What is Automated Device Enrollment (ADE) and when to use it

What ADE does

With ADE, an organization registers devices in Apple Business Manager and assigns them to an MDM server. When a user (or a technician) turns on a registered device and works through Setup Assistant, the device is already known to Apple as belonging to your organization and is routed to your MDM server. No one has to install a profile by hand, visit a web page, or sign in with a special account.

Apple describes ADE as the method for organization-owned devices that gives IT the most control. You can use the full range of Apple-defined payloads and restrictions, and you can prevent the user from removing the management enrollment.

Apple Business Manager is also where you buy and assign apps and books and create Managed Apple Accounts. This article is only about the device enrollment side.

What happens at Setup Assistant

The enrollment happens during the device configuration step of Setup Assistant, at activation. In order:

1. The device connects to a network and contacts Apple's servers.
2. Apple checks whether the device's serial number is assigned to an MDM server for an organization.
3. If it is, the device contacts that MDM server and enrolls.
4. The configurations and restrictions your MDM server sends are installed automatically, often before the user reaches the Home Screen or desktop.

Two consequences follow from this flow. First, devices enrolled with ADE are supervised automatically, which unlocks the strongest management controls. Second, you can choose to make the enrollment non-removable: on a supervised device, the user cannot unenroll it, and on a Mac that also blocks removal through System Settings and the profiles command-line tool. Apple's guidance treats supervision as a signal that the organization owns the device.

Your MDM server can also hold a device in Setup Assistant while it applies critical configuration or installs essential apps, so the user does not reach a half-configured desktop. See supervised vs. unsupervised devices for what supervision adds.

Prerequisites

Before ADE works end to end, these pieces need to be in place:

• An Apple Business Manager account for your organization (Apple School Manager for schools).
• Eligible devices purchased directly from Apple, from a participating Apple Authorized Reseller, or from a participating carrier, and linked to your organization. Devices that did not come through those channels can be added manually with Apple Configurator for iPhone or Apple Configurator for Mac.
• An MDM server linked in Apple Business Manager. You add the server under Devices, upload the server's public key certificate, download the server token, and then upload that token to your MDM service.
• Devices assigned to that MDM server in Apple Business Manager. Registering a device is not enough on its own; it must be assigned to a server for the enrollment to be offered at setup.

Plan for the token as an operational dependency. It is not a one-time setup step, as the pitfalls section below explains.

Skipping Setup Assistant panes

A major reason teams choose ADE is that it lets the MDM server hide Setup Assistant panes the user does not need, such as Siri, Touch ID, or Apple Account sign-in, so the first-run experience is short and consistent. Skipping panes depends on the device being supervised, enrolled in your MDM service, and assigned in Apple Business Manager. Not every MDM service supports every skip option, so check yours.

When a pane is skipped, the device uses the more privacy-preserving setting for that feature, and users can still change settings later unless you restrict them. A few panes cannot be hidden. For example, on a Mac running macOS 15.4 or later, the Set Up as New or Restore pane cannot be hidden, and Remote Management cannot be skipped for devices added through Apple Business Manager.

On a Mac or Apple TV connected by Ethernet, a feature called Auto Advance can skip every pane for zero-touch setup, provided the device's serial number is registered in Apple Business Manager.

ADE compared with other enrollment methods

Apple documents several enrollment paths, and they differ mainly in how much control IT gets and how much separation the user keeps.

• Automated Device Enrollment: for organization-owned devices; supervised; the most control for IT; no work-and-personal data separation.
• Account-driven User Enrollment: for personally owned devices. The user signs in with a Managed Apple Account, the device is not supervised, and work data is separated from personal data. IT can manage only the organization's accounts, settings, and data.
• Device Enrollment (profile-based or account-driven): the user starts enrollment themselves. On iPhone and iPad the device is not supervised; on a Mac it is.
• Apple Configurator: a manual path for adding devices to Apple Business Manager and supervising iPhone, iPad, and Apple TV with a cable and a Mac. It does not scale to large fleets, but it is useful for devices that were not bought through a channel that registers them automatically.

When to choose ADE, and when not to

Use ADE when the company owns the device and needs reliable control. Typical cases are laptops and phones issued to employees, shared devices, kiosks, and any fleet where you want consistent configuration without handling each unit. If you want users to be unable to remove management, ADE is the only path that supports it cleanly.

Do not use ADE for personal devices. Employees do not expect their own phones to be supervised, and ADE offers no data separation. Account-driven User Enrollment is the right tool there. Many organizations run both: ADE for company-owned devices and User Enrollment for bring-your-own-device. For the broader decision, read company-owned vs. personal devices.

A mixed fleet is normal. A contractor with a personal phone, a salesperson with a company laptop, and a warehouse iPad can each sit in a different enrollment method under one MDM server.

Wipes, re-enrollment, and common pitfalls

Because the assignment check runs during Setup Assistant, a device that is wiped and set up again goes through the same check. If the device is still assigned to your MDM server, expect it to be offered enrollment again. If you are retiring or reselling a device, unassign or release it in Apple Business Manager first so it does not return to your server.

• Expired server token. Device management service tokens expire after one year, and your MDM service may not warn you. Generate a new token in Apple Business Manager well before the date and upload it to your MDM service. Tokens also need replacing if the person who downloaded one changes their Managed Apple Account password or leaves the organization, so avoid tying the token to one individual's account.
• Devices not assigned. A device that is registered but not assigned to your server will not enroll at setup. Check assignments in Apple Business Manager before handing devices out.
• Skip options your MDM does not support. Verify that your service supports the panes you plan to hide before you build a first-run flow around them.
• Mixed ownership. Do not push ADE-only expectations (such as non-removable enrollment) onto devices employees own.

Sources

• Deploy devices with Apple School Manager or Apple Business (Apple Platform Deployment)
• Automated Device Enrollment and device management (Apple Platform Deployment)
• Manage Setup Assistant for Apple devices (Apple Platform Deployment)
• About Apple device supervision (Apple Platform Deployment)
• Enrollment methods for Apple devices (Apple Platform Deployment)
• Link to an external device management service in Apple Business

AAMDM is not affiliated with Apple Inc. Apple documentation changes over time; check the linked pages for the latest details.

Related articles