Hacker News Reader

Comment by Avamander | Hacker News Reader

It's not very trivial to manage an Apple device and Apple would shut down those ABM tenants real quick. Not to mention, supervision requires enrollment pre-setup, which is really difficult.

So "just replace x with y" does not really work in this context, MDM is vastly more effort than you think and OP-s point still stands.

View on HN

MDM is not easy but you can enroll devices after the fact, pre-enrollment isn’t the only option. But yes, it’s a PITA to deal with even at the best of times.

You can, but that does not give you a supervised device, as I said.

Ahh, maybe I’m mistaken or maybe iOS works differently. I believe you can enroll it in MDM and then you have 30 or 60 days to kick it out at any time and then it becomes fully locked in. Or perhaps I have my terminology wrong. I only scratch the surface of MDM at my company.

This is more to do with ABM - you can add a device to ABM that wasn’t put there by a reseller/vendor/Apple. This also enrols the device, and removing the enrolment in the first 30 days also removes it from ABM again.

After the 30-day period, the enrolment profile cannot be removed on the device-side. This workflow applies for both iOS and macOS.

On macOS the enrolment is supervised either way. You can also get a supervised enrolment on an iOS device that isn’t in any ABM instance - there is more than one path to supervision.

Reply on news.ycombinator.com