Apple device management
Company iPhone, iPad and Mac devices that set themselves up, stay configured and can be locked or erased remotely, through a console built on Apple's MDM protocol.
At a glance
What it is
MDM for company iPhone, iPad and Mac devices: automatic enrolment, supervision, apps, OS updates and remote lock, as a custom build or an integration.
How to start
Tell us what you need in your own words. You talk to the developers who would build it and get a written, line-item estimate.
Get a project estimateApple builds management into iOS, iPadOS and macOS. A device enrolled in an MDM (mobile device management) server accepts settings, apps and commands from it. The server never connects to the device directly: it asks Apple Push Notification service (APNs) to wake the device, and the device then checks in over an encrypted connection to collect its instructions. Newer declarative device management lets devices apply settings on their own and report their status back as it changes.
What IT can do depends on how a device was enrolled. Devices bought by the organisation and registered in Apple Business or Apple School Manager use Automated Device Enrollment and are supervised, which unlocks the full set of restrictions and, on iPhone and iPad, Single App Mode and Lost Mode. Personal devices use User Enrollment, where only work accounts, apps and data are managed.
We build custom MDM servers and consoles, connect existing MDM tools to the rest of your systems, and plan, roll out and support fleets of company devices.
What is included
Platform: Cloud service
Platform: Admin dashboard
Platform: Mac
Platform: API
How it works
The same sequence runs whether you manage ten devices or several thousand.
Devices bought from Apple or a participating reseller or carrier appear in your organisation account; others can be added with Apple Configurator, which erases them. Each serial number is assigned to your MDM server.
The device learns it belongs to your organisation, enrols in the MDM server during setup and becomes supervised. Setup screens you do not need are skipped.
Wi-Fi, email, VPN, passcode rules and restrictions arrive as configuration profiles and declarations, chosen by the device's group or role.
App licences bought in volume are assigned to the device. On a supervised device, apps then install silently, without anyone signing in with a personal Apple Account.
Devices report OS version, storage and security state as it changes, and install OS updates by the deadline IT sets (iOS and iPadOS 17 or later, macOS 14 or later).
A supervised iPhone or iPad can be put in Lost Mode and located, or erased and, with Return to Service (iOS and iPadOS 17 or later), re-enrolled ready for the next person. Mac computers are erased and set up again.
Then it starts again at step 1: Device purchased and registered
Comparison
The enrolment method decides how much IT can control, so it is the first decision in any Apple rollout.
| Automated Device Enrollment | Device Enrollment | User Enrollment | |
|---|---|---|---|
| Who owns the device | The organisation, registered in Apple Business or Apple School Manager | The organisation, set up by hand or with Apple Configurator | The employee (bring your own device) |
| Supervision | Yes, automatically | iPhone and iPad: only if prepared with Apple Configurator. Mac on macOS 11 or later: yes | No |
| Can the user remove management? | Can be prevented | Usually yes | Yes, which removes work data |
| What IT manages | The whole device, including supervised-only restrictions and, on iPhone and iPad, Single App Mode and Lost Mode | Most settings and apps; supervised-only restrictions need supervision | Work accounts, work apps and their data only |
| Remote erase | Whole device | Whole device | Work data only, by ending management |
| Good for | Company phones, shared iPad devices, kiosks and Mac laptops | Company devices that cannot be added to Apple Business, or must not be erased to add them | Personal phones used for work email and apps |
Platforms
iPhone and iPad devices, Mac computers, and the web console your IT team works in.
Organisation-owned or shared iPhone and iPad devices enrolled in MDM through Apple Business or Apple School Manager, supervised for Single App Mode and stricter restrictions.
Mac computers enrolled in MDM for configuration profiles, app and package installs, disk encryption settings and software update rules, set up at first power-on when the purchase is linked to Apple Business.
Back-office panels for operations, support and finance teams: orders, users, content, reports and permissions.
Browser-based applications with logins, roles and workflows, such as customer portals, SaaS products and internal tools.
Technology
Apple's MDM protocol and Apple Business do the device-side work; our server, database and console tie them to your organisation.
Device management
The management channel built into iPhone, iPad and Mac: an MDM server sends settings, apps and commands, and devices apply them remotely.
Used for
Device management
The Apple portal for organisations, now called Apple Business: devices bought from Apple or linked resellers are assigned to your MDM and set up at first power-on.
Used for
Mobile
Apps built specifically for iPhone and iPad, for when your product needs Apple features or a polished experience for iPhone users.
Used for
Backend
Runs the server side of apps: fast, scalable back ends that power your app, website and integrations.
Used for
Backend
A structured way to build back ends on Node.js, so large business systems stay organised, testable and easy to hand over.
Used for
Data
A reliable database for the records your business runs on: orders, payments, bookings and stock, kept accurate and easy to report on.
Used for
Data
Keeps frequently used data in fast memory, so apps stay quick on busy days and live features like order tracking feel instant.
Used for
Web
Builds interactive screens in the browser, such as dashboards, admin panels and portals, that respond instantly as your team works.
Used for
Web
A modern web technology for fast, search-friendly websites, online stores and web applications that load quickly on mobile.
Used for
Cloud & DevOps
Cloud hosting for your app, website and data, with data centres in India and room to grow when traffic rises.
Used for
Cloud & DevOps
Packages your software so it runs the same way on every laptop and server, which makes releases predictable and moving hosts easier.
Used for
Plain-English glossary
Product preview
Illustrative screens from a custom console; device names, people and numbers are samples.
Sample screens: names, prices and figures are examples, not client data.
Work
Device management & kiosk solutions
An illustrative console for school tablets: iPad devices through Apple School Manager and MDM, Android™ tablets through Android Enterprise, with class-based rules teachers can follow.
Runs on
Built with
Cost drivers
Connecting an MDM you already use to HR, identity and helpdesk systems is a smaller job than building and running your own MDM server.
iPhone and iPad share most of the protocol. Adding Mac management brings FileVault, software packages, privacy approvals and a separate test cycle.
Supervised company devices, Shared iPad and personal devices on User Enrollment each need their own flows, role profiles and testing.
From the 27 releases, OS updates can only be enforced through declarative device management, and its status reports replace much of the old polling. Both add server work.
Running your own MDM server means requesting MDM vendor access from Apple, issuing push certificates and renewing them every year.
Staged rollout plans, setup days on site and training for site admins scale with the number of devices and locations.
Estimates are written from your scope, with the effort and assumptions behind each line item.
How pricing worksProcess
We list your devices, how they were bought, which Apple Business or Apple School Manager account holds them and what each group of users needs.
You getDevice inventory and enrolment plan
We compare the device management built into Apple Business, your current MDM and a custom server for your case, and recommend one with reasons.
You getWritten recommendation and estimate
A small group of devices across your main roles runs the new role profiles for two weeks, and we adjust settings from real feedback.
You getPilot report
Sites or departments move in waves, with setup guides for staff and a rollback plan for each wave.
You getRollout schedule and guides
We renew certificates, test each major OS release on pilot devices before it reaches your fleet and handle requests from your IT team.
You getSupport plan
Solutions
Kiosk mode for iPad with Single App Mode, Autonomous Single App Mode or Guided Access, plus the kiosk app and console, for check-in, ordering and forms.
One console for company Android, iPhone, iPad, Mac and Windows devices: enrolment, apps, access and offboarding, on platform APIs or your existing UEM.
Compliance rules for Android, Apple and Windows devices: passcodes, encryption, OS updates, app lists, remote lock and wipe, audit logs and reports.
Zero-touch, QR code, Knox Mobile Enrollment and Apple Automated Device Enrollment set-ups that take devices from the box to ready-to-use.
Services
The disciplines a project like this draws on.
Native iPhone and iPad apps in Swift and SwiftUI, built to Apple's review guidelines and privacy rules and tested on the devices your customers use.
Software shaped around how your business runs, from approvals and inventory to billing and reports, replacing spreadsheets and disconnected tools.
Back-office dashboards built around your team's daily tasks: order queues, approvals, catalogue management, payouts, reports and audit logs.
Secure, documented REST and GraphQL APIs, plus integrations that connect your apps to payment, logistics, GST, messaging and business systems.
Multi-tenant SaaS products with subscription billing, team roles, onboarding and usage analytics, from first MVP to paying customers.
Industries
Industries where this kind of product fits well.
More specific pages
MDM solutions for iPhone, iPad and Mac for
FAQ
Often you do not need your own. Apple Business includes built-in device management that suits many small fleets, and established MDM products cover most company needs. A custom MDM server makes sense when device management is part of your own product, such as a school platform or a retail system that must control iPad devices, or when you need workflows no product offers. We can also connect an existing MDM to your HR, identity and helpdesk systems through its API, which is usually the quickest route.
The organisation behind the server needs an Apple Developer Program or Apple Developer Enterprise Program membership, and its Account Holder asks Apple Developer Support for an MDM vendor CSR signing certificate. With it, you sign certificate requests so that each customer can create an MDM push certificate at the Apple Push Certificates Portal. Push certificates expire after a year and must be renewed with the same Apple Account rather than replaced, otherwise every device has to enrol again. We set up and document this process with you.
Only in a limited and visible way. MDM does not track location day to day. On a supervised iPhone or iPad, IT can switch on Managed Lost Mode, which locks the device with a message and lets the MDM request its current location. When Lost Mode is turned off, the user is told that the location was collected. If staff need location for their work, such as field visits, that belongs in a work app that asks permission and explains why, in line with the Digital Personal Data Protection Act, 2023.
With User Enrollment, the company manages only the work side: a Managed Apple Account, work apps, their data and settings such as VPN for those apps. It can lock the screen, but it cannot see personal apps, photos or messages, cannot locate the phone and cannot erase it. When the employee leaves, ending management deletes the work apps and data and leaves personal content untouched. That trade-off is why personal phones suit email and business apps, while kiosks and shared devices should be company-owned.
Through declarative device management. The console sets a target version and a deadline; devices download the update, remind the user and install it by the deadline, reporting progress as they go. The older MDM update commands no longer work from the 27 releases of iOS, iPadOS and macOS, so any MDM we build or integrate uses the declarative method. We usually test each major release on a pilot group before setting a deadline for everyone else.
Yes. Mac computers enrol the same way, through Automated Device Enrollment for company-owned machines, and use the same MDM protocol. Mac management adds its own tasks: FileVault encryption with the recovery key held by IT, software packages, privacy approvals for security tools and a managed local administrator account. Windows PCs and Android devices use different management protocols; if you want everything in one console, that is enterprise mobility management, which we also build.
Related
Next step
Tell us how many iPhone, iPad and Mac devices you run, how they were bought and what IT needs to control. We will recommend building, integrating or Apple's built-in option, with a line-item estimate.
