ADE Enrollment Profiles
What is an ADE Profile
An ADE (Automated Device Enrollment) profile defines the enrollment behavior and initial device setup experience for devices enrolled through Apple's Automated Device Enrollment (formerly DEP). When a device is activated or wiped, it contacts Apple's enrollment servers, which direct it to GuardMDM based on the ADE profile assigned in Apple Business Manager. The profile controls which Setup Assistant screens the user sees, whether the device is supervised, and how the enrollment flow behaves.
Each profile is scoped to a single OS — iOS, iPadOS, or macOS — because the available Setup Assistant panes differ per platform. tvOS and visionOS are not supported.
Creating a Profile
Navigate to ADE Profiles in the left sidebar and click Create ADE Profile. A three-step wizard guides you through configuration.
Step 1: Basic Info
| Field | Description |
|---|---|
| Name | A human-readable label for the profile (e.g. "Corporate iPad - Standard") |
| Description | Optional notes about the profile's purpose |
| Shared iPad | Toggle to enable Shared iPad mode (iPadOS only). When enabled, users log in with a Managed Apple ID and their data is cached locally. Requires a Shared iPad license in Apple Business Manager. |
Step 2: Skip Items
This step controls which Setup Assistant panes are shown to the end user during device activation. Over 50 items are available to skip. Skipping a pane means the user never sees it and the device uses the default or configured value.
Commonly skipped panes include:
| Pane | Description |
|---|---|
| Apple ID | Skip Apple ID sign-in during setup |
| Siri | Skip Siri configuration |
| Screen Time | Skip Screen Time setup |
| Passcode | Skip passcode creation (not recommended for corporate devices) |
| Location Services | Skip location services prompt |
| Diagnostics | Skip diagnostic data submission |
| Touch ID / Face ID | Skip biometric setup |
| App Analytics | Skip app analytics sharing |
| Restore | Skip iCloud backup restore prompt |
| Terms and Conditions | Skip legal agreement acceptance |
| Zoom | Skip display zoom selection |
| Apple Pay | Skip Apple Pay setup |
| Display Tone | Skip True Tone setup |
| Wallpaper | Skip wallpaper selection |
| Privacy | Skip privacy configuration |
| Software Update | Skip mandatory software update prompt |
| Watch Migration | Skip Apple Watch migration prompt |
| TVI Provider Sign In | Skip TV provider sign-in |
| iMessage & FaceTime | Skip iMessage/FaceTime setup |
| Onboarding | Skip onboarding screens (macOS) |
| Screen Lock | Skip screen lock type selection (macOS) |
The full list varies by OS version. GuardMDM surfaces all available panes for the selected OS and lets you toggle each one independently.
Step 3: Shared iPad Settings
This step appears only when Shared iPad is enabled in Step 1.
| Setting | Description |
|---|---|
| Temporary sessions only | Allow users to sign in without a Managed Apple ID. Sessions are ephemeral — no data is persisted after logout. |
| Temporary session timeout | Maximum idle time (in minutes) before a temporary session is automatically logged out. |
| User session timeout | Maximum idle time (in minutes) before a Managed Apple ID session is automatically locked. |
| Storage quota size | Maximum storage (in MB) allocated per user on the device. |
| Resident users | Allow resident users on the device (Managed Apple IDs that persist across reboots). |
| Managed Apple ID default domains | Default domains for Managed Apple ID creation. |
| Await user configuration | Require explicit user configuration before enrollment completes. |
Setting a Default Profile
Each OS can have one default profile. When a device enrolls via ADE and no explicit profile is assigned, the default profile for its OS is used.
To set a default profile:
- Go to ADE Profiles
- Click the three-dot menu on the desired profile
- Select Set Default
The default profile is marked with a badge in the profile list.
Profile Assignment to Devices
Profiles are assigned to devices through Apple Business Manager (ABM) or Apple School Manager (ASM), not directly in GuardMDM.
- In ABM/ASM, assign devices to your MDM server (GuardMDM)
- In ABM/ASM, assign an MDM profile to each device or device group
- GuardMDM syncs the assignment and applies the matching ADE profile based on the device's OS
If a device is assigned to GuardMDM in ABM but no matching ADE profile exists, the device falls back to the default profile for its OS. If no default is set either, the device will not complete ADE enrollment.