Device Enrollment Program – FAQs

1. How to configure user assignment for ABM-enrolled devices?

Devices enrolled via DEP will get assigned to a default user upon enrollment into the Hexnode portal. You can navigate to Admin > Apple Business/School Manager > Apple DEP > DEP Accounts and click on the edit icon beside a DEP account to configure user assignment. You can choose the “User Authentication” mode from the following options:

• Use Global Authentication Settings – The mode as selected under Admin > Enrollment > Authentication Modes are considered. This option will be selected by default.
• No Authentication – You can select the default user to which the devices are to be assigned by default.

All the devices enrolled into that particular DEP account will have the user assignment as configured inside the DEP account settings.

2. What is the validity of a DEP token and how do I renew my expired DEP token?

The validity of a DEP token is one year (365 days). After one year, the validity of the token expires, and you will not be able to enroll devices into that DEP account. You can renew your DEP token by uploading the new token to the Hexnode portal. Have a read through our detailed documentation to get a better idea on how to renew an Apple DEP token.

3. I want a particular configuration profile to be applied by default to all my devices when they are enrolled via DEP. Is that possible?

You can either create a new configuration profile or apply an existing configuration to a DEP account. This profile will be the default configuration profile for devices enrolled in this DEP account. Navigate to Admin > Apple Business/School Manager > Apple DEP > DEP Accounts and click on the edit icon beside a DEP account to configure user assignment. Inside the Edit DEP Account window, you can select the required DEP configuration profile from the Default Configuration profile dropdown. The selected profile will get automatically assigned to all the devices that are enrolled into this DEP account.

4. What happens if I perform a wipe action on a DEP-enrolled device?

When you perform a wipe action on a DEP-enrolled device, the device will get re-enrolled back into the portal automatically. The MDM profile and configurations will get re-installed when the device starts up following the wipe.

Devices added to DEP via Apple Configurator have a 30-day provisional period, after which it starts to behave as an actual DEP enrolled device. If a Wipe action is performed on such a device during its provisional period, the MDM profile will get removed.

5. How do I re-assign my device to another DEP user?

Navigate to Admin > Apple Business/School Manager > Apple DEP > DEP Accounts and click on the edit icon beside a DEP account to configure user assignment. You can set the “User Authentication mode” to one of the given options:

• Use Global Authentication Settings – The user authentication mode as selected in Admin > Enrollment > Authentication modes are considered.
• No Authentication – The admin can select the domain and the user to which all the devices enrolled into this DEP account are to be assigned.

Resetting and enrolling the device back into the portal will re-assign the device to another user

6. Will I be able to enroll iOS devices into DEP which are not purchased directly from Apple or authorized resellers?

You can enroll a device not purchased directly from Apple or an authorized reseller in the Device Enrollment Program using the Apple Configurator 2.5 or later.

7. Will I be able to perform actions to my DEP enrolled device without an APNs certificate?

You will not be able to perform any sort of actions or push any policies to an Apple device without an active APNs certificate. An MDM will be able to communicate with an Apple device only if it has a valid APNs certificate configured in the MDM server.

8. Why is the device not getting listed in the device list, even after successfully syncing?

After assigning a device to the MDM server, the configurations will get applied on the device when the device boots for the first time or when the device is reset after adding the device in DEP. When the device starts up, it will get enrolled into the Hexnode portal and the configurations will get automatically applied to the device. After successful enrollment, you can click on the “Sync with DEP” button again to refresh the list of DEP-enrolled devices in the portal.

9. Is Apple Business/School Manager available in all countries/regions across the globe?

Apple offers the Apple Business/School Manager program to various countries and regions across the globe. However, they are not available in all countries/regions. Have a go through Apple’s document on the Availability of Apple Programs to check whether the ABM/ASM program is available in your country/region.

10. Where can I get my Apple Customer Number/Reseller ID from?

To enroll your devices into DEP via ABM/ASM, you will need your Apple Customer Number or the Reseller ID. Here’s how you can find them:

• If you have purchased your device directly from Apple, you can contact your purchasing agent or the Apple Sales team and ask for your Apple Customer Number (ACN).
• If you have purchased your device from an Apple Authorized reseller, you can contact them and ask for their Reseller ID.

11. Can all Apple devices purchased directly from Apple or from an Authorized Reseller be enrolled via DEP, independent of their OS versions?

You will not be able to enroll all devices purchased from Apple or from an Authorized Reseller. You also need to ensure that they are running on the minimum specified OS versions as well:

• iOS devices running iOS 11 and above.
• iPads running on iPadOS 13.1 and above.
• macOS devices running on macOS 10.9 and above.
• Apple TVs running on tvOS 10.2 and above.

12. Is it possible to add multiple DEP accounts in the Hexnode portal?

You can configure multiple DEP accounts inside the Hexnode portal. Navigate to Admin > Apple Business/School Manager > Apple DEP > Add DEP Account, and fill in the required details to configure a DEP account. You can click on DEP Accounts to view all the accounts that you have configured using the Hexnode portal.

13. Can the device end user remove or delete the MDM profile for Apple devices?

No, the device end user cannot remove the Mobile Device Management (MDM) profile for iOS devices enrolled through the Device Enrollment Program (DEP). Once a device is enrolled through DEP, the MDM profile cannot be removed by the end user without unenrolling the device from DEP. With Hexnode UEM, IT administrators can set a UEM profile removal password for macOS devices to further prevent the device end user from removing it.