Manage devices with Apple Configurator

Highlight

Apple has expanded Apple Configurator: it can restore or rescue Apple silicon and T2 Macs, and add unofficial Macs to Apple Business Manager or Apple School Manager via iPhone in iOS 15.

Core Content

When a school or company purchases a Mac, ideally the device comes from Apple, an authorized reseller, or a carrier. Such a Mac can be directly assigned to Apple Business Manager (Apple Business Management) or Apple School Manager (Apple Campus Education Management), enter Automated Device Enrollment after booting, and then connect to the MDM (Mobile Device Management) server.

Reality is often not so tidy. Equipment may come from regular retail channels or may be temporarily replenished. As long as it’s not assigned to an organization, the organization’s MDM enrollment process won’t appear in the Setup Assistant. IT administrators are left to do this manually, which slows down batch deployments.

Apple Configurator has been able to add iPhones, iPads, and Apple TVs to organizations in the past. The change at WWDC 2021 is that Macs are also entering the process. Apple launches Apple Configurator for iPhone. Administrators can assign Macs to organizations by scanning the animation in the Mac Setup Assistant with their iPhone.

This session also talked about another on-site rescue scenario: Mac cannot start after the update is interrupted. For Apple silicon Macs and T2 Macs, Configurator can perform Revive, update firmware and recoveryOS, and preserve user data. When ready for use by a new user, perform a Restore to erase user data and update the system recovery environment.

Mac Repair: The Boundary Between Restore and Revive

Restore is used to redeliver the device. It restores the firmware, updates recoveryOS, and erases all user data. Apple silicon Macs also reinstall the latest version of macOS.

Revive is used in scenarios where the device cannot be started but data needs to be retained. It updates firmware and recoveryOS without erasing user data. A classic example is a MacBook Pro that ran out of battery during a software update.

Mac Inbound: Supplementing Automatic Device Registration with iPhone

The key to organizing and managing Macs is not the step of installing applications, but whether the device belongs to the organization. Macs can automatically enroll in MDM in the Setup Assistant only if they are assigned to Apple Business Manager or Apple School Manager.

Apple Configurator for iPhone solves this entry problem. The administrator logs in with a Managed Apple ID with device registration administrator rights, approaches the device in the Mac country-selecting interface, and scans the animation with the iPhone camera. Once paired, your Mac will receive the information it needs to join the organization.

After joining the organization, you also need to move this Mac from the Apple Configurator 2 MDM server to the real MDM server in Apple Business Manager or Apple School Manager. The next time you restart, your Mac downloads new automatic device enrollment settings and completes enrollment as configured by your organization.

Detailed Content

Restore: Prepare your Mac for the next user

(01:39) Apple Configurator supports two types of Mac repair actions. Restore is geared toward redelivery. After performing a Restore on an Apple silicon Mac, the latest macOS will be reinstalled; on a T2 Mac, the firmware will be restored, and macOS can then be reinstalled via Internet recovery.

Restore workflow
1. Connect the Mac to the correct port.
2. Select the Mac in Apple Configurator.
3. Choose Restore.
4. Wait for firmware and recoveryOS to update.
5. For Apple silicon, install the latest macOS automatically.
6. Hand the Mac to the next user.

Key points:

• Line 1: Connection port is a prerequisite. Apple emphasized in its presentation that the correct ports are different for MacBook Air, Mac mini, MacBook Pro and T2 Macs.
• Line 2: Configurator operates device-centric, selecting the target Mac first.
• Line 3: Restore is used to prepare new users and is not suitable for maintenance that retains the original user data.
• Line 4: Restore will update firmware and recoveryOS.
• Line 5: Apple silicon Macs will reinstall the latest version of macOS.
• Line 6: The device is back in a deliverable state and user data has been wiped.

Revive: Mac rescue that preserves user data

(02:01) Revive is used in scenarios where the Mac cannot boot but user data still needs to be retained. The example given in the talk was a MacBook Pro running out of battery during a software update. The administrator selects the device in the Configurator and selects Revive from the Advanced Actions menu.

Revive workflow
1. Connect the affected Mac to the correct port.
2. Select the Mac in Apple Configurator.
3. Open Advanced Actions.
4. Choose Revive.
5. Update firmware and recoveryOS.
6. Keep user data in place.

Key points:

• Line 1: Revive, like Restore, relies on the correct port.
• Line 2: The target device must be visible in the Configurator.
• Line 3: Revive is in the Advanced Actions menu.
• Line 4: This action is aimed at restoring the bootable state.
• Line 5: The system updates firmware and recoveryOS.
• Line 6: A core boundary of Revive is preserving user data.

Automatic device registration: Organizational ownership determines subsequent management capabilities

(04:05) Macs purchased from Apple, an authorized reseller, or a carrier can be assigned to an organization. Once assigned, automatic device enrollment embeds the MDM enrollment process into the macOS Setup Assistant. With AutoAdvance, your Mac can be configured contactlessly as soon as it’s connected to power and Ethernet.

Automated Device Enrollment path
1. Mac is assigned to the organization.
2. Mac starts Setup Assistant.
3. Setup Assistant enrolls the Mac into the MDM solution.
4. MDM applies the organization configuration.
5. Mac is ready for an employee or a student.

Key points:

• Line 1: The device must first belong to an organization in Apple Business Manager or Apple School Manager.
• Line 2: The user sees the native flow in the System Setup Assistant.
• Line 3: The registration action connects to the organization’s MDM scheme.
• Line 4: The configuration is issued by the MDM server.
• Line 5: Once the device is set up it is ready to be handed over to the employee or student.

Apple Configurator for iPhone: Scan animation completes Mac assignment

(05:41) Apple Configurator for iPhone lets administrators provision Macs without wires. The prerequisite is that you use a Managed Apple ID to log in, and this account has at least the device registration administrator role. The actual action happens when the Mac Setup Assistant selects a country or region.

Configurator for iPhone assignment
1. Sign in with a Managed Apple ID.
2. Confirm the account has the Device Enrollment Manager role.
3. Start the Mac and select the language.
4. Stop at the country or region screen.
5. Bring the iPhone running Configurator near the Mac.
6. Center the animation in the iPhone camera viewfinder.
7. Wait for "Paired Successfully".
8. Let Configurator send the required organization assignment information.

Key points:

• Line 1: The login account must be a Managed Apple ID.
• Line 2: Permissions require at least Device Enrollment Administrator role.
• Line 3: The Mac starts the assignment process with the Setup Assistant.
• Line 4: The trigger point is the country or region selection screen.
• Row 5: iPhone to Mac close-range pairing, no cables required.
• Line 6: The camera scans the animation that appears on your Mac.
• Line 7: When pairing is successful, your Mac displays a success message.
• Line 8: Configurator sends the Mac the information needed to join the organization.

Wi-Fi Configuration: Using iPhone Network or Configuration Profile

(06:21) The Settings button of Configurator for iPhone is used to select the Mac network connection method. You can continue directly when your Mac is connected to Ethernet. Without Ethernet, the easiest thing to do is to share the Wi-Fi your iPhone is currently connected to. If the network cannot be shared, you can select a configuration profile with a Wi-Fi payload.

Network configuration options
1. If Ethernet is connected, use Ethernet.
2. Else, try sharing the iPhone current Wi-Fi network.
3. If that network is not shareable, choose a configuration profile.
4. Make sure the profile contains the Wi-Fi payload for the Mac.

Key points:

• Line 1: When connected to Ethernet, the Mac is ready for networking.
• Line 2: Configurator can share the iPhone’s current Wi-Fi.
• Line 3: Part of the network cannot be shared and an alternative is needed.
• Line 4: The alternative is a configuration description file containing the Wi-Fi payload.

Post-assignment: Move Mac to correct MDM server

(07:51) Mac joining the organization is just the first step. Next, log in to Apple Business Manager or Apple School Manager and move the newly assigned Mac from the Apple Configurator 2 MDM server to the MDM server responsible for issuing automatic device registration settings. The next time your Mac restarts, it will download the new enrollment settings and complete the MDM enrollment.

Post-assignment steps
1. Sign in to Apple Business Manager or Apple School Manager.
2. Find the newly assigned Mac.
3. Move it from Apple Configurator 2 MDM server.
4. Select the MDM server that has the correct automated device enrollment settings.
5. Restart the Mac.
6. Let the Mac download enrollment settings and enroll itself.

Key points:

• Line 1: Subsequent management is done in Apple Business Manager or Apple School Manager.
• Line 2: The target is a Mac that was just assigned via iPhone.
• Line 3: The new device appears first under the Apple Configurator 2 MDM server.
• Line 4: To move to the MDM server that actually hosts the organization’s configuration.
• Line 5: The next reboot will trigger a download of new settings.
• Line 6: The Mac completes automatic device registration with the specified settings.

30-day temporary period: User can release newly allocated Mac

(08:40) Macs allocated through this feature have a 30-day provisional period. If the user logs out of MDM during this time, the Mac is released from the organization. This is the same as for iOS devices.

Provisional period rule
1. Assign the Mac with Apple Configurator for iPhone.
2. Start the 30-day provisional period.
3. If the user unenrolls from MDM during this period, release the Mac from the organization.
4. If the period passes, keep the Mac assigned to the organization.

Key points:

• Line 1: The rule applies to Macs assigned through iPhone Configurator.
• Line 2: The interim period length is 30 days.
• Line 3: Logging out of MDM during the temporary period releases the organization assignment.
• Line 4: The speech only states the release behavior during the interim period, and these 30 days should be included in the delivery process when deploying.

Core Takeaways

1. What to do: Create a Mac rescue ledger to record every Restore or Revive. Why it’s worth doing: Configurator already covers the recovery and rescue of Apple silicon and T2 Mac. The IT team can handle the two scenarios of failure to start and preparation for transfer separately. How ​​to start: Use the Restore and Revive operations of Apple Configurator as the entry point to forcefully record the device model, port used, action type and whether to retain data in the internal work order.

2. What to do: Add a warehousing process to the unofficial channel Mac. Why it’s worth doing: Apple Configurator for iPhone can assign this type of Mac to Apple Business Manager or Apple School Manager to complete the automatic device registration entry. How ​​to get started: Prepare a Managed Apple ID with the Device Enrollment Administrator role, and use iPhone Configurator to scan the pairing animation when selecting a country or region in the Mac Setup Assistant.

3. What to do: Prepare a dedicated Wi-Fi profile for bulk Mac deployment. Why it’s worth doing: Some Wi-Fi networks cannot be shared from iPhone, and the talk clearly gives an alternative path for configuration profile + Wi-Fi payload. How ​​to start: Test the network configuration in Settings of Apple Configurator for iPhone, and prepare a configuration description file containing only the Wi-Fi payload for the non-shareable network.

4. What to do: Make “Migrate to the correct MDM server” an entry check item. Why it’s worth doing: After the Mac is assigned through the iPhone, it will first appear under the Apple Configurator 2 MDM server. If you don’t move it, you won’t get the correct automatic device registration settings. How ​​to get started: Set up in Apple Business Manager or Apple School Manager. Steps: Find new Mac, move to target MDM server, restart to verify registration.

5. What to do: Set a delivery reminder for the 30-day interim period. Why it’s worth doing: Users logging out of MDM during the temporary period will release the Mac’s organizational allocation and affect subsequent management capabilities. How ​​to get started: Create a 30-day check task on the day the device is delivered, confirm that the device is still enrolled in MDM, and retain a record of the assignment in Apple Business Manager or Apple School Manager.

Related Sessions

• What’s new in managing Apple devices — Learn about the annual update to device management for iOS 15, iPadOS 15, and macOS Monterey.
• Meet declarative device management — Continue to learn how declarative device management allows devices to actively maintain their own state.
• Manage software updates in your organization — Supplementary learning about software update deferral, deployment, and enforcement in managed environments.
• Discover account-driven User Enrollment — Learn about User Enrollment and Managed Apple ID in BYOD scenarios.
• Improve MDM assignment of Apps and Books — Learn how the Apps and Books Management API assigns apps and books owned by your organization.