Automated Device Enrollment

How it works

Apple introduced the Device Enrollment Program in 2014 and renamed it Automated Device Enrollment at WWDC 2019. The mechanics didn't change. When a device is activated, the Setup Assistant asks Apple's activation servers whether its serial number belongs to an organization. If it does, Apple returns the address of the assigned MDM server and the device enrolls right there, between the language screen and the Wi-Fi screen.

The MDM decides what happens next. It can skip Setup Assistant panes (Siri, Apple Pay, Screen Time), require a corporate login before the device is usable, apply supervision, and push the first batch of restrictions and apps. On a good Wi-Fi connection the whole sequence takes two to three minutes.

The profile installed this way is different from a manual enrollment. The user can't remove it from Settings. If the device is wiped, the next boot repeats the process, because the assignment lives in Apple Business Manager, not on the device.

Why it matters for a fleet

Think of it as the difference between handing someone a hotel key card and building them a room. Without ADE, IT unboxes every device, taps through setup, installs a profile and hopes the employee doesn't delete it. With ADE, the reseller ships sealed boxes straight to the site and the device configures itself.

Two consequences matter for security. The MDM profile is permanent for the life of the assignment, so a lost device that gets wiped comes back under management. And ADE is the only way to supervise a device without a USB cable, which unlocks single-app mode, silent app installs and Activation Lock bypass.

The limit: ADE only applies to devices present in ABM. A phone bought at retail needs to be added with Apple Configurator first, or enrolled the manual way with fewer controls.

How Appaloosa handles it

Appaloosa registers as an MDM server in your Apple Business Manager or Apple School Manager account. You assign devices to it in the portal, and they enroll at first boot with supervision on, then receive their apps from Apps and Books and your internal catalog. Enrollment settings, skipped panes and mandatory authentication are configured per device group. Details are on the iPhone and iPad MDM page.