Device Enrollment

What is Device Enrollment

Device Enrollment allows devices to enroll in GuardMDM without being connected to a physical provisioning system or Apple Business Manager. Instead, the user scans a QR code or opens an enrollment URL on their device, downloads and installs a management profile, and the device enrolls automatically.

This enrollment method is ideal for:

• BYOD (Bring Your Own Device) — personal devices that are not in ABM
• Remote workers — devices that cannot be physically provisioned
• Legacy devices — devices not enrolled in Apple Business Manager
• Testing and staging — quick enrollment for evaluation or development

Unlike ADE enrollment, this method does not supervise the device automatically. Supervision must be applied separately if required.

Prerequisites

Before generating an enrollment profile, you must configure an APNs Push Certificate first:

1. Go to Device Enrollment > APNs
2. Upload your APNs certificate
3. Return to Enrollment to generate the enrollment URL

Without a valid APNs certificate, the enrollment URL and QR code will not be available.

Generating an Enrollment URL

GuardMDM generates a unique enrollment URL for your organization. This URL can be shared with users to download the enrollment profile.

1. Navigate to Enrollment in the left sidebar
2. If the APNs certificate is configured, the page displays:
   • A QR code for quick scanning
   • The Enrollment URL for copying or sharing
   • A Download .mobileconfig button

QR Code for Easy Enrollment

The QR code encodes the full enrollment URL. When scanned with the device's camera, it opens the enrollment page in Safari.

Scan QR Code

→

Opens Enrollment URL

→

Installs MDM Profile

→

Device Enrolls

Sharing the Enrollment URL

The enrollment URL can be:

• Copied to clipboard and emailed to remote users
• Shared in a company portal or internal wiki
• Sent via messaging apps (Slack, Teams)
• Embedded in onboarding documentation

The enrollment page is mobile-responsive and works on iOS, iPadOS, and macOS.

Enrollment Flow

The device enrollment process follows these steps:

User opens enrollment URL

↓

Safari loads enrollment page

↓

Profile downloads automatically

↓

Device contacts GuardMDM

↓

Device enrolls successfully

Step-by-Step

1. User opens the enrollment URL on their device (Safari on iOS/iPadOS, Safari or any browser on macOS)

2. Profile download — the browser downloads an .mobileconfig profile containing the MDM server URL and enrollment challenge

3. Profile installation — the user is prompted to go to Settings > General > VPN & Device Management and install the profile. On macOS, System Settings opens automatically.

4. Device enrollment — after profile installation, the device contacts GuardMDM, exchanges certificates, and registers itself

5. Policy application — GuardMDM applies the assigned group's policies, configurations, and apps to the device

User Experience on iOS/iPadOS

1. Tap enrollment link

↓

2. Allow profile download

↓

3. Settings - Profile Downloaded

↓

4. Tap Install - Enter passcode

↓

5. Install anyway if untrusted warning

↓

6. Device enrolls

User Experience on macOS

1. Click enrollment link

↓

2. Browser downloads profile

↓

3. System Settings - Privacy and Security - Profiles

↓

4. Click Install - Authenticate

↓

5. Device enrolls

Verifying Enrollment

After enrollment, verify the device is properly managed.

In GuardMDM

1. Go to Devices and locate the newly enrolled device
2. Check that the device status shows Enrolled
3. Verify the assigned group, policies, and configurations are applied

On the Device

iOS/iPadOS:

• Go to Settings > General > VPN & Device Management
• The GuardMDM profile should appear with a green checkmark
• Tap the profile to view installed configurations and restrictions

macOS:

• Go to System Settings > Privacy & Security > Profiles
• The GuardMDM management profile should be listed as Verified

Common Issues

Issue	Cause	Resolution
Profile won't install	APNs certificate not configured	Upload an APNs certificate in Device Enrollment > APNs
"Invalid Profile" warning	Enrollment URL expired	Refresh the Enrollment page to generate a new URL
Enrollment hangs at "Configuring Device"	Network connectivity	Ensure device can reach GuardMDM
Profile is untrusted	Root CA not installed	Install root CA profile first

---

Next: Enrollment Verification and Troubleshooting