How to enroll Apple TVs

Apple TVs are becoming a significant entity in enterprises. It is one of the most promising streaming and signage tool used today in enterprise infrastructures. Hexnode supports the management of Apple TVs with a set of easy enrollment methods. They can be enrolled in Hexnode via different methods:

1. Apple Configurator Enrollment
2. ABM Enrollment
3. ABM Enrollment via Apple Configurator

Apple Configurator Enrollment

Apple Configurator is a macOS tool that can be used to supervise and enroll Apple devices in mobile device management solutions. Apple Configurator is also used for creating configuration profile and deploy applications for enterprise and educational institutions. The enrollment can be completed through a wired setup or wirelessly over-the-air.

Follow the steps below to enroll Apple TV to Hexnode using Apple Configurator:

ABM enrollment

Apple Business Manager was introduced by Apple to help Business and Educational organizations remotely deploy Apple devices. Using ABM, a brand-new Apple device can be enrolled in Hexnode without a technician ever touching it. After the devices have been enrolled in Hexnode, you can apply DEP policies via the Hexnode portal.

Here is how to assign Apple TVs to the Hexnode server via ABM:

1. Navigate to Apple Business Manager and log in to your account.
2. Complete the two-step verification.
3. Click Devices. Search and select the required devices from the list. You can filter devices based on their source, order numbers, device types, etc. Then, click on Edit Device Management.
4. Click on Assign to server. Now choose the MDM server from the drop-down and click Continue.
5. Confirm your action to complete the assignment.

Create a configuration profile with required configurations in Hexnode and attach it with the devices for streamlined enrollment. The device is now ready for deployment. If you have a new device, activate DEP by connecting it to the internet and applying Remote Management configurations. If you have an already activated device, reset the device to its factory settings to initiate the device enrollment procedure. After resetting, connect the device to a Wi-Fi network and apply Remote Management.

ABM Enrollment via Apple Configurator

Apple devices purchased before March 1, 2011 and other non-Authorized resellers or non-Apple purchased devices cannot be directly enrolled via ABM enrollment. Such devices can be enrolled in DEP with the help of Apple Configurator. Also, Apple TV’s that were previously Released from DEP can also be added back using this enrollment method.

Step A: Create a Wi-Fi profile in Apple Configurator

1. Open Apple Configurator on the host Mac. On the menu bar, click on File → New Profile → Wi-Fi, select Configure.
2. Enter the SSID, security type, password, and any other relevant settings required to connect to your Wi-Fi network.
3. Click Save from the File menu.

Step B: Prepare a Blueprint and attach the Wi-Fi profile

1. Open Apple Configurator 2.0 on your host Mac machine.
2. Go to Blueprints and click on Edit Blueprints.
3. Click on New from the bottom left and enter a name for the blueprint.
4. Double click on the blueprint, this will take you to the Info page. Change the blueprint Target to Apple TV. Click on Back.
5. Select the blueprint and click on the Add button (located on top of Apple Configurator). Choose Profiles and select the created Wi-Fi profile. Alternately right-click on the blueprint and click on Add and choose Profile to add the Wi-Fi profile.
6. Then select the blueprint and click on the Prepare button on top of the Apple Configurator. Or, right click on the blueprint and select Prepare.
7. Choose Prepare with: Manual configuration. Enable the options Add to Apple School Manager or Apple Business Manager, Activate and complete enrollment, Supervise devices and Allow devices to pair with other computers and click Next. If Allow devices to pair with other computers is not selected, the device cannot be detected by Mac or a PC when connected via USB.
8. Now choose the enrollment server to remotely manage the device. Select New Server from the drop-down and click Next.
9. Specify a name for the server and enter the URL, which can be found at Enroll > Platform – Specific > tvOS > Apple Configurator and click on Next.
10. The trust anchor certificates for the MDM server will be automatically added, click on Next.
11. Now choose the organization used to supervise the devices. To create a new organization, select the New Organization from the drop-down menu, and click Next. Note that, this step will be hidden if no organization is already registered in the Apple Configurator.
12. Sign in to your Apple Business Manager account. Note that this account should have administrative permissions to manage devices.
13. Select Generate a new supervision identity and click Next.
14. From the Setup Assistant screen, select any of the three options from the drop-down: Show all steps, Show only some steps, and Do not show any of these steps. If Show only some steps is selected, choose the steps to be shown from the same page. Click Next.
15. Then select the previously prepared Wi-Fi profile and click Next.
16. Click on Prepare.

Step C: Pair the devices and associate the Blueprint

Connect the host Mac and the Apple TV either wirelessly or via a USB cable. To pair Apple devices over a network, refer Step 4: Applying Blueprint to the Apple TV in the Apple Configurator Enrollment.

Now, apply Blueprint to devices. To do so, select the device and click on Blueprints, select the required Blueprint, and click on Apply.

If the device is supervised, the Wi-Fi profile will automatically install on the device and you will be prompted to initiate the erase action on Apple Configurator. However, if the device is not-supervised, you will be notified that the Wi-Fi profile installation cannot be completed without manual intervention. Install the profile by physically accessing the device and manually reset the device to its factory settings.

Step D: Sync the Apple Business Manager account with Hexnode

Once the device is reset, leave it on the Hello screen. Then sync your Apple Business Manager account with Hexnode. For that, first create a DEP Account in Hexnode.

1. On your Hexnode MDM console, navigate to Enroll > Platform-Specific > tvOS > Apple Business/School Manager. Click on Next.
2. Enter an Account name and download the DEP server token.
3. Login to your Apple Business Manager account.
4. Navigate to Settings > Device Management Settings > Add MDM Server.
5. Enter an MDM Server Name, then upload the DEP server token that you have previously downloaded.
6. Then click Save.
7. Click on Download Token > Download Server Token.
8. Now go back to the Hexnode MDM console and upload the server token obtained from the ABM portal.
9. Check Add as Pre-approved device if you want to attach configurations and restrictions with the device prior to device enrollment.
10. Then select a DEP configuration profile to attach to all the devices in this account.
11. Select the enrollment authentication preferences. The available options are
    1. Use Global Authentication settings: If selected, the enrollment configurations set up under Enroll > Settings > Authentication Modes will take effect.
    2. No Authentication: If selected, you will be asked to select a user and the user domain. All the devices associated with this DEP account will be enrolled under this user. However, device ownership can be changed after enrollment.
12. Now, save the DEP Account by clicking on Next.
13. Click on Next to move on to the next steps.

Step E: Assign the devices to the Hexnode server in ABM

On applying the configurations via the Blueprint, the device will get listed under Devices tab in Apple Business Manager. Select the devices and assign it to the MDM server.

Devices can be assigned individually or in bulk. To select devices in bulk, use the available filter criteria to group the required devices together. However, if you want to enroll multiple devices without filtering then just select the required devices manually.

1. On your Apple Business Manager account, go to Devices.
2. Select the required devices and click on Edit Device Management.
3. Choose Assign to server and select the required server from the drop-down.
4. Click on Continue and then confirm your action.
5. Now, go to your Hexnode MDM admin console and click on Sync with DEP under Enroll > All Enrollments > No-Touch > Apple Business/School Manager > DEP Devices.

Step F: Activate the device and get it enrolled in ABM

Now, start activating the erased device or the new device to which the Blueprint was attached. The device will get automatically associated with the Wi-Fi network configured under the Wi-Fi profile. Enable Remote Management for the device and follow the on-screen instructions to complete the device enrollment.

30-day provisional period

Apple devices enrolled in ABM via Apple Configurator will not work like an actual DEP enrolled device during the initial 30-days after deployment. That is, even if you have configured to block the manual MDM administration removal in the associated DEP profile, the user can choose to remove the MDM management from Settings > General > profiles. However, after the initial 30-days of enrollment, the user will be blocked from bypassing the MDM management.