Glossary

DEP (Device Enrollment Program)

DEP, the Device Enrollment Program, was Apple's original service for enrolling company-owned iPhones, iPads and Macs into an MDM automatically at first boot. Apple folded it into Apple Business Manager in 2019 and renamed the feature Automated Device Enrollment, so DEP is now a legacy label for something that still runs every day under a different name.

How it works

Apple launched DEP in 2014, alongside the Volume Purchase Program, on a portal called deploy.apple.com. The principle was simple and hasn't changed: a device bought from Apple or an authorized reseller carries its serial number into the program, you assign that serial to your MDM server, and during Setup Assistant the device asks Apple who owns it. The MDM answers with an enrollment profile, and the iPhone is managed before anyone taps through to the home screen.

Two things come with that path and with nothing else. The enrollment can be made non-removable, so a user cannot delete the management profile from Settings. And the device is supervised automatically, which has been the default for DEP and ADE devices since iOS 11 in 2017. Supervision unlocks the restrictions most security teams actually ask for: blocking app removal, forcing a single app, controlling AirDrop and iCloud backup.

Apple announced Apple Business Manager at WWDC 2018 and pushed everyone off the old portals during 2019. ABM merged DEP and VPP into one place, added Managed Apple IDs and federated sign-in, and renamed the enrollment side Automated Device Enrollment. Under the hood, very little moved: the same serial-number claim, the same signed server token (a .p7m file that half the MDM consoles on the market still label "DEP token"), the same 30-day window to release a device from your organization after assignment.

Why it matters for a fleet

People keep typing DEP in 2026 for boring, legitimate reasons. Vendor APIs still carry the name: MDM protocol documentation talks about DEP profiles and the DEP web service, and plenty of consoles expose a screen called DEP Settings. Internal runbooks written in 2016 are still in Confluence. Resellers say DEP on the phone. Job postings ask for "DEP and VPP experience".

The practical consequence is a translation problem. When a colleague or an auditor says DEP, check whether they mean today's ABM enrollment or are quoting a document from the Apple Configurator era, because the answers about supervision and removability differ. And if you inherit a fleet, check ABM first: devices that were never registered there can only be brought under supervised management by erasing them and running Apple Configurator, which means touching each one by hand.

How Appaloosa handles it

Appaloosa connects to Apple Business Manager with a server token, picks up the devices assigned to it, and applies your enrollment profile at first boot: supervision, non-removable management, skipped Setup Assistant panes, app assignment and security policies from the start. Same flow for iPhone, iPad and Mac. The details are on the iOS MDM page.

Explore

See the full platform

Enrollment, apps, security, remote support: all in one place.

Explore Appaloosa →

See Appaloosa run on your fleet Book a demo

Frequently asked questions

Is DEP still a thing, or should I say ADE?

The service is now called Automated Device Enrollment and lives inside Apple Business Manager. DEP is the old name for the same mechanism, and it survives in API fields, token file names and vendor documentation. Use ADE in writing, but don't be surprised when a reseller or a console says DEP.

Can I add an iPhone we already own to Automated Device Enrollment?

Yes, with Apple Configurator on a Mac or the Apple Configurator app for iPhone. You erase the device, run it through Configurator, and it appears in Apple Business Manager. The catch is a 30-day provisional period during which the user can remove the management profile, which is not the case for devices bought through a registered reseller.

Does ADE give me supervision automatically?

On iOS 11 and later, yes: any device enrolled through DEP or ADE is supervised. That's what makes restrictions like blocking app deletion or enforcing single app mode possible. Manually enrolled devices are not supervised unless you erase them and use Apple Configurator.