution for this workaround with the following settings:

  • Allow pairing with Macs or PCs and allow Apple Configurator to configure the device is enabled. This option is only needed for a local backup via a Mac or PC and cannot be changed later for an enrolled device without resetting it.
  • Location Services is not skipped.
  • Restoring from backup is not skipped.
  • Apple Account is not skipped.

These three setup steps remain cleared under Skip the following steps.

For devices running iOS/iPadOS 26 or later, the DEP profile also offers the option Do not use profile from backup. If it is enabled, the device does not use the profile from the backup when it restores a backup. More details in Profile for ADE →

More on configuring a DEP profile in Relution: Profile for ADE →

Workflow

Device-01 and Device-02 must run the identical operating system version. In addition, Find My iPhone must be disabled on both devices, since an active device search can prevent a backup from being created or restored.

1. Backup

A backup of the unsupervised Device-01 is created via iCloud or locally on a Mac or PC. This backup is restored onto a second device, Device-02. A new backup of Device-02 is then created via iCloud or locally — this second backup will later be restored onto Device-01 and will be treated as a backup from “another device”.

2. Preparation

Device-01 is reset to factory settings and added to Apple School / Business Manager using Apple Configurator 2. More details in Add to ADE retroactively →.

3. Integration in Relution

Device-01 is assigned to the corresponding Relution server in Apple School / Business Manager. As soon as the device appears in Relution under Devices → Auto Enrollments, it is selected there and receives the prepared DEP recovery profile via Set profile.

Alternatively, the DEP recovery profile is temporarily marked with Use as default profile before the assignment in Apple School / Business Manager. The default profile is automatically assigned to new auto enrollments — during this period, this includes every other newly added device.

The device is then set up by following the Setup Assistant on the device.

4. Restore Backup

On Device-01, Restore Apps & Data is selected in the Setup Assistant, followed by the backup created from Device-02. For iCloud backups, the restore must use the same Apple ID that was used to create the backup.

Because the backup originates from Device-02, the restore counts as a restore on a different device: management settings are not taken from the backup, but from the DEP profile configured in Relution — making Device-01 supervised and enrolled via ADE.

After a successful restore, Device-01 receives the regular DEP profile again under Devices → Auto Enrollments via Set profile; if the DEP recovery profile was marked as the default profile, the original profile is set as the default profile again. If the regular profile skips the setup step Restoring from backup, the Setup Assistant no longer offers the restore during a future setup.