Adding an Existing Device to Automated Device Enrollment

Automated Device Enrollment (ADE) is the fastest way to get a fully managed Apple device: unbox it, join the Wi-Fi network, and the device checks in with your management service on its own. In practice, though, almost no SMB buys its entire fleet through Apple or an authorized reseller all at once. There are already MacBooks in use, a box of iPhones was bought at a local shop, or an employee brings their own device. Those devices don’t automatically show up in Apple Business, and so they’re not part of the ADE flow either.

The good news: this is fixable. Apple Configurator lets you manually add existing, already-purchased devices to Apple Business, after which they behave (almost) the same as an ADE device. This whitepaper shows exactly how that works: which devices qualify, what you need to arrange beforehand, the steps for Mac and for iPhone/iPad, and what to watch out for with a device that’s already in use.

Which devices can you add after the fact?

Apple Configurator supports adding several device types to Apple Business or Apple School Manager, provided they meet the minimum software requirements.

Two tools, one goal

There are two separate apps that both go by the name “Apple Configurator,” with overlapping but different capabilities.

Requirements before you start

Each device type needs to be sitting on a specific screen in the setup assistant before Configurator can take over, and it needs to meet a minimum OS version:

For a Mac, there’s an additional requirement: only models with an Apple silicon chip or T2 security chip qualify. You can connect over Wi-Fi sharing from the iPhone running Configurator, through a configuration profile, or over Ethernet. To log in, you need a Managed Apple Account with device management permissions in Apple Business.

If the device is already in use: wipe it first

This is exactly the scenario many SMBs run into: an employee has already been working on their MacBook for six months, or there’s a box of iPhones sitting around that was bought outside of Apple’s channels. Once the device is wiped and back on the right Setup Assistant screen, you can continue with the steps below.

Step by step: adding a device with Apple Configurator for iPhone

1. Open Apple Configurator for iPhone on an iPhone or iPad signed in with a Managed Apple Account that has device management permissions.
2. Make sure the target device is on the right Setup Assistant screen (see the requirements above).
3. Start “Add Device” in the app and scan the QR code that appears on the target device, or enter the 6-digit code manually if scanning isn’t possible.
4. Confirm the pairing on both devices.
5. Choose whether the device is assigned to a management service right away, or whether that happens manually later.
6. Finish the pairing; the device then appears in Apple Business under Devices.

Step by step: preparing a Mac with Apple Configurator for Mac

Apple Configurator for Mac uses a “Prepare” assistant to add the Mac it’s running on (or a connected Mac):

1. Open Apple Configurator for Mac and choose “Prepare with manual configuration.”
2. Leave the “Activate and Complete Enrollment” checkbox on or turn it off, depending on how you want to hand over the device (see the next section).
3. Choose “New Server” and give it a recognizable name, for example “Apple Business.”
4. Skip the certificate (not needed for Apple Business).
5. Select the right organization.
6. Log in with a Managed Apple Account that has device management permissions.
7. Let Configurator generate a new supervision identity.
8. Choose which Setup Assistant screens should be skipped for the end user.
9. Optionally include a Wi-Fi configuration profile.
10. Authenticate with a local macOS administrator account.
11. Click “Prepare” to start the preparation process.
12. Confirm “Erase All Content and Settings” if prompted (on a Mac that’s already configured).
13. Wait for the Mac to restart and check in with Apple Business.

Two enrollment modes: automatic or manual

After adding: assigning a management service

A device added through Configurator appears in Apple Business under Devices > Inventory, in the “Apple Configurator” source group, not yet linked to a management service. To do that:

1. Go to Devices > Inventory.
2. Filter by Source: Apple Configurator.
3. Select the device (or several at once).
4. Choose “Assign to Server” and select the right service (for example Microsoft Intune or Apple’s own MDM).
5. Confirm the assignment.

The 30-day trial period

As also described in From Enrollment to Deployment, devices added through Configurator get a 30-day trial period: during that time, the end user can still unilaterally detach the device from Apple Business. After 30 days, the link becomes permanent. This differs from “true” ADE devices (purchased through Apple or an authorized reseller), where this trial period doesn’t apply.

What happens if the enrollment is removed?

On iOS and iPadOS 14 and later: if the device’s MDM enrollment profile is removed, the device automatically resets itself to factory settings and is disconnected from Apple Business. Keep this in mind during troubleshooting: removing a profile isn’t a harmless action on a device added through Configurator.

Practical scenario: an SMB with an existing device fleet

A common path for an IT contact at an SMB with, say, 15 MacBooks already in use:

1. Take stock of which Macs have an Apple silicon chip or T2 chip; older Intel models without T2 are excluded.
2. Plan the wipe session with users: back up, sign out of iCloud, turn off Find My.
3. Wipe each Mac using “Erase All Content and Settings” and leave it sitting on “Select Your Country or Region.”
4. Use Apple Configurator for Mac (on one management laptop) or Apple Configurator for iPhone (on the IT contact’s phone) to pair each Mac.
5. Deliberately choose manual completion if employees need to sign in with their own Managed Apple Account.
6. Assign all added Macs in Apple Business to the right management service before users continue through Setup Assistant.
7. Let users finish setting up their Mac; Platform SSO and other configuration profiles roll out automatically once the Mac checks in with the management service.
8. After 30 days, check that all devices have passed the trial period and are permanently linked.

With this route, an SMB doesn’t have to wait for the next hardware refresh cycle to benefit from automated device management. Even an existing fleet, bought here and there over time, can still end up fully under Apple Business and your management service.

Analyst ICT is an officially recognised Apple Technical Partner. Want to know more about Apple within your organisation? See our overview for business or email frank@analystict.nl.