Home > Enterprise Mobility Management > Device Enrollment > Using Apple's Device Enrollment Program (DEP) with Systems Manager

Using Apple's Device Enrollment Program (DEP) with Systems Manager

The Apple Device Enrollment Program (DEP) allows administrators to enroll devices in Systems Manager prior to even touching the devices, and provides an additional level of management control. This greatly increases the simplicity of adding and deploying iOS and OS X devices with Systems Manager. This article will cover how to use the Apple DEP with System Manager.


For additional information on DEP, including how to enroll, please review Apple's Device Enrollment Program Overview.

The following video also outlines an example DEP configuration and deployment through Systems Manager:


Linking Systems Manager to Apple DEP

In order to use the Apple DEP with Systems Manager, a Systems Manager deployment must be linked to an organization within DEP. These steps assume an Apple ID for the organization has already been created, as outlined in the Device Enrollment Program Guide.

  1. In Dashboard, create an EMM network for Systems Manager.
  2. Navigate to Organization > Configure > MDM, then scroll down to the Apple Device Enrollment Program section.
  3. Download the Meraki_Apple_DEP_cert.pem file provided.
    • If someone has downloaded the .pem file previously, and the server token has expired, click clear token in order to download the .pem file again.
  4. In another browser window, go to https://deploy.apple.com/ and sign in with the Apple ID tied to the desired organization.
  5. Navigate to Device Enrollment Program > Manage Servers.
  6. Click Add MDM Server.
  7. Enter a Name for the MDM server in DEP, then click Next.
  8. Click Choose File... and upload the public key downloaded in step 2, then click Next.
  9. Download the server token provided, then click Done.
  10. Back in Dashboard, click on the Choose File button in step 3.
  11. Select/upload the server token downloaded in step 8.
  12. Choose the default Systems Manager network where devices tied to this MDM server in DEP will be enrolled.
  13. Click Save Changes.

If you encounter an error uploading the server token to Dashboard, make sure that the file name ends in 'smime.p7m' without any trailing characters like '(1)' that may appear from downloading multiple copies of the file.

Renewing a DEP Token

Apple DEP tokens last for one year by design. To continue enrolling via DEP:

  1. Log in to deploy.apple.com.
  2. Select the MDM server for your organization.
  3. Click on Generate New Token.
  4. Upload the token to Dashboard under Organization > MDM.

Assigning Devices

Devices can be assigned to Systems Manager by Apple Order Number of Serial Number. 

  1. In Apple DEP, navigate to Device Enrollment Program > Assign by Order Number or Assign by Serial Number.
  2. Provide the Order Number or Serial Number(s).
  3. Select the MDM server configured earlier.
  4. Click Assign Now.

System Manager will automatically populate the MDM > DEP tab with any devices that have been correctly assigned and associated.


Note: To be eligible, devices must have been purchased directly from Apple within the last three years, or through participating resellers and carriers. For more information regarding this and supported countries, please refer to Apple's Device Enrollment Program page.

Applying Settings to Devices

DEP settings are applied during setup assistant, either upon setting up the device for the first time, or after a factory reset for devices already in use. 

After devices have been assigned to Systems Manager via DEP, they will automatically be enrolled in the default Systems Manager network upon setup. Additional settings can be configured in order to further enhance the deployment process.

  1. Navigate to MDM > DEP within the Systems Manager network.
  2. Click the checkbox next to any devices that require settings be applied.
  3. Click Assign settings.
  4. Complete the fields/selections that appear:
    • Name: A friendly name for the group of settings applied.
    • Allow pairing: Devices can be paired with a computer. Note that if unchecked, devices will not be able to connect to applications like Xcode or iTunes on a computer.
    • Supervise: Supervise devices upon enrollment.
    • Mandatory: Users are required to complete enrollment during setup.
    • Removable: The management profile can be removed.
    • Support phone number: A number provided to users during setup if help is required.
    • Department: Group the device is assigned to; displayed during setup.
    • Skip: Steps of the setup process to skip. They can be completed later if needed.

  5. Click Assign # device(s).
  6. In most cases, the device(s) should be factory reset at this point. This is required to ensure the device is activated and configured with DEP settings.
    1. On a Mac, restart in Recovery Mode and reinstall the operating system. On an iOS device, navigate to Settings > General > Reset, then tap Erase All Content and Settings.
    2. Confirm by tapping Erase.
    3. In some cases, this may be required for brand-new device as well, if Apple doesn't correctly push the DEP settings during the initial activation process. 

Please choose Set Up as New Device, or skip the "Restore from Backup" option entirely when assigning the DEP settings. It is not recommended to restore from iCloud or iTunes backups. 

 setup as new iOS device


To apply profiles and additional settings to devices, the appropriate tags will need to be applied. Profiles tied to those tags will then be applied to the devices upon enrollment.

  1. Navigate to MDM > DEP.
  2. Click the checkbox next to any devices the tag must be applied to.
  3. Click Tag.
  4. Within the Add box, type the tag that should be applied to the device(s). If it is an existing tag, select it from the list. Otherwise, click Add option create a new tag. Tags must not contain spaces.

  5. Click Add to apply the tag(s).

Removing Settings from Devices

In the event a device needs to be reset and managed under different conditions, the settings applied via DEP can be removed.

  1. Navigate to MDM > DEP.
  2. Click the checkbox next to the device(s) in question.
  3. Click Remove settings


If tags were applied to a device prior to enrollment, they can also be removed to prevent profiles and apps from associating.

  1. Navigate to MDM > DEP.
  2. Click the checkbox next to the device(s) in question.
  3. Click Tag.
  4. In the Remove box, select any tags that should be removed from the device.
  5. Click Remove.

Recovering DEP Devices

If a DEP-enrolled device is removed from Systems Manager, it will not automatically reappear without taking additional steps to sync Dashboard with Apple DEP.
For specific instructions on DEP device recovery, please refer to our documentation for more info.

Clearing Apple DEP Token

There are some instances where a DEP token needs to be removed to resolve an issue, or to use a different MDM server on the Apple side. To do this, navigate to the Organization > MDM page. Under Apple Device Enrollment Program, click the Clear Server Token button. This will remove the existing token and allow a new one to be uploaded.

Note: Once the DEP token has been cleared, the client drop-down menu under MDM > DEP with existing DEP settings will be cleared.


It is important to note that any devices that need to be associated with the organization in Dashboard must also be assigned to the new MDM server within Apple's DEP portal. So if the MDM server is changing, the devices should also be reassigned. Avoid doing this if possible when there are a large number of devices already assigned with settings, as clearing the DEP token will purge these assigned settings in the cloud (but not on devices themselves). It is also recommended that a list of assigned devices be exported to a spreadsheet, within the Apple site, to aid in the reassignment process.

You must to post a comment.
Last modified
12:11, 22 May 2017



This page has no classifications.

Article ID

ID: 1267

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case