Using Account-driven User Enrollment

Account-driven user enrollment streamlines Bring Your Own Device (BYOD) setup and management. Users no longer need to download and install enrollment profiles manually. Instead, they sign in directly on their device with a Managed Apple ID or a federated Apple Business Manager (ABM) account.

Before you begin

Important: Use account-driven user enrollment on devices running iOS 17 or later or iPadOS 17 or later. Devices on iOS 18 or later or iPadOS 18 or later must use account-driven enrollment (the SOTI Enrollment service is not supported). Devices on iOS 16 or earlier and iPadOS 16 or earlier must use the SOTI Enrollment service.
  • SOTI MobiControl version 2025.0.1 or later
  • Apple devices running iOS 17 or later, or iPadOS 17 or later

  • Managed Apple IDs or enterprise accounts federated in Apple Business Manager (ABM)

Account-driven enrollment involves:
  1. Configuring the Discovery Service
  2. Enrolling an Apple Device

Configuring the Discovery Service

Procedure

  1. Create a user-based iOS enrollment policy with Account-driven enrollment enabled. See Creating an iOS Enrollment Policy.
  2. Select Download JSON in the created enrollment policy to download the .JSON registration file.
    Selecting Download JSON to download the JSON registration file.
    //example JSON registration file content

{
  "Servers": [
    {
      "Version": "mdm-byod",
      "BaseURL": "https://<your-mobicontrol-server>/appleenrollment/userenroll.mobileconfig"
    }
  ]
}
  3. Host the .JSON file at a well-known endpoint in your enterprise’s service discovery system. For example, a GET request to https://acme.com/.well-known/com.apple.remotemanagement should return the JSON object containing your SOTI MobiControl enrollment base URL.

Enrolling Your Apple Device

Procedure

  1. On the device, navigate to Settings > General > VPN & Device Management.
    Navigating to the VPN settings on the iOS device.
  2. Select Sign In to Work or School Account.
    Signing in to a Work or School Account on an iOS device.
  3. When prompted, enter your Managed Apple ID or federated user account. The device uses this account to find the correct enrollment URL from the com.apple.remotemanagement domain.
    Signing in with a Managed Apple ID on an iOS device.
  4. Enter your organizational username and password to authenticate.
  5. After successful authentication, the device automatically receives the enrollment profile. Follow any on-screen instructions to complete enrollment.
    The Remote Management screen.
  6. If required, authenticate again to complete the device configuration.

Results

After enrollment, the device applies managed apps and profiles. Check the device details in SOTI MobiControl to confirm that the user account is linked successfully.