Apple device management: configuration profiles and declarative management
You learn the building blocks of managing an iPhone and iPad fleet: configuration profiles and payloads, supervised mode, automated enrolment, managed apps, declarative management and profile signing, all tried on files and a simulated server.
Level 301 · 22 lessons · 18 practice labs
Lessons
Profiles
- Structure of a configuration profile: payloads and identifiers
- Passcode and restrictions payloads
- Wi-Fi, VPN and certificate payloads
- Signing and encrypting profiles
- Profile removal and precedence between conflicting settings
- Short task: write, sign and verify a profile with passcode and Wi-Fi payloads
Enrolment and supervision
- Enrolment types: user enrolment, device enrolment, automated enrolment
- Supervised mode and the settings it unlocks
- The push certificate and the device check-in flow
- Managed Apple accounts and data separation
- Short task: order a device's enrolment steps from the simulated server's records
Commands and apps
- MDM commands and queries: device information, lock, erase
- Managed apps and managed open-in rules
- Per-app VPN and managed domains
- Update management: deferral and enforcement
- Short task: write the setting that stops work documents opening in personal apps
Declarative management and auditing
- Declarative management: declarations, activations, the status channel
- Writing declarations: configurations and assets
- Auditing installed profiles: comparing with what is expected
- Managing lost mode and Activation Lock for the organisation
- Short task: compare a device's installed profile list with the baseline and find the extra one
Capstone
- Capstone: write and audit the profile set for a clinic chain's shared iPads
Practice labs
- Read a profile's identifiers and payloads: Find the payload types and the removal setting.
- Write a profile with passcode and Wi-Fi payloads: Prepare a valid .mobileconfig and validate it as a plist.
- Sign a profile and verify the signature: Sign the profile with the lab certificate using openssl, verify it and explain the difference from the unsigned version.
- List the features a restrictions payload turns off: Write down the keys and values in the payload.
- Decide which setting wins between two conflicting profiles: Compare the passcode settings of two profiles and justify the value the device will apply.
- Separate the settings that need supervision: Mark the items in a restriction list that work only on supervised devices and write a plan by enrolment type.
- Order the enrolment steps from server records: Put the authenticate and token update messages on the simulated server in order.
- Determine the enrolment type from the device response: Prove from the fields in the response whether it is user or device enrolment.
- Write a push certificate renewal plan: Find the certificate's expiry, explain what happens if it lapses and write renewal steps with dates.
- Read the response to a device information query: Extract version, supervision and encryption state from the response.
- Stop work documents opening in personal apps: Add the managed open-in settings to the profile and validate.
- Define per-app VPN and managed domains: Write the payload and domains so that only the Lavinya Klinikleri patient app uses the VPN.
- Read a declaration's type and content: Tell configuration, asset and activation declarations apart.
- Write a declaration for a passcode policy: Write the configuration and activation declarations and have the simulated server validate them.
- Find the declaration that did not apply from the status report: Examine the device's status channel response, fix the faulty declaration and revalidate.
- Compare the installed profile list with the baseline: Find the extra profile.
- Report missing and outdated profiles: Tabulate the missing and outdated profiles across ten devices' lists.
- Write and audit the profile set for shared iPads: Write restriction, Wi-Fi and single-app mode profiles for Lavinya Klinikleri's reception iPads and verify them against a checklist.
About this course
You learn the building blocks of managing an iPhone and iPad fleet: configuration profiles and payloads, supervised mode, automated enrolment, managed apps, declarative management and profile signing, all tried on files and a simulated server.
What you will learn
- Profiles
- Enrolment and supervision
- Commands and apps
- Declarative management and auditing
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.