iOS MDM service and MDM agent app

Question

I'm researching about MDM in iOS, and find out information about Apple’s native iOS mobile device management. Once the device is enrolled into a MDM server, server can manage the device by sending commands. I tested on a MDM server and saw that without installing MDM agent app on device, server can still send profiles and apply policies to the device.

Could anyone help me to address:

1. Is Apple’s native iOS mobile device management built inside the iOS itself?
2. Can MDM server manage device (install apps, disable camera, iTunes...) without installing a MDM agent app?
3. How can the device itself can communicate with MDM server and install profiles sent from server automatically?
4. Do I need an enterprise account to use iOS MDM service?
5. Where can I find documents about MDM API and how to use it?

Mellar

Answer 1

Is Apple’s native iOS mobile device management built inside the iOS itself?

Yes - as of iOS4 devices become MDM-capable.

Can MDM server manage device (install apps, disable camera, iTunes...) without installing a MDM agent app?

Yes. The only thing an MDM Agent app will get you is the ability to report back on the device's IP address / network information, custom logging, etc. By default iOS does not allow for "tracking" a user's network details.

How can the device itself can communicate with MDM server and install profiles sent from server automatically?

This is what I refer to as "the circle of hell". Your MDM sends command/installation packets to the APNs server, the APNs server tells the device it has a pending command from the MDM, the device reaches out to the MDM for its instructions and acknowledges. My nickname is for the trouble it takes to get firewall permissions setup in large enterprises.

Do I need an enterprise account to use iOS MDM service? Where can I find documents about MDM API and how to use it?

To use an MDM service you do not need an Enterprise account. To create an MDM service and access its documentation you do need an Enterprise account at $299/year.

Hoop

are there any updates to iOS meanwhile, where you need a client on iOS device to enable extra capabilities? Because every MDM/MAM/EMM company have their own iOS clients. Also, how do they support remote control support when iOS MDM does not support it. – Caesalpiniaceous

Answer 2

1. Yes.
2. N/A as the 'agent' is already built in iOS
3. To manage a device by MDM, the device must be enrolled manually first. During the enrollment process, a configuration file will be installed in the device containing the information of the MDM server. The MDM framework also make use of push notification to communicate with the device.
4. Yes. In addition, you also need the ability to generate MDM Vendor Certificate on Apple's Developer Portal.

Smutch

Thanks for the answer, TackMayers. I'm not clear about MDM framework, is it inside the device OS or MDM server integrate it to communicate with device? Could you provide me any info where can I get document about MDM API and how to use it? – Mellar

Documentation, the in-depth MDM specific documentation, is only available by signing up with an Enterprise Apple Developer account. – Testate

@Tact, are there any updates to iOS meanwhile, where you need a client on iOS device to enable extra capabilities? Because every MDM/MAM/EMM company have their own iOS clients. Also, how do they support remote control support when iOS MDM does not support it. – Caesalpiniaceous

Answer 3

Is Apple’s native iOS mobile device management built inside the iOS itself?

Yes , Apple has secured mdm-client bundled in each Apple product . We can make use of the client upon enrolling . There is supervised enrollment where mdm-client can perform more privileged task .

Can MDM server manage device (install apps, disable camera, iTunes...) without installing a MDM agent app?

Yes , Once device is enrolled you can apply restrictions on iOS and macOS , install apps silently using VPP etc . Refer Configuration-Profile-Reference.pdf Page 67 for list of all restrictions

How can the device itself can communicate with MDM server and install profiles sent from server automatically?

Like iOS apps , mdm-client responds to notifications through APNS . The server in which device is enrolled will have push-magic string,device token and a topic device listens to these helps the server to notify device . Device will then ping the server. I have attached Official MDM guide that you can refer for more details.

Do I need an enterprise account to use iOS MDM service?

Here you have two options , if you want to build your own MDM solution then like i said before you would need to notify device so that it contacts your MDM server upon enrollment . Similar to building iOS app , you need an developer account to create a APNS certificate (refer here) to notify default mdm-client.

Or you you just wish to manage your device , you need not require a developer certificate. MDM vendors would use their certificate for signing, and you would need an apple id account to use upload certificate provided by your MDM to notify devices.

Where can I find documents about MDM API and how to use it?

Refer below links to getting started with MDM . Comment your queries for any help.

1. Setting up MDM and MDM Protocol

2. Restrictions and other MDM profiles

3. Apple business manager

Cru