Setting up the Deployment of iPhones with DEP, VPP, and AirWatch, and Ground Control.
The following page will help guide you through provisioning iOS devices, leveraging Apple's Device Enrollment Program (DEP), Apple's Volume Purchasing Program (VPP), GroundControl (GC) and AirWatch (AW).
Before you begin
Creating the AirWatch Environment
This section outlines how to create a new AirWatch environment from scratch that is built for VPP and DEP.
Primary role responsible: AirWatch Administrator
Initial Org Set Up
This section outlines the steps to create the organization in AirWatch to be used for the hospital’s devices.
- Access Parent Level org set up by AirWatch via purchase order
- Name: [Hospital Name] - Pink
- GroupID: [Hospital Abbreviation]vcp
- Type: Customer
- Create Child Level org
- Name: [Hospital Name] - iPhones
- GroupID: [lowercase hospital abbreviation]ios
- Type: Container
- Internal Name/Display Name: [Hospital Name] - iPhone
- From top Customer org navigate to: Groups & Settings->Groups->Organization Group->Organization Group Details->Add Child Organization Group
- Create three Enrollment Users
- Create first Enrollment User (Customer level)
- Navigate to the Customer Organization Group for this deployment
- Navigate to Accounts > Users > List View
- Select Add
- Select Add User
- Username: [hospitalabbreviation]dep
- Set the password
- Set the account First Name as the full name of the hospital
- Set the account Last Name as "DEP"
- Set the account email as [email protected]
- Go to Advanced
- Staging
- Enable Device Staging
- Disable Single User Staging
- Enable Multi-User Disabled
- Select Save – add to Confluence Page created by the Project Manager
- Create second Enrollment User
- Navigate to the Child Organization Group for this deployment
- Navigate to Accounts > Users > List View
- Select Add
- Select Add User
- Username: [hospitalabbreviation]ios
- Set the password
- Set the account First Name as the full name of the hospital
- Set the account Last Name as "iOS"
- Set the account email as [email protected]
- Select Save – add to Confluence Page created by the Project Manager
- Create third Enrollment User (Automated)
- Navigate to Accounts > Users > List View
- Select Add
- Select Add User
- Username: [hospitalabbreviation]iosauto
- Set the password
- Set the account First Name as the full name of the hospital
- Set the account Last Name as "iOS Auto"
- Set the account email as [email protected]
- Select Save – add to Confluence Page created by the Project Manager
VPP Setup in AirWatch
This section outlines the necessary steps to properly connect the VPP account (and applications) with the AirWatch org.
-
-
- Navigate to the desired Parent Customer group
- Navigate to Groups & Settings > All Settings > Apps > Catalog > VPP Managed Distribution
- Change the Description to the iCloud account for the token
- SToken Upload: Upload provided sToken (see Before you Begin)
- Select Save
- Navigate to Apps & Books > Applications-> Native->Purchased
- Note: Voalte must add the apple ID to the correct Custom B2B app in iTunes Connect before proceeding. The site administrator must also have already purchased licenses in the VPP portal.
-
-
-
- If an app shows up as "Unknown," the app is a Custom B2B Application
- If the app is not there, select Sync Assets at the top of the page. If it still doesn't appear, work with the Voalte Project Manager to ensure the customer purchased it.
- Select the Edit Assignment icon next to the Voalte application you would like to assign
- Enter the name of the Application as it appears in the iTunes store
- Enter the Bundle ID for the application (Voalte will provide)
- Upload a photo for the icon. (Voalte will provide)
- Note: This is not the picture that will appear on the devices.
- Select Save
- For Custom B2B App:
- Select Enable Device Assignment
- Select Save and Assign
-
-
- Select License Codes by Smart Group
- Input the smart group where it says "Select Smart Group"
- Change the number in Allocated to be larger than the total number of devices you will be inputting into this smart group (Should be provided ahead of time)
- Select Make App MDM Managed if User Installed
- Select Save
- Select Save and Publish
-
Integrating Ground Control into AirWatch
This section outlines the necessary steps to properly connect the Ground Control account with the AirWatch org.
- Create API Admin Account
- Select Add Role
- Organization Group: Parent (Customer) Organization Group Name
- Role: Console Administrator
- Under the Parent (Customer) Organization Group for this deployment, navigate to Accounts > Administrators > List View
- Select Add > Add Admin
- Username: [hospitalabbreviation][email protected]
- Set password
- First Name: Hospital Abbreviation
- Last Name: GroundControl API
- Email Address: [email protected]
- Navigate to the Roles tab
- Navigate to the API tab
- Ensure Authentication is Basic
- Enable Admin API Access at Parent (Customer) Level OG
- Take note of AirWatch API Key for future use in Ground Control
- Save
- Navigate to Groups & Settings > All Settings > System > Advanced > API > REST API
- Set Current Setting to Override
- Under the General tab, check "Enable API Access"
- Navigate to the "Authentication" tab and ensure Basic is enabled
- Document creation date, and set a 90 day calendar reminder to reset this account password back to what it was to avoid any "incorrect username/password" errors from the password expiring.
AirWatch Smart Group Creation
This section outlines the steps to create Smart Groups in AirWatch.
- Within the correct child org, go to Groups & Settings->Assignment Groups->Add Smart Group
- Under Additions type the user you created that ends in auto - [hospitalabbreviation]iosauto, click on the selection that pops up, then click "add"
- Uncheck the Organization Group at the top
- Click Save
- For the name of the Group create one for each of the following:
- [Hospital] [Device] Profiles
- [Hospital] [Device] 3rd Party Apps
- [Hospital] [Device] Voalte One
- [Hospital] [Device] WiFi
AirWatch Profiles Creation
This section outlines the steps to create Profiles in AirWatch.
- How to create a new Profile Group
- Created at the customer child level: iOS Diagnostic Profile, Restrictions, Wifi - Production, Home Screen, Notifications
- Deployment: Managed
- Assignment Type: Auto
- Allow Removal: Always (only impact is via Self Service Portal, no actual impact on device)
- Assigned Groups: Profiles (WiFi will go into WiFi Smart Group)
- Name: [Hospital Name] [Profile Type] Profile
- Navigate to correct level
- Go to Devices->Profiles & Resources->Profiles->Add->iOS
- New Profiles needed to be created
- Home Screen
- Note: there is a new bundle ID for each major release of Voalte Platform.
- Dock:
- com.voalte.platform.ios.store.one.37
- com.voalte.platform.ios.store.one.36
- Page One:
- Clock - com.apple.mobiletimer
- Notes - com.apple.mobilenotes
- Calculator - com.apple.calculator
- Weather - com.apple.weather
- Page Two:
-
- Create Folder (would ideally like this on 2nd page of folder once AW supports)
- AirWatch Agent - com.air-watch.agent
- Phone - com.apple.mobilephone
- Settings - com.apple.Preferences
- Restrictions - This profile allows certain attributes of the device to be locked down.
- Check only the following:
- iOS Update Delay: 90
- Allow Use of Camera (Blocked by Voalte)
- Allow Installing Public Apps
- Force Limited Ad Tracking
- Require Passcode on First AirPlay pairing
- Allow Predictive Keyboard- Optional
- Allow Autocorrection for keyboard- Optional
- Allow Spell check for keyboard- Optional
- Allow Bluetooth Settings Modification (This will be changed post-creation of Back-up)
- Force Date & Time to be Set Automatically
- Allow managed apps to read contacts from unmanaged contacts accounts
- Force iTunes Store password entry
- Allow pairing with non-configurator hosts
- Force Wifi Whitelisting- Optional
- This profile allows certain attributes of the device to be locked down.
- Updated for AirWatch Console 9.2.2.3 and iOS 11.2.1
- Show Apps: (5 total)
- Calculator
- Notes
- Clock
- Weather
- Voalte One
- Notifications
- Select app: Voalte One 3.[Current Version]
- Allow Notification: Enabled
- Show in Notification Center: Enabled
- Show in Lock Screen: Enabled
- Allow Badging: Enabled
- Allow Sound: Enabled
- Allow Critical Alert Notifications: Enabled (iOS 12, AW Console 9.7)
- Allow CarPlay: Disabled (iOS 12, AW Console 9.7)
- Alert Style when Unlocked: Banner
- Select Group Notification Type: Do Not Group (iOS 12, AW Console 9.7)
- WiFi - Production
- SSID
- Auto-join
- Pass
- Auth Type
Ground Control Setup
This section outlines the necessary steps to properly set up Ground Control (G) and the workflows.
- Setup MDM
- MDM Name: [AirWatch URL] [Customer Org Name]
- Eg: CN700 - Voalte Hospital Pink
- No Enrollment profile due to DEP
- API Integration On
- Host: AirWatch URL
- API User: User Created above “[hospitalabbreviation][email protected]”
- API Password: Password created above for API user
- API Key: Collected above
- Test
- At top Customer level in GC go to Admin->MDMs
- Add->AirWatch
- Add Voalte Attributes
- Admin->Attributes->New
- Workflow
- Asset Tag Number
- AWtag
- Hospital
- Unit
- AWGroupID
- Friendly Name
- Workflow: [Site] [Optional Location] Default Workflow
- Erase
- Delay New Releases
- When device is below [current deployed version]
- Restore from Backup
- Set Timezone
- WiFi:
- Provision2 (Voalte provisioning), Automatically forget after 120 minutes
- Site Wifi: Automatically forget after 120 minutes
- Set Name: [Unique ID][Friendly Name]
- Set Wallpaper:
- Set Lock Screen text: [Device Serial][Lost][Unique ID]
- Set home screen
- Set lock screen
- Manage with DEP- Do not Authenticate
- Perform MDM Command
- MDM: Created Above: [AirWatch URL] [Customer Org Name]
- Delete Device
- Assign Staged Device to User:: Created above, [hospitalabbreviation]iosauto
- Automation
- Workflow is->[Site] [Optional Location] Default Workflow
- [Site] [Optional Location] Default Workflow
- When ALL of following conditions are true:
- Deploy these workflows:
- Launchpad
Primary role responsible: Hospital administrator
-
- Export .p12 cert from GC
- Admin->DEP
- Enable
- Download Supervision Identity
- In AW Navigate to Parent Customer org->Groups & Settings->All Settings->Devices & Users->Apple->Device Enrollment Program->Configure
- Name the server “[Hospital Abbreviation] Voalte CN700”
- Uncheck “Automatically Assign New Devices” as some hospitals use DEP for things other than Voalte
- Upload MDM token to the DEP portal.
- Download DEP token from the DEP portal.
- Upload DEP token to DEP profile that is in AirWatch
- Authentication: Off
- Staging Mode: Single User Device
- Default Staging User: DEP User created earlier [this is re-assigned with GC)
- Device Ownership Type: Default
- Device Organization Group: Parent Customer Level
- Profile Name: [Hospitalname] DEP Profile
- Department: DEP ID
- Support Number: DEP Org Name
- Require MDM enrollment: Enabled
- Supervision: (Will be default enabled from 2018)
- Lock MDM Profile: Enabled
- Anchor Certificate: Disbaled
- Device pairing: Enabled
- Upload GC .p12 file
- Await Configuration: Disabled
- Auto Advance Setup: Disabled
- Setup Assistant:
- Save
- Click the blue link next to “Download Public Key - MDM_DEP_PublicKey.pem”
- Login to DEP website->Device Enrollment Program->Add MDM Server.
- DEP Authentication:
- MDM Features (DEP Profile Setup)
- Default Profile Assigned for Newly Synced Device: The profile just created
- Save
- For customers not using CN700, you will need to ensure that the VPP token and DEP profilel are applied at the highest level of the AirWatch environment.
- The reason for this is because the Ground Control API requires access to the same organization that phones are being enrolled into, and Voalte will have access to the username and password for that Ground Control account. Applying the token and profile this way allows the Ground Control access to remain without giving partners access to the AirWatch top level for the organization.
Creating the Backup
DEP Portal
- Verify the device is in the DEP portal and assigned to a MDM Server
- Sync device used for creating the backup with AirWatch
- Note: The following steps will have to be done again once all phones are enrolled in DEP and assigned to a server
AirWatch
- Login to AirWatch->Customer Org w/DEP Profile->Devices->Lifecycle->Enrollment Status
- Click Add->Sync Devices
- Change Layout to Custom
- Check the box next to your device->More Actions->Assign profile.
- Default should be the single profile you created. If you have multiple, please make sure it’s assigned to the profile at the Child Voalte level
- Make sure you see your device when assigning profile or it will likely not assign
- Scroll all the way to the right (under Custom layout) and make sure under “Profile Name” you see the newly-created profile. If not you will need to assign the profile again.
- If the profile is not getting assigned you may have to login to the DEP portal again, assign the device to a different DEP profile or unassign it, save, then re-assign the profile. Then start this section over by assigning the profile
Manual steps
Mac Mini
- Use iTunes or Apple Configurator 2 to backup the device to your computer
- On OSX, open the Finder application->Go->Go to Folder->”~/Library/Application Support/MobileSync/Backup”
- Find the backup you just created
- Go into the folder for the device backup, Select All->Compress
- Find the Archive.zip file created, Rename it to “[Hospital]_[iPhone Version]_[iOS Version]_Backup.zip”
- Drag this to your desktop or somewhere for easy access
- Login to Ground Control, Navigate to the correct organization
- Go to Cache at the top bar
- Click Upload->Restore Image->Select the file that was just uploaded.
- Modify Ground Control Workflow to include the backup file.
- Save
- Test
- If Bluetooth is desired to be off:
- Login to AirWatch, navigate to the Restrictions profile, click "Add Version"
- Disable Allow Bluetooth Settings Modification
Provisioning a DEP Phone
This section outlines the final steps to provisioning a phone. This can be done in bulk.
- If you haven’t already, confirm the phone is listed in your DEP portal by signing in and searching for the phone. The very top of the screen is a search bar.
- Go into AirWatch at the same org the DEP Profile is set to (Should be customer org)
- Devices->Lifecycle->Enrollment Status
- Add->Sync Devices->Sync (if there are new devices in this state you should see them listed)
- Change Layout to Custom
- Select all devices->More Actions->Assign Profile
- The profile will be listed up top and you should see the new devices without the profile below
- If you do not see them then the owner of the DEP portal will need to login, assign the phones to a different profile or unassign them, then re-assign them back to the same profile. Resync devices and try to add the profile again.
- Make sure devices are added to GC with appropriate tags and attributes, workflow assigned, and automation enabled.
- Plug devices into GC
- Enjoy! :)
