The Apple Device Enrollment Program (DEP) was Apple's original zero-touch enrollment service that let organizations automatically configure iPhones, iPads, and Macs during initial setup. Apple deprecated DEP in December 2019 and folded its functionality into Apple Business Manager (ABM). The feature is now called Automated Device Enrollment (ADE). If you purchased Apple devices through an authorized reseller or Apple directly, ADE lets your MDM server push profiles, apps, and security policies to each device the moment the user powers it on, with no manual configuration required.
What did DEP do?
DEP handled three things that mattered for IT teams managing Apple fleets:
- Zero-touch provisioning. Devices shipped directly from Apple or a reseller arrived pre-assigned to your MDM. The user powered on, connected to Wi-Fi, and the MDM profile installed automatically during Setup Assistant.
- Supervised mode activation. DEP-enrolled devices could be placed in supervised mode from day one, unlocking restrictions that unsupervised devices cannot enforce (single app mode, content filtering, preventing MDM profile removal).
- Mandatory enrollment. Unlike manual enrollment, DEP enrollment could not be skipped or removed by the user, ensuring corporate control from first boot to decommission.
At its peak, DEP supported iOS, macOS, and tvOS devices. Apple never extended it to watchOS.
What replaced DEP?
Apple Business Manager (ABM) replaced DEP in late 2019. ABM is a web portal that combines three previously separate programs into one:
| Old program | What it did | ABM equivalent |
|---|---|---|
| Device Enrollment Program (DEP) | Zero-touch device assignment to MDM | Automated Device Enrollment (ADE) |
| Volume Purchase Program (VPP) | Bulk app and book licensing | Apps and Books |
| Apple School Manager (schools only) | Education-specific device and account management | Still separate, but shares the same backend |
The enrollment workflow is identical: your authorized Apple reseller links device serial numbers to your ABM account, you assign those serials to your MDM server, and the device auto-enrolls at first power-on. The only change is where you do it (ABM web portal at business.apple.com) and what it is called (ADE instead of DEP).
How to set up Automated Device Enrollment today
If you are migrating from the old DEP portal or setting up enrollment for the first time, here is the process: For Apple-specific setup, see our Apple MDM guide.
- Create an ABM account at business.apple.com. You need a D-U-N-S number and a corporate Apple Account (not a personal one).
- Connect your MDM server. In ABM, go to Settings > MDM Servers, add your MDM (for example, Appaloosa), and upload the public key your MDM provides.
- Assign devices. Once your reseller links serial numbers to your ABM account, assign them to the MDM server. You can set a default server so every new purchase auto-assigns.
- Configure enrollment profiles. In your MDM, create the enrollment profile: which Setup Assistant steps to skip, whether to enforce supervision, which Wi-Fi and VPN settings to push.
- Ship and power on. The user opens the box, connects to a network, and the MDM profile installs during Setup Assistant. No IT intervention needed.
The entire setup takes 15 to 30 minutes for the IT admin. Each device enrolls in under 2 minutes at first boot.
DEP vs. ADE: what actually changed?
For most IT teams, nothing changed in practice. The enrollment protocol, the MDM integration, and the supervised mode behavior are the same. Here is what did change:
- Portal consolidation. DEP had its own portal (deploy.apple.com). ADE lives inside Apple Business Manager, alongside app licensing and Managed Apple Accounts.
- Managed Apple Accounts. ABM introduced federated authentication with Azure AD and Google Workspace for corporate Apple Accounts, something the old DEP portal could not do.
- Role-based access. ABM supports granular admin roles (Device Manager, Content Manager, People Manager). The old DEP portal had a flat admin model.
If your MDM already supported DEP, it supports ADE. No migration is required on the MDM side. You only need to sign in to ABM instead of the old DEP portal.
Requirements for Automated Device Enrollment
Before you can enroll devices via ADE, you need four things in place:
| Requirement | Details |
|---|---|
| Apple Business Manager account | Requires a D-U-N-S number and a corporate domain. Approval takes 1 to 5 business days. |
| MDM server connected to ABM | Your MDM (Appaloosa, Jamf, Intune, etc.) must be registered as a server in ABM with a valid server token. |
| Devices purchased through an authorized channel | Devices must be bought from Apple directly or from an Apple Authorized Reseller. Devices bought from retail stores or second-hand cannot be enrolled via ADE (use manual MDM enrollment instead). |
| Network access during setup | The device needs Wi-Fi or Ethernet (via USB-C adapter) during Setup Assistant to contact Apple's activation servers and download the MDM profile. |
Apple Configurator 2 (macOS only) can add devices to ABM manually if they were not originally purchased through an authorized channel. This is useful for devices already in your inventory that predate your ABM account.
Getting Devices Into Apple Business Manager
ADE only works on devices Apple recognises as yours. There are three ways to establish that link, and they depend on where the hardware came from.
Bought directly from Apple
Purchasing directly gives your organisation an Apple Customer Number. Add it in Apple Business Manager under Device Management Settings, and every future order lands in your account automatically.
Bought from a reseller or carrier
Give the reseller your Organization ID and ask them for their Reseller ID. Both go into Apple Business Manager. Do this before the order ships: retrofitting is possible but slower.
Devices you already own
Hardware bought before you set ABM up, or donated hardware, can still be added with Apple Configurator 2 over USB. If the devices came from a reseller, asking them for late enrollment is usually simpler than configuring each unit by hand.
Eligibility in short
- iOS 7 and above, or macOS 10.9 and above.
- Purchased through Apple, an authorised reseller or a carrier, or added manually with Apple Configurator 2.
- An Apple Push Certificate on the MDM side, which requires an Apple Account. A Managed Apple Account is the recommended option for an organisation, so that the certificate does not depend on one employee.
Why ADE rather than manual enrollment
- Setup collapses to almost nothing. The device configures itself out of the box, with no admin handling it first.
- Supervision. ADE is the path to supervised mode, which unlocks the stronger restrictions and stops a user from removing the management profile.
- Enrollment stays locked. A wiped device re-enrolls on the next boot instead of leaving the fleet.
Supervision is for corporate-owned hardware. A personal iPhone enrolled under BYOD is not supervised, and the restrictions that depend on supervision are simply unavailable there.
What the End User Sees
How should users configure their devices?
Your users will receive an Apple device that works out-of-the-box. However they will need to connect the device at least once to internet.
- Ask the user to unpack the device
- Connect the device to the Internet.
- The device asks Apple if anyone has it. Apple checks ABM and confirms that your company owns the device.
- The device then communicates with the company's mobile device management server and starts receiving instructions.
From the moment the automated device enrollment recognises a new device, it acts immediately and automatically on it. If you have configured software to be installed on the mobile device, the installation will be done automatically. Security settings will also be applied.
By acting quickly, ADE allows users to be operational immediately.
Once the device is configured, users really don't have to do anything else but use the device. For any changes or updates to be made to the mobile device, the technical department takes care of the operations remotely.
Troubleshooting common ADE enrollment issues
Most ADE enrollment problems fall into three categories.
Device not appearing in ABM. The reseller has not linked the serial number to your ABM account yet. Contact your reseller and provide your ABM Organization ID. New purchases typically appear within 24 to 48 hours.
Enrollment profile not installing during Setup Assistant. Check that the device serial is assigned to the correct MDM server in ABM. If you recently rotated your MDM server token, re-upload the new token in ABM under Settings > MDM Servers. Also verify that the device has internet access during setup.
Device enrolls but policies do not apply. The MDM enrollment profile installed, but your configuration profiles or app deployments are not pushing. Verify in your MDM console that the device appears in the correct device group and that your policies target that group. On Appaloosa, check the device's compliance status in the dashboard.
Supervised mode not activating. Supervision must be enabled in the enrollment profile before the device goes through Setup Assistant. You cannot retroactively supervise a device that has already been set up. The only fix is to wipe the device and let it re-enroll through ADE.
Frequently asked questions
Is DEP the same as ADE?
Yes. ADE (Automated Device Enrollment) is the new name for DEP inside Apple Business Manager. The enrollment protocol and device behavior are identical. Apple retired the DEP branding in 2019.
Can I still use DEP?
No. The standalone DEP portal (deploy.apple.com) was shut down. All enrollment management now happens through Apple Business Manager at business.apple.com.
Does ADE work with third-party MDM solutions?
Yes. Any MDM that supported DEP supports ADE, including Appaloosa, Jamf, Intune, Hexnode, and Mosyle. The MDM vendor registers a server token in your ABM account, and devices assigned to that server auto-enroll.
Can I enroll personally owned devices through ADE?
No. ADE is designed for organization-owned devices purchased through authorized channels. For employee-owned devices (BYOD), use manual MDM enrollment where the user installs the MDM profile themselves. Some organizations use Apple Configurator to add existing devices to ABM, but this requires physical access to the device and a macOS computer.
How many devices can ADE handle?
There is no limit. ADE scales from a handful of iPads to tens of thousands of iPhones. The enrollment happens device-by-device during Setup Assistant, so even large deployments do not create bottlenecks on the ABM or MDM side. Organizations routinely enroll 5,000+ devices in a single rollout cycle.