Customer HubManage Apple devices
The operating systems iOS, iPadOS, macOS, tvOS, visionOS and watchOS were developed exclusively for Apple devices. Relution provides a set of features to configure and control Apple devices. The following sections describe how to get started managing Apple devices.
Certificates
New in 26.3Before Apple devices are enrolled, an APNS certificate → (Apple Push Notification Service) must be set up for the organization.
As of Relution 26.3.0, new installations must provide their own APNS certificate before devices can be enrolled. The self-service wizard in Settings → Organization Certificates guides through the setup. Installations set up before this version continue to work with their existing configuration for now, either the certificate provided by Relution or their own certificate obtained via Relution support.
Set up APNS push certificates →
Enrollment
To be able to manage an Apple device, it must be enrolled in Relution. To do this, a so-called MDM profile is installed on the device. Three different types of enrollment are available for Apple devices. Apple Watches are not enrolled directly but through a paired iPhone managed in Relution.
iOS enrollments →
macOS enrollments →
tvOS enrollments →
visionOS enrollments →
Enrollment under watchOS →
Supervised Mode
Supervised Mode allows to distinguish Apple devices owned by the employer from personal devices. For unrestricted management and use of all MDM features, it is recommended to put the devices into Supervised Mode. This allows restrictions to disable many features not needed for use in a school or work environment. The link below leads to further information on how to put Apple devices into this mode.
Devices from Automated Device Enrollment (ADE, DEP in the portal) are always supervised. Add to ADE retroactively →
Relution Agent
After enrollment, the Relution Agent is automatically installed on iOS/iPadOS and macOS devices, but not on tvOS or visionOS devices. It is not necessary for device manageability, but provides a variety of additional useful features for users.
It is recommended to have a sufficient number of Apps and Books (VPP in the portal) licenses for the app available, in which case the installation runs without any user interaction. On macOS devices, the installation requires such a license; without a license, the agent is not installed there. On iOS/iPadOS devices without a license, users need to sign in to the App Store on the device with an Apple Account instead.
On macOS devices, the macOS Companion is also deployed during enrollment, provided that Enable macOS companion is switched on under Settings → Relution Client Apps. User enrollments and devices running a version earlier than macOS 12 are excluded.
Separate business and personal data
Managed apps: Apps that are deployed to Apple devices through Relution are called managed apps. Control over these apps is retained; they and their associated data can be removed as needed. For iOS and macOS devices, managed apps can be configured through the Managed App policy configuration.
Managed accounts: For iOS and macOS devices, Relution can set up email and other accounts through MDM and manage them independently of personal accounts. With Relution, the following accounts can be configured:
- Exchange
- CardDAV
- CalDAV
- LDAP
- Subscribed calendars (iOS devices only)
- Google Accounts (iOS devices only).
Data separation takes place within the operating system for Apple.
Manage apps
The apps to be used on Apple devices are selected; apps that are not needed are blocked or removed. Apps can be managed, distributed and removed efficiently on a large number of Apple devices at the same time.
App Licenses
Every app that is installed on Apple devices through the Public App Store must be licensed. It does not matter if the app is free or not. The license can be obtained either via the user currently signed in with an Apple Account or, if working without Apple Accounts, via Apps and Books. For Apps and Books, access to an Apple School/Business Manager is required. For native apps, this is not necessary.
The apps can be installed on Apple devices without users manually initiating the installation, as long as the Apple devices are supervised, i.e. in Supervised Mode.
Apps licensed through Apps and Books can be installed on supervised Apple devices without user input. Learn more about Apps and Books:
VPP setup in Relution →
App Installation →
Block or positive list for iOS and tvOS
The block or positive list feature in Relution allows administrators to block certain apps on iPhones, iPads, and Apple TVs and allow installation of important apps. This feature prevents the installation of unwanted apps and hides installed apps that are already on devices from users if necessary. The link below leads to further information on blocking or allowlisting apps.
App compliance for iOS →
App compliance for tvOS →
Single App Mode for iOS and tvOS
Single App Mode can be enabled on iPhones, iPads and Apple TVs, restricting devices to a single app and blocking all others. It should be noted that the devices must be supervised to enable Single App Mode.
Single App Mode for iOS →
Single App Mode for tvOS →
Web link
The webclip looks like an app icon that links to a website when clicked. Just a label and a URL have to be specified.
Weblinks →
Creating folders in the Home Screen Layout →
Protect MDM profile from deletion
Removal of the MDM profile from the device settings can be prevented if the devices are enrolled through Automated Device Enrollment (ADE) and the option User may remove MDM Enrollment is disabled in the profile for ADE before enrollment (enabled by default).
Profile for ADE →
Auto enrollment →
Network configuration and security
Maximum network security can be achieved by setting up appropriate configurations. With Relution, Wi-Fi settings can be configured for all Apple operating systems. In addition, VPN (Virtual Private Network) and per-app VPN settings can be configured for iOS and macOS devices. Cellular settings (APN, Access Point Name) can be configured for iOS devices using the Mobile network configuration.
Restrictions
The policy configuration of restrictions limits Apple devices in functionality. It is important to note the type of enrollment, as many restrictions only take effect on supervised devices.
System updates
The update behavior of Apple devices is controlled by the Software update settings configuration (on iOS as of iOS 18). Among other things, it covers notifications, automatic download and installation, and the deferral of updates for up to 90 days. During this period, users are not prompted to update devices to the latest OS version. This allows organizations to check for errors/problems or to check the compatibility of deployed applications with the latest OS versions.
The Managed Software Updates configuration enforces a target version by a deadline (on iOS as of iOS 17, supervised devices only).
For older devices, the deprecated System updates configuration (supervised devices earlier than iOS 17) and the Force delayed software updates restriction are still available.
Software update settings →
Restrictions →
Content filtering
The web content filtering feature can be used to prevent access to specific web pages in the organization. The configuration is available for iOS and macOS devices, but not for user enrollments.
Web Content Filter for iOS →
Web Content Filter for macOS →
Homescreen Layout for iOS
The apps can be arranged on the homescreen of the iPhone or iPad as well as in the Dock, and be placed in folders that can be created manually or automatically.