Can an MDM capability iOS app enrol a device using user authentication enrolment using OAuth2 without managed Apple ID?

Question

Created 23h

Replies 1

Boosts 0

Participants 2

Hi,

Is there any possible way we can install enrolment provisioning profile using iOS app using User/Account Authentication Enrolment such as described in this thread:

https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow

Answered by Device Management Engineer in 887117022

First, some clarification: Provisioning profiles are different from configuration profiles. A provisioning profile is part of the development process for an application, and unrelated to configuration profiles. Configuration profiles change the configuration of a device when they are installed. An enrollment profile is a type of configuration profile that enrolls a device in device management.

The documentation you linked to describes how to use OAuth2 as part of authentication related to account-driven enrollments. Account-driven enrollments require Managed Apple Accounts.

You also asked about using an iOS app. An iOS app cannot initiate an account-driven enrollment. The user must manually open the Settings app, navigate to General > VPN & Device Management, and tap Sign In to Work or School Account... in order to start an account-driven enrollment.

Boost

Answer 1

Device Management Engineer OP

Apple

19h

Accepted Answer

Recommended

First, some clarification: Provisioning profiles are different from configuration profiles. A provisioning profile is part of the development process for an application, and unrelated to configuration profiles. Configuration profiles change the configuration of a device when they are installed. An enrollment profile is a type of configuration profile that enrolls a device in device management.

The documentation you linked to describes how to use OAuth2 as part of authentication related to account-driven enrollments. Account-driven enrollments require Managed Apple Accounts.

You also asked about using an iOS app. An iOS app cannot initiate an account-driven enrollment. The user must manually open the Settings app, navigate to General > VPN & Device Management, and tap Sign In to Work or School Account... in order to start an account-driven enrollment.

1