As an admin, you can create and export an MDM profile that you can then import into Apple Configurator when staging devices.

The path to the Automated Enrollment page on the UEM console is Groups & Settings > All Settings > Device & Users > Apple > Automated Enrollment.

What can you do with the Apple Automated Enrollment settings page?

With Automated Enrollment settings you can:
  • Export a profile for the Organization Group and then install it on devices using Apple Configurator using the instructions provided on the page.
  • Enable automated enrollment for your devices.
  • Enable single or multi-user staging mode depending on your requirements.

Determine your Organization group hierarchy

Before you review and modify the settings, understand the two types of inheritance/override options for the organization group hierarchy available at the top and bottom of the settings page and determine your choice. For more information about these settings, see Override Versus Inherit Setting for Organization Groups.

  • Current Setting – Select whether to Inherit or Override the displayed settings. Inherit means use the settings of the current organization group's parent OG, while Override enables the settings for editing so you can modify the current OG's settings directly.
  • Child Permission – Select the available behavior of child organization groups that exist below the currently selected organization group. Inherit only means child OGs are only allowed to inherit these settings. Override only means they override the settings, and Inherit or Override means you can choose to inherit or override settings in child OGs that exist below the currently selected OG.

Follow the instructions on the Automated Enrollment page to generate APNs certificate from APNs for MDM page. The available options are:

Table 1. Automated Enrollment
Setting Description
Enable Automated Enrollment Select this check box to display the staging settings you can configure.
Platform Select which Apple platform this profile will be used for.
Staging Mode

Select the appropriate Staging Mode depending on how the device is going to be used and how the device must enroll. You can choose to pre-register devices and enroll using Apple Configurator. By pre-registering devices and selecting the None or Single User mode, you can pre-assign the end user for each device. However, you cannot pre-register Multi User devices.

  • None – Does not stage device for other users. For non-registered devices, all devices will be enrolled under the Default Enrollment User. In this case, only non-staging users are available as default staging user options.
    Important: If you do not pre-register your devices and select None and specify a default enrollment user, then all devices that receive the .mobileconfig file will be enrolled to that user. To ensure devices are enrolled to distinct users, pre-register them to specific users or create a staging user account and select Single User as your Staging Mode.
  • Single User – Stages device for a single, known or unknown user. Only staging users are available as Default Enrollment User options. When end users open the Workspace ONE Intelligent Hub, they must enter credentials to fully enroll the staged device. At that time, the device details will update in the UEM console and the device is associated with that end user.
  • Multi User – Places device into Shared Device Mode. This stages the device for multiple, known or unknown users. Only staging users are available as Default Enrollment User options. When end users open the Workspace ONE Intelligent Hub, they must enter credentials to check out the device for use.
Default Staging User Set a Default Staging user if you are using either the None or Single User staging modes.