Hacker News Reader

MDM is not easy but you can enroll devices after the fact, pre-enrollment isn’t the only option. But yes, it’s a PITA to deal with even at the best of times.

View on HN

You can, but that does not give you a supervised device, as I said.

Ahh, maybe I’m mistaken or maybe iOS works differently. I believe you can enroll it in MDM and then you have 30 or 60 days to kick it out at any time and then it becomes fully locked in. Or perhaps I have my terminology wrong. I only scratch the surface of MDM at my company.

This is more to do with ABM - you can add a device to ABM that wasn’t put there by a reseller/vendor/Apple. This also enrols the device, and removing the enrolment in the first 30 days also removes it from ABM again.

After the 30-day period, the enrolment profile cannot be removed on the device-side. This workflow applies for both iOS and macOS.

On macOS the enrolment is supervised either way. You can also get a supervised enrolment on an iOS device that isn’t in any ABM instance - there is more than one path to supervision.

Reply on news.ycombinator.com