Learn how to integrate your Apple Business Manager (ABM) tenant with Mobile Guardian using Apple’s Automated Device Enrollment (formerly DEP). This guide walks system administrators through the process of linking MDM servers, configuring enterprise enrollment profiles, and syncing corporate assets.
Apple’s Device Enrollment Program (DEP) is fully integrated into Apple Business Manager (ABM). Once linked with Mobile Guardian, you can manage your fleet across the organisation seamlessly.
Overview of Steps
- Step 1: Download the Public Key from Mobile Guardian
- Step 2: Create an MDM Server in Apple Business Manager
- Step 3: Upload the Server Token to Mobile Guardian
- Step 4: Recommended Enrollment Settings
- Step 5: Assign Devices in Apple Business Manager
- Step 6: Sync Devices to Mobile Guardian
- Maintain and Renew Your Token
- Adding Devices to an MDM Server
Step 1: Download the Public Key from Mobile Guardian
Download a secure public certificate from Mobile Guardian to establish a connection to ABM.
- Log in to the Mobile Guardian Dashboard.
- Navigate to Settings > iOS MDM Settings.
- Scroll to the Apple Device Enrollment Program (DEP) section.
- Under Getting Started on the right, click to download your public key: Mobile_Guardian_Apple_DEP_cert.pem. Save this file locally.
If you manage multiple MDM server instances, rename the downloaded .pem file to reflect the specific server or business unit.
Step 2: Create an MDM Server in Apple Business Manager
Upload the Mobile Guardian public key to ABM to generate an encrypted server token.
- Log in to Apple Business Manager.
You may need to go through a verification process while logging in. If this is your first time signing in on your device, we recommend selecting "Trust" when asked, “Trust this browser?”
- Select the Device tab at the top of the window and select Management Services.
- Navigate to Device Management Services > Add device management service, click Add.
- Enter a Device Management Service Name (e.g., [Company Name] - Mobile Guardian MDM).
- Click Choose File under MDM Server Settings, select the .pem key file downloaded in Step 1, and click Next.
- Select Download Service Token (file format ends in .p7m). Save this token securely and select Done
Step 3: Upload the Server Token to Mobile Guardian
Complete the integration by importing the ABM server token into Mobile Guardian.
- Return to the Mobile Guardian Dashboard.
- Navigate to Settings > iOS MDM Settings.
- Click Upload Server Token.
- Select the .p7m token file downloaded from ABM in Step 2.
- A confirmation alert will appear verifying the token has been linked successfully.
Step 4: Recommended Enrollment Settings
Configure corporate enrollment policies to match your organisation’s security guidelines.
- Go to Settings > iOS MDM Settings in Mobile Guardian.
- Adjust the policy flags as recommended below:
| Setting | Recommended Value | Purpose |
| Allow Pairing | Enabled | Allows administrators to extract diagnostic logs or sync with a local host. |
| Supervise | Enabled | Enforces full management control over company-owned hardware. |
| Multi-User | Optional | Enables shared-device workflows for shift-based employees. |
| Mandatory | Enabled | Forces the device to automatically re-enrol upon factory reset. |
| Allow Removal of MDM | Disabled | Prevents unauthorised users/employees from removing the management profile. |
| Setup Assistant Screens | Optional | Hides or shows standard iOS setup steps to streamline onboarding. |
- Click Update Settings to save your preferences.
Step 5: Assign Devices in Apple Business Manager
Assign your corporate hardware assets to the newly created Mobile Guardian MDM server.
- In Apple Business Manager, click Devices in the top navigation panel.
- Select the target hardware assets.
- Click Assign Device Management.
- Choose the MDM server created in Step 2, and click Continue.
- Confirm the assignment. A status notification will confirm when the update is complete.
Step 6: Sync Devices to Mobile Guardian
After assigning assets in ABM, trigger a manual sync to populate them in your administration dashboard.
- Log in to the Mobile Guardian Dashboard.
- Go to Settings > iOS MDM Settings.
- Scroll to Apple Device Enrollment Program (DEP) and click Resync Devices.
- The newly assigned devices will populate in your console (greyed out until initial onboarding is completed).
Maintain and Renew Your Token
ABM server tokens expire every 12 months. To ensure uninterrupted management:
- Monitor the expiration date visible in Settings > iOS MDM Settings.
- Set a recurring reminder to generate a new token in ABM and upload it to Mobile Guardian before expiration.
- Recommended to renew your token 7 days before expiration.
Adding Devices to an MDM Server
Adding devices to an MDM server is essential for successful synchronisation with the dashboard.
Devices can be moved into the MDM server at any time, but must be followed by a Resync of Devices from the Mobile Guardian Dashboard, as shown in Step 5.