Using Account-driven User Enrollment

Before you begin

Note: Use account-driven user enrollment on iOS/iPadOS 15 or later. On iOS/iPadOS 18 or later, you must use account-driven enrollment because the SOTI Enrollment service isn’t supported. On iOS/iPadOS 14 or earlier, you must use the SOTI Enrollment service.
To configure Account-driven user enrollment:
  • SOTI MobiControl must be on version 2025.0.1 or later.

  • You must have managed Apple IDs or enterprise accounts federated in Apple Business Manager (ABM).

About this task

Account-driven user enrollment simplifies Bring Your Own Device (BYOD) setup and management by eliminating the need for users to download and install enrollment profiles manually. Instead, users sign in directly on their device using a Managed Apple ID or a federated ABM account. Account-driven enrollment involves:
  1. Configuring the Discovery Service.
  2. Enrolling an Apple Device.

Configuring the Discovery Service

Procedure

  1. Create a user-based iOS enrollment policy with Account-driven enrollment enabled. See Creating an iOS Enrollment Policy.
    Important: Ensure that only one account-driven enrollment policy is active. If more than one policy exists, set the required policy as the default in the Global Settings > Enrollment > Enrollment Rules section.
    Setting a default iOS(Account-Driven) rule in Global Settings.
  2. Select Download JSON in the created enrollment policy to download the .JSON registration file.
    Selecting Download JSON to download the JSON registration file.
    //Example JSON registration file content

{
  "Servers": [
    {
      "Version": "mdm-byod",
      "BaseURL": "https://<your-mobicontrol-server>/appleenrollment/userenroll.mobileconfig"
    }
  ]
}
  3. Host the .JSON file at a well-known endpoint in your enterprise’s service discovery system.
    Example: A GET request to https://acme.com/.well-known/com.apple.remotemanagement should return the JSON object with your SOTI MobiControl enrollment base URL.

Enrolling Your Apple Device

Procedure

  1. On the device, navigate to Settings > General > VPN & Device Management.
    Navigating to the VPN settings on the iOS device.
  2. Select Sign In to Work or School Account.
    Signing in to a Work or School Account on an iOS device.
  3. When prompted, enter your Managed Apple ID or federated user account. The device uses this account to find the correct enrollment URL from the com.apple.remotemanagement domain.
    Signing in with a Managed Apple ID on an iOS device.
  4. Enter your organizational username and password to authenticate.
  5. After successful authentication, the device automatically receives the enrollment profile. Follow any on-screen instructions to complete enrollment.
    The Remote Management screen.
  6. If required, authenticate again to complete the device configuration.

Results

After enrollment, the device applies managed apps and profiles. Check the device details in SOTI MobiControl to confirm that the user account is linked successfully.