Jamf Device Enrollment: Your Complete Guide to Getting Apple Devices Enrolled

If a client submits a request asking you to enroll 10 Apple devices in Jamf by tomorrow, would you know where to start? Two years ago, I wouldn’t have. I was excited about getting the request, but had no clue how to actually execute it. And quite honestly, school didn’t prepare me for a lot of the practical stuff, so in that moment, I truly didn’t know where to begin.

This article is written to serve as a foundation guide for Jamf. We’ll cover what Jamf does in the MDM space, how enrollment actually works, and the methods you’ll use most often. By the end, you’ll have enough foundation to handle real enrollment requests and know where to look when you hit something unfamiliar.

MDM & Jamf Basics

MDM stands for Mobile Device Management. If you’ve studied for any CompTIA certs or spent time in IT courses, you’ve probably heard the term. Tools like Intune, Jamf, and Kandji help companies manage devices by setting policies and guidelines.

One example of an MDM policy is requiring users to set up passcodes before company resources can be deployed. Another is ensuring devices stay updated to prevent malware where work product is stored and accessed. There are many other security policies that can be deployed using an MDM.

Jamf is one of the major MDM platforms for Apple devices. Once a device is enrolled, it receives management instructions through Apple’s Push Notification (APN) protocol. There are two main paths to enrolling devices in Jamf: Automated Device Enrollment (ADE through ASM or ABM) and manual enrollment. ADE is preferred when possible because it’s simpler and gives you more control. Manual enrollment is your backup when ADE isn’t available.

Automated Device Enrollment (ADE)

When companies buy Apple devices from Apple or authorized resellers, those devices get added to Apple Business Manager (ABM) or Apple School Manager (ASM). Don’t worry about the difference between ABM and ASM right now. What you should know is that they’re Apple enterprise accounts that manage device inventory and app licenses.

Once a device appears in ABM or ASM, it shows up in Jamf under the Automated Device Enrollment tab. From there, you can assign it a Profile, Blueprint, or Device Group so that once it connects to a network for the first time, it will inherit those configurations automatically. The user can then click through setup screens, so enrollment happens without any IT involvement.

There are many benefits to using ADE. Firstly, it’s zero-touch, which means users don’t need help from IT. Once enrollment is complete, users cannot remove the MDM profile from Settings. Only someone with Jamf access can do that, and this is critical for asset protection since it discourages theft by internal staff (yes, it happens) and external parties. You can also customize which setup screens users see during enrollment for more control.

Using Apple Configurator 2 for ADE

Sometimes you need to enroll a device that wasn’t purchased through Apple’s enterprise channels. Apple Configurator 2 lets you add devices to ASM or ABM after the fact, making them eligible for ADE.

This process is convenient but requires specific conditions. First, you need a MacBook with Apple Configurator 2 installed and the target device in your possession. Using AC2 lets you add the device to your ASM or ABM inventory, making it available for ADE enrollment in Jamf.

Here’s how it works:

1. Connect the device to your MacBook with a USB cable, then open Apple Configurator 2.
2. Select the device and click Prepare.
3. Under Manual Configuration, choose “Add to Apple School Manager or Apple Business Manager.”
4. For the MDM Server, select “New Server” and enter the MDM URL from Jamf.
5. Sign in to your ASM or ABM account when prompted, choose your organization, and click Prepare.
6. The device will restart and go through setup. After that, head to ASM or ABM, find the device by serial number, and assign it to your Jamf MDM server. Now wipe the device completely.
7. When it turns back on and connects to the internet, ADE kicks in automatically.

Manual Enrollment Options

There’s a good chance you’ll encounter situations where a device hasn’t been added to ASM or ABM, but you still need to enroll it. Jamf offers several manual enrollment methods for these situations.

The simplest is on-device enrollment. You grab a link from the Jamf portal and enter it into the device’s browser. Jamf Pro doesn’t require an access code, so you would just enter the Jamf URL and go. Jamf School and Jamf Now will require a Network ID or an Access Code, which you can get from the portal.

You can also send enrollment links through email to the users. Once the user clicks the link, the mobileconfig profile downloads and gets installed through Settings.

Remember, manual enrollment should be a backup option. If you can use ADE, use it. There are times when manual enrollment makes sense, though. In BYOD situations, it’s preferred since ADE restrictions can be invasive for personal devices.

Simply put, the main difference between manual enrollment and ADE is that manually enrolled devices let users remove the MDM profile from Settings. ADE-enrolled devices don’t. The MDM profile can only be removed through the Jamf portal. That alone should tell you which method to use for company assets.

Equipping Yourself

I’d highly recommend creating a free Jamf Now account. This allows you to manage up to 3 Apple devices at no cost. The interface is different from Jamf School and Jamf Pro since it’s a limited version, but familiarizing yourself with the environment will give you a foundation, and you’ll have a strong foundation to work with for interviews.

If you have Jamf access at work, explore the menus and speak to your management about creating test configurations. Just remember to delete them when you’re done, and don’t take any action that could disrupt users or isn’t easily reversible.

Spend time with Jamf Docs, too, so when you hit an unfamiliar scenario and need to reference documentation, you’ll be familiar with how everything is laid out for quick finding.