Help

Help

What this tool cannot do for you, and the order to do it in. The ticks are a working aid and are not saved — start each phone with a clean list.

Adding a phone to SimpleMDM

Do this once per handset, in this order. Step 1 is the one that bites: get it wrong and the phone locks itself out.

  1. 1 · Sign the Apple Account out ON THE PHONE

    Settings → tap the name at the very top → scroll down → Sign Out. It asks for that Apple ID password. Do this before erasing. Signing out is what clears Activation Lock; erasing while still signed in leaves Setup Assistant demanding the previous owner’s Apple ID, and the phone is stuck until somebody produces it. Releasing the device in Apple Business is NOT the same thing.

  2. 2 · Assign the device to SimpleMDM in Apple Business

    Apple Business → Devices → find the serial → assign it to the SimpleMDM MDM server. If it refuses with "Cannot Assign Device Management — active user enrolment", step 1 has not taken effect yet.

  3. 3 · Make SimpleMDM notice

    SimpleMDM only learns about the assignment when it syncs with Apple, which happens on its own schedule — it can be hours. In SimpleMDM go to the Automated Enrollment / DEP server and press Sync. The device then appears as "awaiting enrollment". Note the console hides those from the default Devices list, so filter by status or look under the DEP server itself before concluding it is missing.

  4. 4 · Erase the phone

    Settings → General → Transfer or Reset iPhone → Erase All Content and Settings. Assigning a device in Apple Business does not enrol a phone that is already set up — enrolment only happens when the device next runs Setup Assistant.

  5. 5 · Through Setup Assistant

    Join sfnet when asked for a network. At the Apple Account step choose Later — there is no Skip, only Later. Everything else can be dismissed.

  6. 6 · Confirm it landed

    The device should flip to enrolled and supervised by itself. Check it in SimpleMDM, then run a sync here (Sync in the sidebar) so the tool fills in its SimpleMDM id. Until that happens the phone is skipped by pre-flight with "not enrolled in SimpleMDM", which is also what you will see in run logs.

  7. 7 · Check the kit list

    The ten suitcase serials are already on the kit allow-list, so normally there is nothing to add. If this is a replacement handset, add it on the kit page with the number written on the Spigen case — that number becomes the device name, e.g. SPOTME-K1-05.

After every run, on every phone

The erase resets both of these and iOS has no MDM payload for either, so they come back every single time. About thirty seconds a handset.

  1. 1 · Open the app once and allow the camera

    iOS has no way for us to pre-grant a camera permission. Somebody has to tap Allow. Ten taps in the office, or a rep at a booth who cannot scan.

  2. 2 · Turn Location Services on

    Settings → Privacy & Security → Location Services → on, and System Services → Setting Time Zone on. The phone then works out its own time zone anywhere in the world and keeps its clock synced. Without it the device has no idea where it is: iOS takes the clock from the network but the zone from location, so a kit flown to the US keeps showing Swiss time.

Adding a customer app

  1. 1 · Buy the licences in Apple Business. Apps and Books, at least one per phone, assigned to the Organisational Unit linked to the SimpleMDM server. Skip this and the install fails at the device with no useful error.
  2. 2 · Wait for SimpleMDM to pick it up. It syncs the app into its own catalogue by itself. Nothing to do there.
  3. 3 · Import it here. Apps → Import from SimpleMDM → type the customer name → Import. The App Store ID and bundle ID come across automatically, so there is nothing to mistype. Only use "Add an app by hand" for something SimpleMDM has not synced.

Adding a Wi-Fi network

Always a SimpleMDM step — this tool cannot create one. Return to Service only accepts SimpleMDM's own Wi-Fi profiles, and their API has no endpoint for making them. The upside is that no venue Wi-Fi key is ever stored here.

  1. 1 · SimpleMDM → Configs → Profiles → Create Profile → Wi-Fi
  2. 2 · Network name (SSID), security type, password. Tick Auto-join, or the phones will not reconnect by themselves after a drop.
  3. 3 · It appears in this tool immediately — the run form and the kit page read the list live.
  4. 4 · Push it to the phones from the kit page before they travel. A phone with no network cannot be sent anything, so this does not work once a kit has already landed somewhere.

When something looks wrong

A phone I just assigned is not in SimpleMDM
SimpleMDM has not synced with Apple yet. Press Sync on the Automated Enrollment server. Also check the console is not hiding it — devices awaiting enrollment are filtered out of the default Devices list.
A phone is skipped at pre-flight
The run log says why, per serial. "Not enrolled" means it has not finished Setup Assistant or the tool has not synced since. "Supervision not reported" means SimpleMDM does not yet know it is supervised — a run will not erase a phone it cannot confirm is supervised, because Return to Service needs it.
The clock is wrong on a provisioned phone
Almost always the time zone, not the clock. Do the Location Services step above. For a kit already at a venue, the kit page can push a time zone to every phone without erasing anything — that is the recovery path, not the main one.
All the Apple apps are back on the home screen
Normal during setup — iOS restores them and the restrictions profile hides them a moment later. If they are still there several minutes after the run finished, the profile did not apply and the run log is the place to look.
Never delete a Wi-Fi profile from SimpleMDM
These phones have no SIM. The Wi-Fi profile is what keeps them on the network, so removing it takes a phone offline where it stands and it has to be picked up by hand. The office profile is a standing one and a run neither creates nor deletes it.