Integrating with the Device Enrollment Program
The Device Enrollment Program settings allow you to integrate with Apple’s Device Enrollment Program (DEP), part of Apple Deployment Programs. Integrating with DEP is the first step to enrolling a device with Jamf Pro using a PreStage enrollment. After Jamf Pro is integrated with DEP, you can use Jamf Pro to configure enrollment and device setup settings.
To integrate with DEP, you need to do the following:
-
Download a public key (.pem) from Jamf Pro.
-
Obtain a server token file (.p7m) from Apple.
-
Upload the server token file to Jamf Pro to configure an instance of DEP.
For more information about DEP, see the following websites:
-
Device Enrollment Program for Business
https://www.apple.com/business/dep/ -
Device Enrollment Program for Education
https://www.apple.com/education/it/dep/
Requirements
To obtain a server token file from Apple, you need an Apple Deployment Programs account. You can apply for an account at:
https://deploy.apple.com
Downloading a Public Key
Before you can obtain the server token file from Apple, you need to download a public key from Jamf Pro.
-
Log in to Jamf Pro.
-
In the top-right corner of the page, click Settings
.
-
Click Global Management.
-
Click Device Enrollment Program
.
-
Click Public Key to download the public key.
The public key (.pem) is downloaded immediately.
Obtaining the Server Token File
To download the server token file, you need to upload your public key to the Apple Deployment Program website.
-
Log in to the Apple Deployment Program website at http://deploy.apple.com.
-
In the sidebar, select Device Enrollment Program
.
-
Follow the onscreen instructions to verify your identity.
-
In the sidebar, select Manage Servers, and then click Add MDM Server.
-
Enter a name for your MDM server, and then click Next.
-
Click Choose File, and then upload the public key (.pem) you downloaded from Jamf Pro.
-
Click Next to download the server token file (.p7m).
The server token file (.p7m) is downloaded immediately.
Uploading the Server Token File to Configure an Instance of DEP
This process creates one instance of DEP in Jamf Pro. To meet the needs of your organization, you can repeat the process to create multiple instances of DEP.
-
Log in to Jamf Pro.
-
In the top-right corner of the page, click Settings
.
-
Click Global Management.
-
Click Device Enrollment Program
.
-
Click New
.
-
Enter a display name for the DEP instance.
-
Click Upload Server Token File to upload the server token file (.p7m) you downloaded from Apple. This creates one instance of the program in Jamf Pro.
The information contained in the server token file is displayed. -
(Optional) Choose a supervision identity to associate with the DEP instance. (For more information, see Supervision Identities.)
-
Click Save.
-
To configure another instance of DEP, repeat steps 5-9.
Refreshing DEP Instance Information
Jamf Pro allows you to manually refresh information in the DEP instance as needed.
-
Log in to Jamf Pro.
-
In the top-right corner of the page, click Settings
.
-
Click Global Management.
-
Click Device Enrollment Program
.
A list of program instances is displayed. -
Click the program instance you want to refresh.
-
Click Refresh.
If there is updated information in DEP, this information is displayed in Jamf Pro.
Further Considerations
-
If you upload a new server token file (.p7m) to renew an expired DEP instance, it is recommended that you do not delete the expired instance from Jamf Pro before uploading the new server token file.
-
Deleting a DEP instance removes the instance from Jamf Pro but does not delete the settings in DEP.
-
If necessary, you can remove a device from DEP by disowning the device using the Apple Deployment Programs website. Disowning a device that is currently enrolled with Jamf Pro does not remove the device from Jamf Pro. For detailed information on disowning devices, see Apple Deployment Programs Help at:
https://help.apple.com/deployment/business/
Related Information
For related information, see the following Jamf Knowledge Base videos:
For related information, see the following sections in this guide:
-
Mobile Device PreStage Enrollments
Find out how to enroll mobile devices using a mobile device PreStage enrollment. -
Computer PreStage Enrollments
Find out how to enroll Mac computers using a computer PreStage enrollment. -
Supervision Identities
Find out how to create, upload, and download a supervision identity for use with Apple Configurator 2.