Apple Business — Automated Device Enrollment (Working Draft)

Doc 2 of 3 — org-owned devices set up through Setup Assistant

Guide set — Apple Business device management. You are here: Doc 2. Three enrollment guides plus a hands-on Apple Configurator companion:

Account-Driven Enrollment — BYOD + OOD — enroll a device already in use, from Settings.

Automated Device Enrollment (this doc) — new or erased org devices via Setup Assistant.

Lifecycle & Offboarding — un-enroll, release, transfer, erase/reassign.

Companion: Manual Add with Apple Configurator — step-by-step On-ramp 2 drill-down that feeds this doc.

Scope: This doc covers Automated Device Enrollment (ADE) — the method for organization- owned devices that are new or erased and configured from the moment they're turned on, during Setup Assistant. It has two forks: a Blueprint assigned to a user/user group, and a Blueprint assigned to a device by serial number (for shared or dedicated devices).

Part of the three-document set: 1. Account-driven enrollment — BYOD + OOD — devices already in use, enrolled from Settings. 2. Automated Device Enrollment (this doc) 3. Device lifecycle & offboarding — un-enroll, release, transfer, MDM migration, Activation Lock, erase/reassign.

Status: draft from Apple's official docs (Apple Business User Guide, "Enrollment methods for built-in device management," April 14, 2026). To be corrected against David's real walkthrough — items needing confirmation are flagged inline.

⚠️ Terminology reminder (we diverge from Apple)

As in Doc 1, we organize by ownership/use, while Apple organizes by method. For this doc:

Our term	What it means	Apple's term
OOD (new/erased)	Org-Owned Device set up fresh through Setup Assistant, assigned to a user	Automated Device Enrollment (Blueprint → user)
Shared / Dedicated device	Org device managed as a unit by serial number, often no per-user account	Automated Device Enrollment (Blueprint → device by serial)

Both are the same Apple method (Automated Device Enrollment) — they fork on whether the Blueprint targets a user or a device serial number.

When to use Automated Device Enrollment

Use ADE when the device is organization-owned and either new or erased, and you want the highest level of control. ADE devices are supervised, which is what unlocks the strongest management (remote erase, Activation Lock control, more restrictions) referenced in Doc 1's ownership cascade.

Fully managed, assigned to a person → Blueprint to user or user group. The Managed Apple Account the user signs in with during Setup Assistant becomes the only iCloud account on the device.
Shared or single-function (kiosk, point-of-sale, loaner, signage) → Blueprint to device by serial number. No Managed Apple Account required.

Important contrast with Doc 1: ADE does not provide work/personal data separation — regardless of Blueprint assignment. If you need a personal Apple Account alongside organizational management on an org-owned device, use Account-driven Device Enrollment (Doc 1) instead.

⚠️ Clearing up the name — "Automated" is the enrollment method, not how the device arrived

A common misconception is that Automated Device Enrollment only works for devices you bought new that landed in Apple Business automatically. Not so. "Automated" describes the enrollment method — the device configures itself during Setup Assistant — not how the device got into your inventory.

A device reaches Automated Device Enrollment by either of two on-ramps, and from there the process is essentially the same:

On-ramp 1 — Purchased / supplied. You bought it through Apple or a linked reseller, so it appears in Apple Business automatically.
On-ramp 2 — Added with Apple Configurator. A used or existing device that isn't in your inventory is manually added to Apple Business using Apple Configurator — a Mac app that needs a current macOS (full steps in the companion guide). Once it's in and assigned to the management service, it uses the same Automated Device Enrollment Setup Assistant flow.

So "I didn't buy this phone through Apple" does not rule out Automated Device Enrollment — it just means you take On-ramp 2 to bring the device into Apple Business first.

⚠️ Two things differ for Configurator-added (On-ramp 2) devices: - 30-day provisional period: after the device is assigned and enrolled, the user can release it from Apple Business, supervision, and management within 30 days. Purchased devices have no such provisional escape hatch. - Order matters: do not proceed through Setup Assistant until the device has been assigned to the management service — otherwise it won't pick up Automated Device Enrollment.

The shared start → the divergence

Every ADE device follows the same arc — appear in Apple Business → assigned to the management service → configured during Setup Assistant — and forks on who the Blueprint targets.

Part A — Get the device into Apple Business (two on-ramps), then assign it to management

On-ramp 1 — Purchased / supplied devices

Link your Apple Customer Number or Reseller Number to Apple Business (Devices > Manage device suppliers). Devices you buy then appear in inventory automatically.

On-ramp 2 — Used / existing devices not yet in inventory

Add the device with Apple Configurator — connect it to a Mac running Apple Configurator and add it to Apple Business.
Remember the 30-day provisional period, and don't run Setup Assistant on the device until it's been assigned to the management service (next step).

Then, for either on-ramp

Assign the device to the Apple Business device management service (see the Device workflow). Once assigned, it's ready for the same Setup Assistant flow in Part C.

Part B — Assign the Blueprint (this is the fork)

Fork 1 — Blueprint to a user or user group. Assign the Blueprint (e.g., Staff BYOD's org-owned equivalent) to the user/group. Apps are delivered in the Apple Business app.
Fork 2 — Blueprint to a device by serial number. Assign the Blueprint directly to the device serial. Assigned apps download to the device immediately. No Managed Apple Account needed.

Part C — User/device: Setup Assistant

The device is connected to the internet and powered on.
On iPhone, iPad, and Mac, a user completes Setup Assistant. (Apple TV completes Setup Assistant automatically.)
The user signs in during Setup Assistant with their Managed Apple Account (Fork 1). - For Fork 2 (device by serial), no Managed Apple Account sign-in is required; the device is managed as a unit. A user may optionally sign in with a personal Apple Account afterward in Settings.

When Setup Assistant completes, the device is supervised and fully managed, with settings and assigned apps applied.

After enrollment

	Fork 1 — Blueprint to user	Fork 2 — Blueprint to device (serial)
Apple Business app installed	Yes (not on Apple TV)	Yes (not on Apple TV)
Assigned apps	In the Apple Business app	Download immediately to the device
Settings/Blueprint applied	Yes	Yes
Supervised	Yes	Yes
Managed Apple Account	Required	Not required
Personal Apple Account	Not permitted	Optional (sign in later in Settings)
Personal Apple Account iCloud storage	Unavailable	Optional
Org Managed Apple Account iCloud storage	Available (not Apple TV)	n/a unless a Managed account is used
Work/personal data separation	No	No

For tighter control over data flows on a device-by-serial deployment, an org can upload custom configuration profiles to supplement the built-in controls.

Reusing an org-owned device — erase & re-prepare with Apple Configurator

Because ADE devices are organization-owned and supervised, they can be wiped and redeployed when an employee leaves or the device is reassigned. There are two erase paths:

Remotely from Apple Business — issue a remote erase (see Doc 3 for offboarding) when you don't have the device in hand.
Locally with Apple Configurator — the hands-on method when the device is returned to IT.

Local erase & re-prepare (Apple Configurator on a Mac):

Recover any needed data first. Erasing is destructive — retrieve the user's business data before wiping (see Doc 3 → data recovery).
Connect the device to a Mac running Apple Configurator.
Actions > Advanced > Erase All Content and Settings (this wipes the device and unsupervises it).
Use the Prepare Assistant to re-prepare: add the device to Apple Business, supervise it, assign it to the organization, and complete enrollment.
Reassign the Blueprint to the next user/user group (or to the device serial for a shared/ dedicated role).

⚠️ Activation Lock: make sure Activation Lock is cleared before/with the erase, or the device can't be set up as new. Org-owned devices support remote Activation Lock bypass — see Doc 3.

⚠️ To validate: the exact Configurator menu path and Prepare Assistant options on the current version, plus whether a remote erase from Apple Business fully releases supervision the same way.

How ADE differs from account-driven enrollment (Doc 1) at a glance

	ADE (Doc 2)	Account-driven (Doc 1)
Device state	New or erased	Already in use
Where it happens	Setup Assistant	Settings (sign in)
Supervised	Yes	BYOD: no · OOD: Mac yes / iPhone-iPad no
Data separation	No	Yes (BYOD + OOD)
Prerequisite	Device in ABM via Customer/Reseller # (or Configurator)	None beyond a Managed Apple Account

How to add a device with Apple Configurator — On-ramp 2

📄 Full drill-down lives in its own guide. The complete, screenshot-by-screenshot Configurator → Apple Business manual-add procedure — including the Prepare wizard, the ABM assignment dialogs, the Blueprint-by-serial step, the WiFi/Remote-Management gotchas, and troubleshooting — is maintained as a separate companion document so it stays deep without bloating this one:

→ "ABM Manual Add — Apple Configurator to ABM" (verified end-to-end on a real device, June 30, 2026).

The short version (how On-ramp 2 feeds back into this doc's ADE flow):

Apple Configurator (Mac): Prepare > Manual Configuration > Add to Apple Business, leave "Activate and Complete Enrollment" unchecked → the device lands in Apple Business in a "Devices Added by Apple Configurator" group, parked at Setup Assistant.
Apple Business (web): open the device > Assign Device Management > pick your management service > confirm.
From here it's the same Automated Device Enrollment flow as the rest of this doc — assign the Blueprint (Part B) and complete Setup Assistant (Part C).

⚠️ Critical ordering: don't run Setup Assistant on the device until it's assigned to the management service and on a Blueprint — otherwise it won't pick up its configuration. Also note the 30-day provisional period for Configurator-added devices.

macOS requirement: Apple Configurator runs only on a Mac (2.20 needs macOS 15.7+, 2.19 needs 15.6+) and configures iPhone/iPad/Apple TV. To add a Mac to Apple Business, use Apple Configurator on iPhone instead.

See the companion guide for every step, the screenshots, and the WiFi/Remote-Management troubleshooting. Official Apple how-to: Add devices to Apple School Manager or Apple Business Manager in Apple Configurator

✅ Verified

Confirmed during the live Configurator → Built-in → Blueprint-by-serial run on June 30, 2026 (see the companion ABM Manual Add guide), plus existing production use: - [x] On-ramp 2 — adding a used device via Apple Configurator works end-to-end. - [x] Assign to management service — the control is Assign Device Management (confirmed from the ABM screenshots). - [x] Configurator erase path for reuse — Erase All Content & Settings re-runs Setup Assistant while the serial stays enrolled (no full re-Prepare needed). - [x] Part A→C of the ADE flow — assign service → Blueprint (by serial) → Setup Assistant pulls the config — proven on the test iPhone. - [x] 30-day provisional period — the provisional/release warning appeared on the device during setup, confirming Configurator-added devices carry it. - [x] Manage device suppliers (On-ramp 1) — Apple Business > Devices > Manage device suppliers (link Apple Customer/Reseller number); in routine production use for years. Proven.

Open items to resolve before publishing

[ ] Decide whether shared/dedicated (Fork 2) deserves its own short companion sheet.
[ ] Cross-link finalized Doc 1 and Doc 3.