Customer HubSupervised Mode / Supervision
Supervised Mode, also called Supervision, is a deployment strategy introduced by Apple for organizations to manage iOS, macOS and tvOS devices. Since its introduction with iOS 5, Supervision has been available to organizations as an effective method for managing Apple devices. Supervision means that an organization owns and has complete control over the devices. End users can access and use supervised devices, but the organization has full administrative control. Thus, the owner can decide which features may be used on the devices by enforcing advanced restrictions or adjusting device settings via MDM system.
Relution uses Automated Device Enrollment (ADE, DEP in the portal) to put devices into supervised mode. Whether a device is supervised is reported by the device itself; the status is shown in the device list in the Supervised column. Actions that require supervised mode are only available for supervised devices. This also applies to manually enrolled devices that were previously put into supervised mode with Apple Configurator. How an unsupervised device that is already in use can be enrolled as supervised via ADE without data loss is described in Supervising retroactively →.
Put devices in supervised mode
In order to access all functions of Apple devices via an MDM system, they must be supervised. This state is achieved by adding the devices to Automated Device Enrollment (ADE). For this purpose, it is necessary to add the devices to Apple School Manager or Apple Business Manager. If the devices are already registered there, the following section can be skipped; the setup continues with the ADE configuration in the linked article. The following section describes how to add devices retroactively.
Add iOS and tvOS devices to Apple School / Business Manager
Apple Configurator 2 is a free app available from the Mac App Store. It can be used to manually configure Apple devices connected via USB to a Mac before the devices are handed out to users. In addition, Apple Configurator 2 allows Apple devices that have not already been added to ADE by an authorized reseller to be added to Apple School Manager or Apple Business Manager retroactively. This option is only available for iPhones, iPads and Apple TVs. macOS devices must be purchased from an authorized reseller to be enrolled via ADE. Overall, it is recommended to purchase devices directly from an authorized reseller, as adding them after the fact involves manual effort.
Apple devices that are added retroactively via Apple Configurator 2 in Apple School/Business Manager do not behave, for the first 30 days after provisioning, like devices that were registered directly when purchased through an authorized reseller. Even if manual removal of MDM management on devices has been blocked via the associated DEP profile in the MDM system, users can remove MDM management under Settings → General → Profiles.
During the process, the device needs an Internet connection after the restart, either via a Wi-Fi profile created beforehand in Apple Configurator 2 or via the Mac’s Internet connection shared over USB. After they have been added, the devices are assigned to Apple Configurator 2 in Apple School/Business Manager by default and are then assigned to the Relution MDM server there. The complete procedure is described in the following article:
Supervision Certificate
To protect ADE devices and prevent unauthorized access, the option Allow pairing with Macs or PCs and allow Apple Configurator to configure the device, which is enabled by default, can be disabled in the Profile for ADE →. This prevents the Apple device from connecting to a Mac or PC and subsequently configuring the device using Apple Configurator. For example, this prevents users from removing the MDM profile. This configuration cannot be changed without resetting the device.
What should be considered when using this setting?
In some cases, blocking access via a Mac or PC can prevent the administrator from manually resetting a device from a computer. This can occur, for example, if the Wi-Fi settings are incorrectly configured or the MDM server malfunctions. The device is then no longer accessible via Relution and cannot be managed or reset. This is also known as a lock-in effect.
How can authorized access be ensured with Relution?
Connections to Macs or PCs are possible even if they are prohibited by the DEP profile. For this purpose, Relution automatically generates a supervision certificate and stores it in the Profile for ADE (DEP profile). Using this certificate, the administrator can connect the device to a Mac or PC despite the restriction. To do this, the certificate is downloaded from Relution and specified once when connecting via Apple Configurator. Afterward, the device can be accessed again.
The certificate is available in the device details in the Security card, at the Supervision certificate entry, via Download. The entry only appears for devices that are linked to a supervision certificate. The Download supervision certificate dialog shows the password of the PKCS #12 file (mdm-supervision.p12), which can be copied to the clipboard there. Alternatively, the Download supervision certificate action is available in the device list for exactly one selected ADE device.
What needs to be considered when unlocking the device?
The following describes the unlocking process using Apple Configurator:
In the Download supervision certificate dialog, the password is copied and the certificate is downloaded via Download.
A new organization is created in the Apple Configurator settings, and the Apple ID and verification code are entered.
The existing supervision identity is selected and confirmed with Next.
The downloaded supervision certificate is then opened on the computer using the password from Relution. The Keychain containing the certificate opens.
The certificate then appears in the Apple Configurator dialog under supervision identities for selection.
The organization is created.
As of Relution 26.5.5, the Supervision certificate entry in the device details (Security section) and the Download supervision certificate button in the device list are only shown with the Security informations permission (Read) under
Devices→Detailsin the role. In the default roles, it is included for Administrator and Device Manager; custom roles must be extended with this permission. Downloading the certificate and retrieving the password are recorded in the audit log.Create a new organization in Apple Configurator settings and enter the Apple ID and verification code.
Select the existing supervisor identity and click Next.
Then, open the downloaded supervision certificate on the computer using the password from Relution. The Keychain containing the certificate opens.
The certificate then appears in the Apple Configurator dialog under Supervisor Identities for selection.
Create an organization.
The device is now unlocked and can be managed via Apple Configurator.
What should be considered when using the supervision certificate?
Relution generates one supervision certificate per organization and stores it in the profiles for ADE (DEP profiles) when they are created, changed or synchronized. Apple transfers the certificate to the device during setup via ADE. The same certificate applies to all devices of the organization that are enrolled with such a profile. A downloaded certificate therefore grants access to all of these devices and should be treated as confidential. Devices that were enrolled before the certificate was stored in the profile are not linked to it. They only trust the certificate once they are enrolled again via ADE.