Academy
Technical · Course T3

Lesson 2 of 4

Automated enrollment via ABM

9 min read
In this lesson you'll learn to
  • Run the WeGuard ↔ ABM token exchange end to end
  • Assign devices to the WeGuard MDM server in ABM and sync them
  • Explain token validity and what expiry breaks

The automated-enrollment setup is a fifteen-minute, one-time exchange per tenant. Partners should be able to run it from memory — it's the most common Apple onboarding task.

Before you start

  • iOS platform enabled under Settings → Platform
  • APNs configured and Valid (previous lesson — DEP setup refuses to work without it)
  • An ABM account, signed in with an Apple ID not tied to personal devices or other DEP/VPP accounts

The token exchange

Six steps, alternating between WeGuard and ABM:

  1. WeGuard → download the public key. In Settings → Apple → DEP, the not-yet-enrolled state offers WeGuard's public key file (.pem). Download it — it's unique to this tenant and establishes the trust relationship.
  2. ABM → create the MDM server. In ABM Preferences → MDM Servers, add a server (name it recognizably, e.g. "WeGuard MDM") and upload that public key.
  3. ABM → download the server token. After saving, download the .p7m server token.
  4. WeGuard → upload the token. Back in the DEP tab, drop the .p7m into the upload zone and complete.
  5. Verify. The DEP tab now shows the certificate details — organization, server name, UUID, and S/MIME expiry — with a green Valid badge. The DEP Setup tab unlocks.
  6. Calendar the expiry. The token is valid one year. Expired token = new devices stop auto-enrolling. Renewal is the same dance: new token from ABM, upload.

Assign and sync devices

Binding done, devices flow in two motions:

  • In ABM → Devices: select devices → Edit MDM Server → assign to the WeGuard server. From now on they auto-enroll (supervised) whenever they're activated or restored.
  • In WeGuard → DEP tab → Sync Devices: pulls the assigned device list from ABM into the Devices view. Run it after assigning new batches — sync is on demand, not automatic.

When it fails

  • Token upload rejected — confirm APNs is Valid first; the DEP flow depends on it.
  • Assigned device skipped MDM at activation — check the token hasn't expired and the device's serial is actually assigned to the WeGuard server in ABM.
  • Devices missing in WeGuard — you assigned in ABM but didn't hit Sync Devices.
Knowledge check
1. What is the correct order of the ABM binding?
2. How long is the ABM server token (.p7m) valid?
3. Devices were assigned to the WeGuard server in ABM but don't appear in WeGuard. What's the missing step?
4. Which devices can be assigned to WeGuard in ABM?
Apple MDM foundationsSetup Assistant & supervised policies