PERMISSIONS  Refer to Setup > Integrations in Permissions.

PERMISSIONS  Refer to Global > Policies in Permissions.

PERMISSIONS  Refer to Sites > Policies in Permissions.

PERMISSIONS  Refer to Sites > Devices in Permissions.

NAVIGATION  Setup > Integrations > Apple MDM

Apple MDM uses separate licensing for macOS and iOS/iPadOS devices. Macs enrolled through Apple MDM continue to use a standard Datto RMM Endpoint License.

iOS and iPadOS devices require a dedicated Mobile Device Management License.

License consumption

NOTE  Devices discovered through Automated Device Enrollment (ADE) do not consume a license until they are activated, configuration is finished, and their enrollment status changes to Enrolled.

Trialing Apple MDM

Eligible Datto RMM accounts can start a free 14-day Mobile Device Management trial to evaluate Apple device management in their own environment.

During the trial, you can connect Datto RMM to Apple services, enroll supported Apple devices, apply Apple MDM policies and payloads, deploy managed applications, and run supported MDM commands. Apple devices are managed through the same Datto RMM Sites, Devices, filters, groups, policies, and activity workflows used for other endpoints.

Starting a trial

1. In Datto RMM, navigate to Setup > Licenses.
2. Click Start trial.
3. Confirm that the card status changes to Trial active.
4. Set up the required Apple MDM integrations.
5. Enroll Apple devices and begin evaluating the available capabilities.

Ending a trial

When the 14-day trial expires, trial access ends automatically. No paid subscription is created, and no automatic charge is applied.

The Mobile Device Management card displays the trial expiration date and, when applicable, the date when another trial becomes available.

To continue using MDM, contact your Account Manager to purchase the required Mobile Device Licenses. Macs will continue to use standard Datto RMM Endpoint Licenses under existing licensing terms.

License quantity and overage

Mobile Device Licenses are subject to the committed quantity in your subscription. When enrolled iPhone and iPad use exceeds the committed quantity, additional use may be billed as overage according to your subscription terms.

Unlicensed mobile devices

When a device is unlicensed, the device remains visible in Datto RMM, but MDM commands are no longer available, MDM policies are no longer applied or updated, and online status is no longer reported.

Unenrollment and license use

When a device is unenrolled, the device remains visible in Datto RMM and enrollment status changes to Unenrolled. MDM commands are no longer available, MDM policies are no longer applied or updated, and online status is no longer reported for iOS and iPadOS devices. For iPhone and iPad, the Mobile Device License is not consumed. For macOS devices, the Datto RMM Endpoint License remains consumed.

Deletion

When an MDM device is deleted, its license is no longer consumed.

An Apple Push Notification service (APNs) certificate allows Datto RMM to communicate with Apple devices enrolled in Apple MDM. Create the APNs certificate before manually enrolling Apple devices or configuring Automated Device Enrollment.

Prerequisites

Before you begin, verify the following: 

• You have permission to manage Apple MDM integrations in Datto RMM.
• You have an organization-controlled Apple account that can sign in to the Apple Push Certificates Portal.
• You know which Datto RMM Sites should be covered by the certificate. The APNs certificate must cover every Site where you plan to enroll or manage Apple devices.

NOTE  Use an organization-controlled Apple account when creating the APNs certificate. Record which account was used and ensure that authorized administrators can access it when the certificate needs to be renewed.

Create the certificate in Datto RMM

1. Go to Setup > Integrations > Apple MDM > APNs.
2. Click Create Certificate.

   

3. In Apple ID, type the email address of the organization-controlled Apple account that will be used to create and renew the APNs certificate.
4. In Description, optionally type information that helps identify the certificate.

   

5. Select the Certificate Scope of the Sites that will use this APNs certificate:
   • Global: Select when the certificate should be available across the Datto RMM account.
   • Sites: Select all Sites that should use the certificate.

IMPORTANT  The APNs certificate must cover the Site where you plan to enroll or manage Apple devices.

Create the APNs certificate in Apple's portal

1. Click Download CSR to download the Certificate Signing Request (CSR) file required by Apple.

   

2. Sign in to the Apple Push Certificates Portal with the organization-controlled Apple account that will be used to create and renew the APNs certificate.

   

3. Click Create a Certificate.
4. Accept the MDM Certificate Agreement Terms of Use when prompted.
5. Upload the CSR generated by Datto RMM.

   

6. After Apple confirms that the certificate was created, click Download.

Upload the APNs certificate to Datto RMM

1. Return to the Create APNs Certificate page in Datto RMM.
2. In Upload the Apple Push Certificate, upload the certificate downloaded from the Apple Push Certificates Portal.
3. Verify that the Apple ID matches the account used to create the certificate.
4. Click Create.

Verify the certificate

Confirm the following values on the APNs page:

• Apple ID: Identifies the Apple account used to create and maintain the certificate.
• Scope: Shows the expected Datto RMM Sites.
• Status: Shows Active when the certificate is valid.
• Devices: Shows the number of devices using the certificate to communicate with Apple.
• Expiration: Shows the certificate expiration date.

You can now proceed to the applicable enrollment workflow.

Use an Automated Device Enrollment (ADE) token to connect Datto RMM to Apple Business or Apple School Manager. After the token is configured and devices are assigned to the corresponding MDM server, the devices can appear in Datto RMM and enroll automatically during device setup.

Prerequisites

Before you begin, verify the following: 

• You have an active APNs certificate in Datto RMM.
• The APNs certificate covers the Datto RMM Enrollment Site you plan to use.
• You have access to an organization-controlled Apple account that will be used to create and maintain the ADE server token.
• You have access to Apple Business or Apple School Manager with permission to manage MDM server assignments.
• The Apple devices you want to enroll are available in Apple Business or Apple School Manager.
• You know which Datto RMM Site should contain the automatically enrolled devices.

Create the token in Datto RMM

1. Go to Setup > Integrations > Apple MDM.
2. Select the Automated Device Enrollment tab.
3. Click Create Token.

   

4. In Apple ID, type the email address of the organization-controlled Managed Apple Account that you will use to download and maintain the ADE token.
5. In Description, optionally type information that helps identify the token.
6. Select the Enrollment Site where devices will be enrolled.

   NOTE  When a Site is chosen, a matching or Global certificate is pre-selected.

7. Select an APNs certificate.

   

   IMPORTANT  Make sure you select an APNs certificate that covers the selected Enrollment Site.

Connect to Apple Business

1. Click Download Public Key. Datto RMM downloads a Privacy-Enhanced Mail (PEM) file named ade_public_key_<token id>.pem to your default download location.

   

2. Click Go to Apple Business or Go to Apple School Manager.

   NOTE  Keep the Datto RMM page open. You will return to it after downloading the MDM server token from Apple.

Upload the public key to Apple Business

1. In Apple Business, click your name at the bottom of the sidebar and select Preferences.
2. Click MDM Server Assignment, then click Add.
3. Type a unique name for the server.

   

4. Upload the ade_public_key_<token id>.pem file you downloaded from Datto RMM.
5. Click Save.
6. Click Download MDM Server Token, then click Download MDM Server Token in the confirmation dialog box.

NOTE  Apple Business can allow an MDM server to release devices from the organization. Review your organization's device-management requirements before configuring the MDM server's release-device permissions.

Upload the server token

1. Return to the Create Automated Device Enrollment Token page in Datto RMM and locate the Upload Server Token section.
2. Upload the .p7m server token file downloaded from Apple Business by dragging it into the drop file to attach box or by clicking Browse and selecting the file.

Configure enrollment options

1. Optionally type a support phone number and email address to display to users during device activation.
2. In the General Settings section, configure the following:
   • Enforce MDM enrollment: Select whether enrollment is mandatory during device setup.
   • Allow users to remove MDM profile: Select this option only when users should be allowed to remove management from the device. For organization-owned devices, leave this cleared unless your organization intentionally allows removal.
   • Enable Shared iPad experience: Shared iPad does not support personal Apple Accounts. Users may sign in as guests, and their data is erased after they sign out.
3. In Setup Assistance Options, select which setup steps are present when running setup on an MDM-enrolled device.

   

4. Click Create to save your configuration and create the token.

Verify the ADE token

Confirm the following values:

• Apple ID: Identifies the Apple account used to create and maintain the token.
• Enrollment Site: Shows the Datto RMM Site where assigned devices will appear.
• Status: Shows Active when the token is valid.
• Expiration: Shows the token expiration date.
• Devices: Shows the number of devices discovered from Apple Business.

Assign devices to the MDM server

In Apple Business or Apple School Manager, assign the Apple devices you want to enroll to the MDM server created for this ADE token. Refer to Assign, reassign, or unassign devices in Apple Business.

Devices assigned to the MDM server appear in the ADE device view before activation on Setup > Integrations > Apple MDM > Automated Device Enrollment > Devices page.

After a device is powered on and completes Setup Assistant, it becomes enrolled and appears in the standard Devices list.

Renew an ADE token

Renew the ADE token before it expires to maintain synchronization between Datto RMM and Apple Business or Apple School Manager.

Use the same Apple account that was used to create the existing token. Refer to Manage content tokens in Apple Business.

An Apps and Books token connects an Apps and Books content scope in Apple Business or Apple School Manager to Datto RMM.

The content token represents a specific Apple content scope. Only applications and licenses available in that scope are synchronized to Datto RMM.

Datto RMM uses the token to synchronize available application licenses so that you can assign managed apps to enrolled Apple devices.

After the token is active and application synchronization is complete, configure the applications in an Apple MDM policy and target the required devices.

NOTE  Creating an Apps and Books token does not enroll devices or immediately install applications.

NOTE  Apple application licenses are separate from Datto RMM device licenses.

Prerequisites

Before you begin, verify the following: 

• You have an organization-controlled Managed Apple Account with permission to download Apps and Books content tokens.
• Required application licenses have been acquired or transferred to the appropriate organizational unit in Apple Business or location in Apple School Manager.
• You have permission to manage Apple MDM integrations in Datto RMM.

Create the token in Datto RMM

1. Go to Setup > Integrations > Apple MDM.
2. Select the Apps and Books tab.
3. Click Create Token.

   

4. In Name, type a unique name that identifies the customer and the corresponding Apple organizational unit or location.

5. In the Connect to Apps and Books section, follow the instructions in that section to download a content token from Apple Business or Apple School Manager.

6. In Apple ID, type the email address of the organization-controlled Managed Apple Account that you will use to download and maintain the content token. Use the same account when the token needs to be renewed.

   

Download the content token from Apple Business

NOTE  The following steps describe Apple Business. The corresponding workflow in Apple School Manager is the same, but may have different navigation.

1. Sign in to Apple Business with an account whose role has permission to obtain licenses for Apps and Books.
2. Go to Settings > Payments & Billing.
3. Select Apps and Books.
4. Locate the organizational unit whose applications and licenses you want to synchronize with Datto RMM.
5. Select Download to download its content token.

Upload the content token to Datto RMM

1. Return to the Create Apps and Books Token page in Datto RMM.
2. In Upload Content Token, upload the .vpptoken file downloaded from Apple Business or Apple School Manager.
3. Click Create.

Verify the token

Confirm the following values:

• Name: Identifies the correct customer and Apple content scope.
• Apple ID: Identifies the account responsible for maintaining the token.
• Status: Shows Active when the token is valid.
• Expiration: Shows the expected expiration date.
• Apps: Shows the number of applications synchronized from Apple after synchronization completes.

NOTE  After the token is active and synchronization is established, configure managed applications in an Apple MDM policy and target the required devices.

Content token renewal

Content tokens are valid for one year. Renew the token before the expiration date shown in Datto RMM to prevent interruption to application-license synchronization and assignment. Refer to Manage content tokens in Apple Business.

Enrollment is the process of registering an Apple device with a mobile device management (MDM) service so that the device can be managed by Datto RMM. Choose the enrollment method based on the device type, whether the device is personally owned or organization-owned, and the level of management required.

BEFORE YOU BEGIN  Configure an APNs certificate before using Apple MDM enrollment. Refer to Create an APNs certificate.

Manually enroll an Apple device using a QR code or link

Use manual enrollment to enroll an Apple device into Datto RMM without Automated Device Enrollment.

• QR code enrollment is intended for personal (BYOD) iPhone and iPad devices.
• Link enrollment is required for Mac computers and can also be used for iPhone and iPad.

BEFORE YOU BEGIN  Confirm that an active APNs certificate is associated with the Site where you want to enroll the device.

Start enrollment in Datto RMM

1. Go to Devices > Add Device.
2. Select Apple MDM.
3. Select the Site where the device should be enrolled.
4. Select QR Code and Link as the enrollment path.

   

   Use one of the following methods:
   • QR code: Scan the QR code with the device's Camera app.
   • Enrollment link: Open the displayed link on the device using Safari browser.

   

Complete enrollment on the Apple device

On iPhone or iPad:

1. Scan the QR code using the Camera app, or open the enrollment link.
2. Open the downloaded configuration profile.
3. Open Settings.
4. Tap Profile Downloaded.
5. Tap Install.
6. Follow the on-screen prompts to complete enrollment.
7. Tap Done.

On a Mac:

1. Open the enrollment link provided by Datto RMM.
2. Download the configuration profile when prompted.
3. Open the downloaded profile.
4. Follow the on-screen instructions to install the profile and complete enrollment.

Verify enrollment

1. Go to Devices.
2. Locate the newly enrolled device in the Site selected during enrollment.
3. Open the device card and verify the following: 
   • MDM Enrolled is Yes.
   • The expected Enrollment type is shown.
   • The expected supervision status is displayed in Ownership.

You can now manage the device using the supported Apple MDM policies and commands.

NOTE  If the device does not appear in Datto RMM, refer to Apple MDM in Datto RMM

Manually enroll an Apple device using USB and Apple Configurator

Use USB enrollment with Apple Configurator to manually enroll supervised iPhone and iPad devices in Datto RMM. This method is intended for organization-owned devices and provides additional management capabilities.

Prerequisites

Before you begin, verify the following: 

• An active APNs certificate is associated with the Site where the device will be enrolled.
• You have a Mac computer with Apple Configurator installed.
• You have physical access to the iPhone or iPad.
• The device is organization-owned and eligible for supervision.

NOTE  A Mac computer is required to run Apple Configurator, but Mac computers cannot be enrolled using the USB enrollment method.

Start USB enrollment in Datto RMM

1. Go to Devices > Add Device.
2. Select the Apple MDM tab.
3. Select a Site with an associated APNs certificate.
4. Select USB as the enrollment path.

   

5. Download and install Apple Configurator from the Mac App Store on the Mac you will use to prepare the iPhone or iPad.

Create a Wi-Fi profile

1. Open Apple Configurator on the Mac device you will use for USB enrollment.
2. In Apple Configurator's top navigation menu, click File > New Profile.

   

3. On the General tab, type a profile name in the Name field.

   

4. In the left navigation menu, select Wi-Fi, then click Configure.
5. Type the settings of the Wi-Fi network to which the device should connect.
6. Click File > Save and save the file in a location you can access in the next steps.

Create a blueprint

1. In Apple Configurator, select File > New Blueprint.

   

2. Type a name for the blueprint.
3. Select the blueprint you created, then click Add > Profiles.

   

4. Select the Wi-Fi profile you created and click Add.

Prepare the blueprint

1. Click the blueprint, then click Prepare.
2. In the Prepare Devices window, select Prepare with > Manual Configuration.
3. Confirm that the Supervise devices check box is selected.
4. Click Next.
5. On the Enroll in MDM screen, click Server > New Server, then click Next.
6. In Name, type a descriptive name for the Datto RMM MDM server.
7. In Host name or URL, type the enrollment URL displayed in the USB enrollment section of Datto RMM.

   

8. Click Next. Apple Configurator retrieves the required trust anchor certificates automatically.
9. If prompted, sign in to Apple Business or Apple School Manager according to your organization's device-management process.

Configure the organization and supervision identity

1. On the Create an organization screen, type the name of the organization with which this device will be associated, then click Next.
2. When prompted, select Generate a new supervision identity and click Next.

   IMPORTANT  Supervision enables additional Apple management capabilities on the device.

3. Configure the iOS Setup Assistant screens that you want users to see during setup.
4. Click Prepare.

   

Apply the blueprint to the device

1. Connect the iPhone or iPad to the Mac running Apple Configurator using a USB cable.
2. In Apple Configurator, select the connected device.

   NOTE  If the device does not appear in Apple Configurator, refer to Apple MDM in Datto RMM.

3. Right-click the device, select Apply, and choose the blueprint you created.

   

4. Click Apply and wait for Apple Configurator to complete the preparation process. This may take several minutes.

Complete device setup

1. Follow the on-screen setup instructions on the iPhone or iPad.
2. Complete any required setup steps and allow the device to connect to the internet.
3. Wait for the device to complete MDM enrollment.

Verify enrollment in Datto RMM

1. Go to Devices.
2. Locate the newly enrolled iPhone or iPad in the Site selected during enrollment.
3. Open the device card and verify the following: 
   • MDM Enrolled is Yes.
   • Enrollment type shows Manual.
   • The device is Supervised.

NOTE  If the device does not appear in Datto RMM, refer to Apple MDM in Datto RMM

Use Automated Device Enrollment

Automated Device Enrollment (ADE) automatically enrolls organization-owned Apple devices into Datto RMM during device setup.

Prerequisites

Before you begin: 

• Configure an active APNs certificate to connect DRMM to Apple services.
• Create an ADE token and connect it to Apple Business.
• Assign the Apple devices you want to manage to the corresponding Datto RMM MDM server in Apple Business.

How ADE works

After a device is assigned to the MDM server, it becomes visible in Datto RMM on Setup > Integrations > Apple MDM > Automated Device Enrollment > Devices.

Before activation, the device appears with Status = Unenrolled and is not visible in the standard Devices list.

When the device is powered on and completes setup, the status changes to reflect that it is enrolled into remote management and ready for management. After successful enrollment:

• Status changes to Enrolled.
• The device is enrolled in supervised mode.
• Assigned Apple MDM policies and payloads can be applied.
• Supported MDM commands become available.

NOTE  If a device was enrolled with a different method, it shows Enrolled with a yellow warning: "This device was not enrolled via its assigned ADE token. To apply ADE supervision, the device must be wiped and re-enrolled."

NOTE  ADE tokens are only valid for one year, and must be renewed periodically. Refer to Renew an ADE token.

Apple MDM brings managed Apple devices into Datto RMM alongside your other managed devices. You can view and manage macOS, iOS, and iPadOS devices using the same Sites, device views, filters, groups, and policy workflows used for other Datto RMM endpoints.

After a device is enrolled, use the Device card and the Devices page to review its MDM status, identify how it was enrolled, and manage the device.

View Apple MDM devices

Apple MDM devices appear in the standard Devices list.

• Use the standard Type and Operating System fields to identify the Apple device platform.
• Use filters and the column chooser to identify MDM devices and review their MDM-specific properties.

Device card MDM properties

Use the device card to access device management actions and review the current state of the device.

The Device card includes the standard Datto RMM device information together with MDM-specific information:

Supervision status

Apple devices can be Supervised or Unsupervised. Supervision affects which Apple MDM policies and commands are available. Refer to Supervised and unsupervised Apple devices.

Enrollment status

The enrollment status determines whether MDM management is available. When a device is enrolled, it can receive supported Apple MDM policies and commands. When a device is no longer enrolled, it remains visible in Datto RMM, but its MDM functionality is limited. Refer to the following table for details.

ADE devices before enrollment

Devices assigned through Apple Business appear in Setup > Integrations > Apple MDM > Automated Device Enrollment > Devices.

NOTE  Before an assigned device is activated and completes enrollment, it will not appear in the standard Devices list because it is not yet fully manageable through MDM.

Delete an Apple MDM device

Deleting an Apple MDM device from Datto RMM unenrolls the device, removes the management profile from the device, and releases Apps and Books licenses.

NOTE  Deleting the device from Datto RMM does not remove it from Apple Business or Apple School Manager. If it remains assigned to an ADE MDM server, it remains visible in the applicable Apple portal and in Datto RMM in Setup > Integrations > Apple MDM > Automated Device Enrollment > Devices.

Supervision is an Apple device-management state that provides organizations with additional management capabilities. Datto RMM supports both supervised and unsupervised Apple devices. The policy settings, applications, and commands available to a device depend on its Apple platform, operating-system version, enrollment method, and supervision status.

How devices become supervised

• Automated Device Enrollment: Eligible devices enrolled through ADE are supervised.
• USB with Apple Configurator: An iPhone or iPad is supervised when Supervise devices is selected during preparation.
• Other manual enrollment methods: Supervision depends on the Apple platform and enrollment workflow.
• Mac: Mac is supervised after every enrollment method: QR code, link, and Automated Device Enrollment.

For more information on enrollment methods, refer to Enroll Apple devices.

General capability differences

IMPORTANT  Exact capabilities vary by Apple platform, operating-system version, enrollment method, policy payload, and application source.

Supervision and MDM commands

Supervision enables additional Apple MDM commands, but supervision alone does not determine command availability.

Command availability also depends on the device platform, operating-system version, and enrollment method.

Refer to Run Apple MDM commands.

Check supervision status in Datto RMM

1. Open the Device card.
2. In Summary, review Ownership.

   

3. Alternatively, add Ownership to the Devices list using the column chooser.

NOTE  For Apple MDM devices, the Ownership field represents only supervision status. It does not indicate whether the device is legally company-owned or personally owned.

An MDM policy in Datto RMM is used to configure and manage enrolled Apple devices. Use MDM policies to configure Apple device settings such as networking, security, system behavior, and application restrictions. When a policy targets an enrolled Apple device, Datto RMM delivers the configured payloads through the Apple Push Notification Service.

An MDM policy defines which Apple devices should receive a configuration. A payload contains the Apple MDM settings to apply to those devices. A policy can contain multiple payloads. For example, one policy can contain network, security, and restriction payloads and target them to the same group of Apple devices.

Create an Apple MDM policy

1. Go to Policies.
2. Click Create Policy.
3. Type a Name for the policy.
4. Optionally type a Description.
5. Select the appropriate scope.

   NOTE  For more information about policy scope, refer to Scope.

6. In Type, select MDM.
   

NOTE  To edit an existing MDM policy, navigate to Policies > MDM and click the name of the policy to open it.

Add and configure payloads

1. Click Add Payload.
2. Search for a payload by payload name or property name, or browse the available payloads. Use the platform filters to identify payloads intended for macOS, iOS, or iPadOS.

   

3. Click Add next to the payload you want to use. The payload is added to the policy.

   NOTE  Some payloads support multiple configurations and can be added more than once.

4. Configure the available settings. Review any required fields and defaults.

   NOTE  Apple defines the payload settings and their platform availability. Use the Learn more link associated with a payload to review Apple's documentation for that configuration.

5. Repeat for each payload in the policy.

IMPORTANT  Some settings in a payload may require supervised devices. Review the setting platform, operating-system, and supervision requirements before adding it to the policy.

Target the policy to Apple devices

1. Scroll to Targets.
2. Click Add Target.
3. Select the required target type.
4. Select the Sites, groups, or filters that should receive the policy.
5. Save the target.

NOTE  For more information on policy targeting, refer to Targets.

Save the policy

1. Select one of the following:
   • Save and deploy now to save the policy and deploy it immediately.
   • Save and deploy later to save the policy, and defer deployment until later when the policy is recalculated. To learn how policy memberships get recalculated, refer to Policy membership recalculation.

Verify deployment

1. Open the device card for a targeted Apple device.
2. Open Activities and look for the MDM - Policy Processed event.
3. In the Activity Log, filter by the device and the MDM - Policy Processed event.
4. Verify that the settings defined in the policy payloads were applied successfully.

If the policy settings have still not applied to the device, refer to Apple MDM in Datto RMM

Apple MDM policies allow you to deploy and manage applications on supported iPhone, iPad, and Mac devices.

Datto RMM supports applications from the App Store, Apps and Books, and Custom Applications. The available deployment options and level of user interaction depend on the application source, device platform, enrollment method, and supervision status.

Choose an application source

NOTE  Devices are checked for uninstalled or out-of-date apps on a 24-hour cycle, so if a user manually uninstalls an app, it is reinstalled within a day. Automatic updates apply only to apps that have automatic update enabled.

Deploy an Apps and Books application

1. Create a new MDM policy, or edit an existing one. Refer to Create an Apple MDM policy.
2. In the MDM policy, click Add Payload and select Apps and Books Application.

   

3. Click Add.
4. Use the Connector drop-down to select your Apps and Books token.

   

5. Select an application from the Application drop-down.
6. Enter any application configuration settings in the Configuration field.

   NOTE  Refer to the application vendor's documentation for directions on configuring these settings in the proper format.

7. Select or clear the following options as needed:
   • Update the application to the latest version automatically: Keeps the app up to date on targeted devices.
   • Delete the app when the device is unenrolled from MDM: Removes the managed application from the device when MDM management is removed.
   • Prevent the backup of app data: Prevents the application's data from being included in device backups.
8. Click Add another Apps and Books Application to add another app configuration, and repeat for all apps you want to add to the policy.

Deploy an App Store application

1. Create a new MDM policy, or edit an existing one. Refer to Create an Apple MDM policy.
2. In the MDM policy, click Add Payload and select App Store.
3. Click Add.
4. Use the Country drop-down to select the country where the requested app resides.
5. Type in the Application field to search the App Store and click to select the application you want to configure.
6. Select or clear the following options as needed:
   • Automatically update application:  Keeps the application up to date on targeted devices.
   • Remove application when profile is removed:  Forces the application to be removed from any targeted devices if they are unenrolled from MDM.
   • Prevent backup:  Omits the app and app data from device backups.
7. Click Add and repeat for all apps you want to add to the policy.

Deploy a custom application

1. Create a new MDM policy, or edit an existing one. Refer to Create an Apple MDM policy.
2. In the MDM policy, click Add Payload and select Custom Applications.
3. Click Add.
4. In the File Link section, type the link to the application's PKG file and click Next. Datto RMM retrieves the application metadata and displays the Name, Bundle ID, and Version for confirmation.

   NOTE  If the link to the file is inaccessible or incorrectly formatted, you will receive a warning and will not be able to save the application.

5. If you want to define preconfigured settings during deployment, type those settings in the Configuration text box in plist format.
6. Select whether you want to delete the application when the device is unenrolled from MDM, whether you want to prevent the backup of application data, and confirm that you agree with the Kaseya Master Agreement.

   IMPORTANT  You must agree with the Kaseya Master Agreement to save a custom application.

7. Repeat for all custom applications you want to add.

Application installation behavior

When using the Apple MDM policy to deploy applications, different conditions will impact the installation process. Review the following table for details.

Application installation notes

• Supervised devices allow for background installation and management of apps without user interaction, but only for Apps and Books and previously installed App Store apps.
• Unsupervised devices require user approval for installation and management. Apps and Books apps benefit from silent installation when possible, avoiding App Store authentication.
• If an app is installed by a user, it can be managed automatically in supervised scenarios but requires user confirmation on Unsupervised devices. Full silent install is available only for Supervised devices with Apps and Books.

Run supported Apple MDM commands from the Device card in Datto RMM. Command availability depends on the device platform, enrollment method, and supervision status.

BEFORE YOU BEGIN  Verify that you have Sites > Devices = Manage permission to run commands on a device.

NOTE  MDM commands are available only for devices that are enrolled in MDM.

IMPORTANT  The device must have an internet connection to receive and process an MDM command. Wi-Fi and cellular connections are supported. An Apple ID or SIM card is not required for command delivery.

Command availability matrix

Run an MDM command

1. Open the device you want to manage.
2. On the Device card, click the three-dot menu in the device header.
3. In the MDM section, select the command you want to run.
4. Complete any additional fields required by the command.
5. Click Confirm.
6. Verify the result in the Activities section, or in the Activity Log.

   

NOTE  After you confirm a command, Datto RMM sends the request to Apple. Kaseya cannot guarantee how quickly a device will receive or execute a command.

Command details

Lock: Locks the device when the command is successfully delivered.

Lost Mode: Use when a supported iPhone or iPad is missing or suspected to be stolen. When activated, Lost Mode locks the device and can display a custom message and contact number on the lock screen.

Play Lost Mode Sound: Available when the device is in Lost Mode. Plays a sound on the device to help locate it.

Erase: Returns the device to its initial setup state and removes the MDM profile. Any data that has not been backed up may be lost. After an erase, the device must complete the applicable enrollment process before it can be managed again.

IMPORTANT  Erase permanently removes data from the device.

View command history

MDM command activity is recorded in the Activity Log. Use the device name, Site, and date range filters to locate the relevant activity. Use the following action filters:

• MDM Command Queued: Datto RMM accepted the command and queued it for delivery.
• MDM Command Processed: MDM service processed the command request.

NOTE  MDM commands are asynchronous. After you confirm a command, Datto RMM sends the request to Apple, but delivery to the device may be delayed. The command may remain queued while Apple attempts to deliver it. Refer to Apple MDM in Datto RMM

Apple MDM certificates and tokens expire and must be renewed to maintain device communication, automated enrollment, and managed application deployment. Review integration expiration dates regularly and complete renewal before an integration expires.

IMPORTANT  Do not delete the existing integration as part of renewal. Renew or replace the certificate or token associated with the existing integration.

Integration maintenance overview

Renew an APNs certificate

Renew an APNs certificate before it expires to maintain communication between Datto RMM and enrolled Apple devices. Use the same organization-controlled Apple account that was used to create the existing certificate.

IMPORTANT  Renew the existing certificate in the Apple Push Certificates Portal. Do not create an unrelated APNs certificate as part of the renewal workflow.

1. Go to Setup > Integrations > Apple MDM > APNs.
2. Locate the certificate you want to renew and click it to edit.
3. Click Download CSR. Datto RMM downloads a Certificate Signing Request file.
4. Click Go to Apple Portal.
5. Sign in to the Apple Push Certificates Portal with the Apple account used to create the existing certificate.
6. Locate the existing APNs certificate and select Renew.
7. Upload the CSR generated by Datto RMM.
8. Download the renewed APNs certificate.
9. Return to Datto RMM.
10. Upload the renewed certificate.
11. Click Save.

After saving, confirm that Status is Active, Expiration shows the new expiration date, Apple ID identifies the account used to maintain the certificate, Scope still includes the expected Sites, and existing managed-device associations remain available.

Renew an Automated Device Enrollment token

Automated Device Enrollment service tokens expire after one year and must be replaced. Renew the token before expiration to maintain synchronization between Datto RMM and Apple Business or Apple School Manager.

1. Go to Setup > Integrations > Apple MDM > Automated Device Enrollment.
2. Locate the ADE token you want to renew and click it to edit.
3. Open Apple Business or Apple School Manager.
4. Locate the existing MDM server associated with the Datto RMM ADE token.
5. Download a new MDM server token for the existing server.
6. Return to Datto RMM.
7. In Upload Server Token, upload the .p7m file downloaded from Apple.
8. Complete the renewal.

After saving, confirm that Status is Active, Expiration shows the new expiration date, Enrollment Site is unchanged, the expected APNs certificate remains associated, and the existing device count and MDM server association remain available.

If ADE devices no longer synchronize after renewal, refer to Apple MDM in Datto RMM

IMPORTANT  If the Apple account used to download the service token changes its password, or if the account owner leaves the organization, replace the token promptly.

Renew an Apps and Books token

Apps and Books content tokens expire after one year. A content token also becomes invalid if the password changes for the Managed Apple Account used to download it. Renew the token before expiration to avoid interruption to application-license synchronization and assignment.

1. Go to Setup > Integrations > Apple MDM > Apps and Books.
2. Locate the token you want to renew and click it to edit.
3. Open Apple Business or Apple School Manager.
4. Go to Settings > Payments & Billing > Apps and Books.
5. Locate the same organizational unit or location represented by the existing Datto RMM token.
6. Download a new content token.
7. Return to Datto RMM.
8. In Upload Content Token, upload the .vpptoken file downloaded from Apple.
9. Click Save.

After saving, confirm that Status is Active, Expiration shows the new expiration date, Name identifies the expected customer and Apple content scope, Apple ID identifies the account responsible for maintaining the token, and existing application assignments remain available.

If applications no longer appear after renewing your Apps and Books token, refer to Apple MDM in Datto RMM

Upload the file that matches the integration type: the certificate file for APNs, a .p7m file for the ADE token, or a .vpptoken file for the Apps and Books token.

Also confirm that the file belongs to the existing integration being renewed, not a newly created one. Uploading the wrong file type or a file from a different integration prevents the renewal from completing successfully.

Confirm that the device is powered on, is connected with a USB cable that supports data transfer, and that Apple Configurator is running on the Mac.

When manually enrolling devices via USB, using the appropriate USB cable is key. Test data transfer functionality and test with multiple devices to troubleshoot effectively.

Confirm that the correct Site was selected, that the Site has an associated APNs certificate, that the enrollment process was fully completed on the device, and that the device has an internet connection.

For ADE devices, note that a device assigned to the MDM server appears on the Setup > Integrations > Apple MDM > Automated Device Enrollment > Devices page but does not appear in the standard Devices list until it is powered on and completes setup.

Confirm that the device is enrolled in MDM, that the device platform and enrollment method support the command, and that the device has the required supervision status.

Command availability also depends on the device's operating-system version. Review the command availability matrix to confirm whether the command is supported for the device's platform and supervision state.

If the command remains queued, verify that the device is powered on and connected to the internet. Commands may remain queued until Apple can communicate with the device.

If the command timed out, check the Activity Log for the command event, then verify the device's current enrollment and connectivity status. If the command is still queued, wait for the device to reconnect before retrying. Repeatedly sending the same command may create additional queued requests.

Confirm that the renewed token represents the same Apple organizational unit or location, that the application licenses remain in that content scope, that the token status is Active, and that application and license synchronization has completed.

Synchronization runs after the token is saved and may take a few minutes. If applications still do not appear after synchronization completes, confirm that the required applications have been acquired in the Apple content scope represented by the token.

Confirm that the renewed token belongs to the existing MDM server, that the token was uploaded to the correct Datto RMM ADE integration, and that the MDM server still has devices assigned to it in Apple Business or Apple School Manager.

Synchronization runs after the token is saved and may take a few minutes.

Confirm that the device is enrolled in MDM, that the device matches the policy target, that the policy is active, and that the device has the supervision status required by the payload.

Also confirm that the device can communicate with Apple's MDM service. If the policy was processed but the setting was not applied, verify that the device supports the payload and that the configured setting is supported by the device's operating-system version.