How to enroll Apple TVs

Apple TVs are becoming a significant entity in enterprises. It is one of the most promising streaming and signage tool used today in enterprise infrastructures. Hexnode supports the management of Apple TVs with a set of easy enrollment methods. They can be enrolled in Hexnode via different methods:

1. Apple Configurator Enrollment
2. ABM Enrollment
3. ABM Enrollment via Apple Configurator

Apple Configurator Enrollment

Apple Configurator is a macOS tool that can be used to supervise and enroll Apple devices in mobile device management solutions. Apple Configurator is also used for creating configuration profile and deploy applications for enterprise and educational institutions. The enrollment can be completed through a wired setup or wirelessly over-the-air.

Follow the steps below to enroll Apple TV to Hexnode using Apple Configurator:

ABM enrollment

Apple Business Manager was introduced by Apple to help Business and Educational organizations remotely deploy Apple devices. Using ABM, a brand-new Apple device can be enrolled in Hexnode without a technician ever touching it. After the devices have been enrolled in Hexnode, you can apply DEP policies via the Hexnode portal.

Here is how to assign Apple TVs to the Hexnode server via ABM:

1. Log in to your Apple Business Manager account.
2. Complete the two-step verification.
3. Click Devices. Search and select the required devices from the list. You can filter devices based on their source, order numbers, device types, etc. Then, click on Edit corresponding to the Edit MDM server option. In the case of a single device, click on Edit MDM Server that appears on the screen’s top center.
4. Next, select the Assign to the following MDM option, and choose the required MDM server to which the devices are to be assigned.
5. Confirm your action to complete the assignment.

Create a configuration profile with required configurations in Hexnode and attach it with the devices for streamlined enrollment. The device is now ready for deployment. If you have a new device, activate DEP by connecting it to the internet and applying Remote Management configurations. If you have an already activated device, reset the device to its factory settings to initiate the device enrollment procedure. After resetting, connect the device to a Wi-Fi network and apply Remote Management.

ABM Enrollment via Apple Configurator

Apple devices purchased before March 1, 2011 and other non-Authorized resellers or non-Apple purchased devices cannot be directly enrolled via ABM enrollment. Such devices can be enrolled in DEP with the help of Apple Configurator. Also, Apple TV’s that were previously Released from DEP can also be added back using this enrollment method.

Step A: Create a Wi-Fi profile in Apple Configurator

1. Open Apple Configurator on the host Mac. On the menu bar, click on File → New Profile → Wi-Fi, select Configure.
2. Enter the SSID, security type, password, and any other relevant settings required to connect to your Wi-Fi network.
3. Click Save from the File menu.

Step B: Prepare a Blueprint and attach the Wi-Fi profile

1. Open Apple Configurator 2.0 on your host Mac machine.
2. Go to Blueprints and click on Edit Blueprints.
3. Click on New from the bottom left and enter a name for the blueprint.
4. Double click on the blueprint, this will take you to the Info page. Change the blueprint Target to Apple TV. Click on Back.
5. Select the blueprint and click on the Add button (located on top of Apple Configurator). Choose Profiles and select the created Wi-Fi profile. Alternately right-click on the blueprint and click on Add and choose Profile to add the Wi-Fi profile.
6. Then select the blueprint and click on the Prepare button on top of the Apple Configurator. Or, right click on the blueprint and select Prepare.
7. Choose Prepare with: Manual configuration. Enable the options Add to Apple School Manager or Apple Business Manager, Activate and complete enrollment, Supervise devices and Allow devices to pair with other computers and click Next. If Allow devices to pair with other computers is not selected, the device cannot be detected by Mac or a PC when connected via USB.
8. Now choose the enrollment server to remotely manage the device. Select New Server from the drop-down and click Next.
9. Specify a name for the server and enter the URL, which can be found at Enroll > Platform – Specific > tvOS > Apple Configurator and click on Next.
10. The trust anchor certificates for the MDM server will be automatically added, click on Next.
11. Now choose the organization used to supervise the devices. To create a new organization, select the New Organization from the drop-down menu, and click Next. Note that, this step will be hidden if no organization is already registered in the Apple Configurator.
12. Sign in to your Apple Business Manager account. Note that this account should have administrative permissions to manage devices.
13. Select Generate a new supervision identity and click Next.
14. From the Setup Assistant screen, select any of the three options from the drop-down: Show all steps, Show only some steps, and Do not show any of these steps. If Show only some steps is selected, choose the steps to be shown from the same page. Click Next.
15. Then select the previously prepared Wi-Fi profile and click Next.
16. Click on Prepare.

Step C: Pair the devices and associate the Blueprint

Connect the host Mac and the Apple TV either wirelessly or via a USB cable. To pair Apple devices over a network, refer Step 4: Applying Blueprint to the Apple TV in the Apple Configurator Enrollment.

Now, apply Blueprint to devices. To do so, select the device and click on Blueprints, select the required Blueprint, and click on Apply.

If the device is supervised, the Wi-Fi profile will automatically install on the device and you will be prompted to initiate the erase action on Apple Configurator. However, if the device is not-supervised, you will be notified that the Wi-Fi profile installation cannot be completed without manual intervention. Install the profile by physically accessing the device and manually reset the device to its factory settings.

Step D: Sync the Apple Business Manager account with Hexnode

Once the device is reset, leave it on the Hello screen. Then sync your Apple Business Manager account with Hexnode. For that, first create a DEP Account in Hexnode.

1. In the Hexnode UEM portal, go to Enroll > All Enrollments > No-Touch > Apple Business/School Manager to obtain the MDM DEP certificate.
2. Click on Next.
3. Provide an Account name and download the certificate file Hexnode_Apple_DEP_cert.pem.
4. Sign in to your Apple Business Manager account.
5. Click your name at the bottom of the sidebar. Then, go to Preferences > Your MDM Servers, and click on Add.
6. Name the MDM server and upload the public key (the DEP certificate previously obtained) and click Save.
7. Click on Download Token > Download Server Token.
8. Go back to your Hexnode UEM console and upload the DEP server token in the field Upload DEP server token file.
9. Check the box Add as Pre-approved device if you want to pre-approve the DEP devices that you are planning to enroll using Hexnode.
10. Choose a Default Configuration Profile. By default, the Default DEP profile will be selected. If you want to attach a different configuration profile with the DEP Account, choose it from the drop-down.
11. Select the User authentication mechanism that should be implemented when enrolling devices.
    1. Use Global Authentication settings: The authentication mode as selected under Admin > Enrollment > Authentication Modes is considered.
    2. No Authentication: If this option is selected, the device enrollment can be completed without any user authentication. The user to which the device should be assigned must be specified.
       • Domain: Select the domain in which the user resides. It can be Hexnode’s local directory or any integrated directory domains.
       • Default user: Choose the user in the selected domain to which all the DEP devices should be assigned to.
12. Click on Next to move on to the next steps.

Step E: Assign the devices to the Hexnode server in ABM

On applying the configurations via the Blueprint, the device will get listed under Devices tab in Apple Business Manager. Select the devices and assign it to the MDM server.

Devices can be assigned individually or in bulk. To select devices in bulk, use the available filter criteria to group the required devices together. However, if you want to enroll multiple devices without filtering then just select the required devices manually.

1. On your Apple Business Manager account, go to Devices.
2. Search and select the required devices from the list. You can filter devices based on their source, order numbers, device types, etc. Then, click on Edit corresponding to the Edit MDM server option. In the case of a single device, click on Edit MDM Server that appears on the screen’s top center.
3. Next, select the Assign to the following MDM option, and choose the required MDM server to which the devices are to be assigned.
4. Click on Continue and then confirm your action.
5. Now, go to your Hexnode MDM admin console and click on Sync with DEP under Enroll > All Enrollments > No-Touch > Apple Business/School Manager > DEP Devices.

Step F: Activate the device and get it enrolled in ABM

Now, start activating the erased device or the new device to which the Blueprint was attached. The device will get automatically associated with the Wi-Fi network configured under the Wi-Fi profile. Enable Remote Management for the device and follow the on-screen instructions to complete the device enrollment.

30-day provisional period

Apple devices enrolled in ABM via Apple Configurator will not work like an actual DEP enrolled device during the initial 30-days after deployment. That is, even if you have configured to block the manual MDM administration removal in the associated DEP profile, the user can choose to remove the MDM management from Settings > General > profiles. However, after the initial 30-days of enrollment, the user will be blocked from bypassing the MDM management.