Choose an MDM solution
There are many MDM solutions available from a variety of third parties. You should evaluate which aspects of MDM are most important to your organization—including hosting options and pricing—before you choose a solution. The criteria below can help with your decision.
Based on your criteria, you can create a short list of MDM solutions and set them up on a trial basis with just a few test devices to evaluate which solution best meets your needs before making a final decision. Apple School Manager and Apple Business Manager all allow you to connect with more than one MDM solution and assign devices to different servers as needed.
Tip: It’s vitally important to select the appropriate MDM solution before your deployment. Changing mid-deployment may require you to erase each device and reenroll it.
Vendor support access and policies
MDM is a mission-critical service. You need to evaluate the support, services, and training your MDM vendor provides.
Hosting in the cloud or locally
An MDM solution can be hosted in the cloud or on a local server. MDM is a lightweight HTTPS-based protocol that can manage devices anywhere in the world with low data-traffic impact, making it well suited for cloud hosting. If your organization chooses a cloud-hosted or internet-hosted solution, many of the MDM configuration steps described in this reference can be considerably reduced or eliminated entirely.
Device support
Some MDM solutions are built with in-depth support for specific Apple device types—for example, just Mac computers or iPhone devices—while others offer cross-platform support. You can choose a mix of MDM vendors so each device type is supported with a specialized solution. Automatic assignment by device type in Apple School Manager or Apple Business Manager makes this simple. Or choose an MDM vendor that supports all Apple device types used across your organization.
Support for Apple web-based portals
Some MDM vendors offer enhanced support for device enrollment and Managed Distribution. Some, for example, offer the ability to import multiple tokens for Apple School Manager or Apple Business Manager. Having multiple tokens associated with purchasing apps and books is helpful if your organization has multiple manager accounts, such as one for each school in a district. With multiple tokens, an organization can have separate enrollment settings for different sets of devices. In this case, an enterprise might have one for shared devices and another for one-to-one devices.
MDM solutions also play a key role in enforcing Access Management rules of Managed Apple Accounts. When a Managed Apple Account tries to sign in, the device sends a GetToken request to the MDM to determine whether its management status aligns with the organizational requirements. For more information, see Get Token on the Apple Developer website.
User account information
MDM can set up mail and other user accounts automatically. Depending on the MDM solution you use and its integration with your internal systems, account payloads can also be prepopulated with a user’s name, email address, and certificate identities for authentication and signing.
An MDM solution can configure the following types of accounts with user information:
Calendar
Contacts
Exchange ActiveSync (EAS)
Exchange Web Services (EWS)
Extensible single sign-on
Google
Identity
LDAP
Mail
Subscribed calendars
VPN
802.1X
MDM framework support
Apple devices provide a rich set of configuration options available through the MDM framework. Organizations should evaluate whether the intended MDM solution supports required profiles and configurations. In addition, you should evaluate which declarative device management capabilities are supported if you are planning to make use of enforced software updates, managed service configuration files, or other functionality provided by the new protocol.
MDM commands
MDM solutions can send commands to enrolled Apple devices. To learn which MDM commands are supported for your devices, consult your MDM solution’s documentation. Commands can be used to trigger software updates, locate misplaced devices with Lost Mode or installing apps remotely. For more information, see MDM commands for Apple devices.
Query and reporting services
An MDM solution can query Apple devices for a variety of information, including hardware serial number, Unique Device Identifier, Wi-Fi, media access control (MAC) address, and (for Mac computers) FileVault encryption status. It can also query for software information, such as device version and restrictions, and list the apps installed on the device. This information can be used to ensure that users maintain the appropriate apps. iOS, iPadOS, and visionOS 1.1 allow queries about the last time a device was backed up to iCloud and about the app assignment account hash of the logged-in user. In tvOS, MDM can query enrolled Apple TV devices for asset information, such as language, locale, and organization. For more information, see Device information MDM queries.
Education-centric functionality
Some MDM vendors offer functionality designed specifically for education environments. Well before the day devices are given to students, make sure your MDM vendor supports solutions such as Apple School Manager, Classroom, Schoolwork, Shared iPad, and all the education features introduced with the latest versions of Apple operating systems. For more information on deployment Apple hardware, software, and services in education (primarily K–12), see the Apple Deployment Guide for Education.
In iPadOS 17.6 or later, developers can take advantage of additional apps alongside their primary assessment app—for example, accessibility apps and apps that may use calculators, notes, and spreadsheets.
In iPadOS 17.5 or later with Schoolwork 3.0, teachers can:
Send any document or file as a Classroom assessment, including PDFs and files created from Pages, Numbers, Keynote, and Google Suite (docs, sheets, slides)
Upload documents from iCloud and scan paper documents directly into Schoolwork
Review and score student work and documents using scoring features
Analyze student performance per question, which includes other reporting and insight features
Business-centric functionality
Some MDM vendors offer functionality designed specifically for business. Examples include tools for auditing and for integrating with Active Directory and LDAP directory services.