1_-_OIMT_Apple_Device_DEP_WorkFlow.pdf

OIMT Apple Automated Device Enrollment (ADE) Program Workflow

Overview of the Workflow The workflow will provide guidance to OIMT Employees as it pertains to the Purchase/Upgrade of an Apple iOS/iPadOS/MacOS Device. There are 3 Phases to the process:

• Phase 1: Purchasing & Onboarding o Onboarding is a 1-time process performed by the Carrier/Vendor in which they will “ONBOARD” an Apple

Device into the DOI Apple Business Manager (ABM) Portal.

• Phase 2: Apple Business Manager (ABM) Approving & Linking o Approving & Linking is a 1-time process performed by the OIMT Mobile Device Team in which they will “APPROVE & LINK” the onboarded device from Phase 1 within the DOI ABM Portal.

• Phase 3: Powering ON & MaaS360 Enrollment o Powering ON and Enrolling a mobile device is the process performed by an IT Specialist and/or End User in which the mobile device is enrolled into the DOI Enterprise MDM Solution (MaaS360).

Phase 1: Purchasing & Onboarding Purchasing All Carriers/Vendors are REQUIRED to be a part of the Apple Device Authorized Carriers/Vendors List. The entities currently on this list have been authorized and are capable of processing Apple mobile devices into DOI’s Apple Business Management Portal. Any Carrier/Vendor qualified to by Apple to support DEP that are not found on the list can be added.

For adding vendors to ABM, that's going to be done via a UM Mobile Devices GFE Support ticket via Remedy. There's no "email" to request that; that ticket will be assigned to us and will be enter the new vendor, as needed, into DOI's ABM portal. The current list of vendors added to ABM:

https://support.apple.com/en-us/HT213320#United%20States

Keep in mind that many vendors will ask for a copy of the above screenshot to ensure they are listed in our ABM vendor.

A vendor cannot add devices into our environment until they are active and listed on this list inside DOI's Apple Business Manager (ABM) portal. So all this must be staged before devices are ordered and shipped.

DOI's ABM ID: 1488513 Many vendors will ask for this screenshot for them to ensure the ID of our ABM environment

Samsung Android Knox Mobile Enrollment (KME) is a requirement for the Android side. That information and the requirements listed above for vendors is roughly the same for KME. See link below

The document linked below is tailored to the procurement and contract specialist who would be tasked with ordering devices for users.

Use Apple Device Enrollment (ADE) and Knox Mobile Enrollment (KME) for all device purchases

All Carriers or Vendors (unless they are Verizon & AT&T) will require an “Onboarding Request” be made at the time of purchase into DOI’s Apple Business Management Portal (this request can be placed in the comments or notes of the procurement request).

If a Carrier/Vendor is NOT currently part of the Apple Device Authorized Carriers/Vendors List, the following process is required to successfully add the Vendor to the Authorized List.

How to Add Vendor to the Authorized Vendors for Apple Products List

1. Before purchasing, confirm with Vendor that they support DEP and ask if there is any form or process necessary to complete.

2. Send an email to IA_OIMT_Mobile_Devices@bia.gov with the Subject Line – “Add Vendor for ABM” and provide the Vendor Name and the Vendor’s ABM ID# in the details.

3. The Mobile Team will process the request through DOI which may take 24-48 hours.

4. The Vendor will be added to DOI’s ABM and the Approved Vendor List.

5. The Mobile Team will respond to the email providing further guidance which will include the DOI ABM information you will need to pass along to the new vendor so they can onboard the device properly.

a. DOI ABM Information: Office of the Secretary U.S Department of Interior -- Organization ID:

1488513

Onboarding Onboarding is the process where the Vendor or Carrier loads the mobile device into DOI’s Apple Business Manager (ABM). In the case of Verizon and AT&T, this process has been automated and performed 24-48 hours after the device is scheduled to ship.

All other Carriers/Vendors require the Purchaser to make the “Request to Onboard” during the purchase of the device, usually within the comment field or additional service requested.

https://doimspp.sharepoint.com/:w:/s/BisonConnect/EYlImqDlaT1DpN9gsMsRAC0BJnHODzRLCxp2Ezz5TmouDg?e=Mj8QiB mailto:IA_OIMT_Mobile_Devices@bia.gov

Phase 2: Apple Business Manager (ABM) Approving & Linking DEP/ABM Portal Approval The Approval process must be completed BEFORE the device is ever turned ON. If the mobile device has been turned ON prior to this process, a manual Factory Reset is required before continuing.

1. Remove any Apple ID Account that was added or used – Settings > Tap on Apple ID (User) > Scroll down and Tap Sign Out – Enter Apple ID Password and Tap Turn Off in Upper Right Corner – Toggle Off All Items for Keep a Copy listed – Tap Sign Out – Tap Sign Out Again (if necessary)

2. From the Main Screen – Settings > Transfer or Reset iPhone > Erase All Content and Settings – follow any remaining prompts to complete the process.

In most cases the following steps will be performed by the Purchaser, however, if the device is sent directly to the User or IT Support, they may be responsible for ensuring the device has been approved.

The following information MUST be emailed to the IA_OIMT_Mobile_Devices@bia.gov.

How to Request DEP Approval for Apple Mobile Devices

1. Send an email to IA_OIMT_Mobile_Devices@bia.gov with the Subject Line -- “DEP Approval Request” and provide the Serial # or IMEI # associated with the device.

2. The Mobile Team will process the request normally within 24 hours (may take longer if the proper information is not submitted.

3. The Mobile Team will respond to the request providing further guidance.

Phase 3: Powering On & MaaS360 Enrollment The DEP enrollment phase is where the Apple device is powered on after the completion of the Onboarding Process.

DEP enrollment happens in the background between multiple servers and takes most of the screen tapping away, giving a quicker and cleaner experience for the user. IT admins will no longer have to create an enrollment and tap through numerous screens to get things started. DEP also provides an extended list of STIG settings that give the Enterprise MDM/MAC Solution better control over a mobile device, one in particular, OS Update Settings.

Here are the steps for a successful enrollment:

If at any time during this process, if you are asked to enter an Apple ID....STOP! This means the device has not been approved or was turned ON prior to being approved and requires the device to be Manually WIPED back to Factory. From the Main Screen – Settings > Transfer or Reset iPhone > Erase All Content and Settings – follow any remaining prompts to complete the process.

1. Power ON Apple device (Device will either need Cellular Data Activated or WiFi Connectivity)

2. IT Specialist or User Interaction

a. A few startup screens will need to be processed before bringing the device to it’s main Home Screen. In particular, look for the screen that states the device is Remotely Managed by DOI.

i. If you do not see this screen, STOP and verify that the device has been Approved by sending an email with the Serial # of the device to IA_OIMT_Mobile_Devices@bia.gov

b. During this time, the Apple device will begin the initial LINKING with Enterprise MDM Solution (currently

MaaS360).

3. MaaS360 Admin (see MaaS360 Region/Local POC Listing)

a. Identifies the device via Serial # to verify it’s LINKED in MDM

b. Enrolls the device by assigning the USER to the device

i. Shared Data Collection Devices, the user will be the one responsible for maintaining the device, keeping it up to date and in compliance. (usually an AO, Supervisor, or IT Specialist)

ii. NO APPLE IDs REQUIRED

4. Upon completion of “User Assignment” the policy push will begin the flow of applications that are typically installed and configured (MaaS360, App Catalog, Authenticator, Teams, Outlook, etc).

a. MS Authenticator MUST be the first application configured before proceeding with any additional App configurations.

i. MS Authenticator Setup for New User

5. The remaining applications can be configured at this time. Any additional support requests will need to be processed through Local or Regional IT HelpDesk - Submit a Helpdesk Ticket https://doimspp.sharepoint.com/:w:/r/sites/BisonConnect/_layouts/15/Doc.aspx?sourcedoc=%7B256CF54C-68BF-4B04-9EB4-C519C7C8564F%7D&file=Using%20MFA%20Temporary%20Pass%20Code.docx&action=default&mobileredirect=true&DefaultItemOpen=1 https://indianaffairs.servicenowservices.com/

Phase 3: Powering On & MaaS360 Enrollment