DEP-2025 Apple Deployment and Management Certification Exam Questions and Answers

In Apple Business Manager (ABM), the Administrator role has broad permissions, including purchasing apps and assigning devices to MDM servers. The Content Manager (option B) can manage and distribute content (e.g., apps, books) but cannot purchase apps or assign devices. The Device Enrollment Manager (option C) focuses on enrolling and assigning devices but lacks purchasing authority. The People Manager (option D) manages user accounts, not apps or devices. TheApple Business Manager User Guideoutlines the Administrator’s comprehensive responsibilities, making it the correct choice.

Managed Distribution requires Apple Business Manager (ABM) or Apple School Manager (ASM) to purchase and assign apps, books, or custom content to users or devices, which are then deployed via MDM. An Apple Developer account (option A) is for custom app creation, not distribution management. User acceptance (option C) may be needed for non-supervised devices but isn’t a requirement for the feature itself. A VPN configuration (option D) is unrelated. TheApple Business Manager User Guidemandates ABM/ASM for Managed Distribution.

Profile Manager, part of macOS Server (now integrated into macOS as a standalone service), is a tool that allows IT administrators to create, edit, and distribute configuration profiles for macOS, iOS, and iPadOS devices. These profiles define settings and restrictions that can be deployed via MDM or manually. Apple Configurator (option A) is primarily for iOS/iPadOS/tvOS device supervision and configuration, not profile creation for macOS. System Preferences (option C) is a user-facing settings app, not a profile creation tool. Terminal (option D) can be used for scripting but isn’t designed for profile creation. TheApple Platform Deployment Guideidentifies Profile Manager as the macOS tool for this purpose.

Only managed data is backed up with a Managed Apple ID. TheiOS Deployment Referencestates, " Under User Enrollment, an iCloud backup using a Managed Apple ID includes only data from managed apps, keeping personal data separate. "

TheSetRecoveryLockcommand locks the Recovery partition, restricting access to Startup Security Utility. TheMobile Device Management Protocol Referencestates, " The SetRecoveryLock command sets a password for the Recovery partition, restricting access to Startup Security Utility and other recovery options unless the password is provided. " Option B sets a firmware password but not specifically for this utility, and C and D are invalid.

Mobile Device Management (MDM) solutions provide IT administrators with the ability to manage software updates on macOS devices remotely. Through MDM, administrators can defer updates, enforce specific versions, or schedule installations, ensuring compliance and security across an organization’s fleet. Apple Configurator (option A) is primarily for iOS/iPadOS/tvOS devices, not macOS update management. System Preferences (option C) allows individual users to manage updates locally, not administrators remotely. Terminal (option D) can script updates but lacks the centralized control of MDM. TheMDM Protocol Referencedetails MDM’s software update management capabilities for macOS.

Apple’sContent Caching serviceimproves bandwidth efficiency by storing downloaded data locally. Administrators can configure the caching server’s behavior with MDM payloads. Apple Learning clarifies that to cachesoftware updates, apps, and books, the cache content type must be set toShared. The “Shared” category includes App Store apps, macOS updates, iOS/iPadOS updates, and other publicly distributed content. In contrast, theiCloud optioncaches personal iCloud data such as photos and documents. Selecting “Shared and iCloud” enables both categories, which is not the requirement in this case. There is no “All Updates” option in Apple’s terminology. By choosing “Shared,” IT ensures only organizationally relevant updates are cached, reducing storage and focusing performance where needed.

Apple’sWi-Fi payloadallows organizations to configure network authentication modes on macOS. When Macs are not bound to a directory but must connect to 802.1X Wi-Fi before login, the correct configuration isSystem+Usermode. Apple Learning specifies that this setting establishes connectivity both at the login window (system-level) and persists once the user logs in (user-level). This allows seamless reauthentication without forcing the user to reconnect after login. In contrast, “Login window” only connects before login and does not persist, requiring reentry later. Device Attestation and Network Relay are unrelated to Wi-Fi authentication. System+User mode is therefore the correct choice for organizations needing Wi-Fi access at both pre-login and post-login stages, ensuring uninterrupted connectivity and access to network-based resources.

Custom local networks and public IP settings span subnets. ThemacOS Deployment Referencestates, " To optimize bandwidth across subnets, use ‘Cache content for devices using custom local networks’ to specify multiple subnets and ‘devices using the same public IP address’ for broader reach. "

Configuration profiles allow IT administrators to manage Bluetooth settings, such as disabling Bluetooth entirely or restricting pairing with specific devices, enhancing security and compliance. These profiles are deployed via MDM or manually. Find My (option B) and iCloud (option C) are unrelated to Bluetooth management. MDM (option D) delivers profiles, but the profiles define the settings. TheApple Platform Deployment Guidedetails Bluetooth configuration via profiles.

Bonjour enables service discovery on a LAN. ThemacOS Deployment Referencestates, " Bonjour supports discovering services such as printers, file shares, and other resources on a local network. " Options A, B, and D are unrelated to Bonjour’s function.

Managed Device Attestationis a feature Apple added to improve trust in MDM environments. Apple Learning explains that this technology ensures the device cannot falsely report its identity, security posture, or management status. Attestation uses secure hardware components such as the Secure Enclave to provide cryptographic proof of device properties. This helps protect against threats where compromised or jailbroken devices attempt to “lie” about compliance or OS version to gain access to sensitive systems. It does not directly address update tampering, kernel bypasses, or Activation Lock manipulation — those are handled by other security layers. By guaranteeing that reported device attributes are authentic, Managed Device Attestation strengthens conditional access policies and prevents non-compliant devices from masquerading as secure.

iPhones prioritize preferred networks. TheiOS Deployment Referencestates, " iPhone prioritizes Wi-Fi networks in this order: preferred (known) networks, private networks, then public networks. "

The Wi-Fi payload supports Cisco Fastlane QoS. TheMobile Device Management Protocol Referencestates, " The Wi-Fi payload supports Cisco Fastlane QoS settings, allowing administrators to prioritize traffic for critical applications on macOS devices. " Options A, B, and D serve different purposes.

AppleConfigurator for Macis a utility designed to supervise, restore, and configure iOS, iPadOS, and tvOS devices. Apple Learning highlights a newer feature: the ability touse Shortcuts automations with Configurator. This means administrators can script repeatable tasks — for example, restoring a device, applying enrollment settings, and erasing it — without manually repeating steps. Over-the-air profile updates are handled by MDM, not Configurator. Purchasing apps and books is managed through Apple Business Manager, not Configurator. Managed Lost Mode is an MDM feature, not part of Configurator. Shortcuts integration makes Configurator more powerful in high-volume environments, letting IT staff automate otherwise time-intensive preparation workflows, especially in education or labs. This reinforces Apple’s commitment to automation and efficiency in deployment.

A Managed Apple ID is needed. TheiOS Deployment Referencestates, " Account-driven Device Enrollment requires a Managed Apple Account to sign in during setup, triggering MDM enrollment. "

Content caching on a Mac improves network performance by storing frequently accessed content (e.g., app updates, iCloud data) locally, reducing internet bandwidth usage and speeding up downloads for connected devices. It doesn’t enhance security (option A), separate data (option C, a User Enrollment feature), or simplify enrollment (option D, an ADE benefit). TheApple Platform Deployment Guideemphasizes bandwidth optimization as the primary benefit of content caching.

Thebootstrap tokenis a mechanism introduced by Apple to help MDM solutions automatically grant SecureToken to managed accounts. Apple specifies that escrow of a bootstrap token requires the device to besupervised. Without supervision, MDM cannot request or store the bootstrap token. This token becomes critical when enabling FileVault, since new accounts may need SecureToken for disk unlock. By escrowing the bootstrap token, MDM ensures accounts created later (e.g., through identity integration or Jamf Connect) can automatically receive SecureToken. This simplifies administration and prevents situations where FileVault cannot be enabled due to missing tokens.

Remote wipe preserves eSIM. TheMobile Device Management Protocol Referencestates, " The EraseDevice command with the preserveDataPlan option allows MDM to keep the eSIM active during a wipe, aiding redeployment. "

Licenses can be transferred within an organization. TheApple Business Manager User Guidestates, " Licenses for purchased apps can be transferred to another location within the same organization in Apple Business Manager. " Options B, C, and D are incorrect as free content doesn’t require negotiation, assignment isn’t automatic, and multiple roles can purchase.

Apple’sApps and Booksprogram within Apple Business Manager (ABM) allows organizations to purchase apps and books in volume. A critical benefit is the ability totransfer licenses between locationswithin the same ABM account. Apple Learning specifies that this feature enables schools, campuses, or departments to redistribute app licenses as organizational needs evolve, without changing the overall license count. Content is not automatically assigned to user accounts; admins choose device- or user-based assignment. Both free and paid apps are available, so there is no restriction to free content. Additionally, purchasing can be delegated to roles such as Content Managers, not just administrators. The ability to move licenses across locations makes management flexible and cost-efficient, while maintaining organizational ownership of the content.

MDM server assignment is required for enrollment. TheApple Business Manager User Guidestates, " For devices to automatically enroll in MDM via Apple Business Manager, they must be assigned to an MDM server. Without this assignment, enrollment will not occur during setup. " Option C explains why iPhones fail to enroll while Macs succeed. Options A, B, and D are incorrect as new devices don’t need resets, approval is automatic for Apple purchases, and 5G doesn’t block enrollment.

Rapid Security Responses use a letter identifier. TheiOS Deployment Referencestates, " A Rapid Security Response appends a single-letter identifier, such as ‘(a)’, to the iOS version number (e.g., iOS 16.4.1 (a)) to indicate its application. "

Apple introducedRapid Security Response (RSR)to deliver urgent security patches without waiting for a full OS release. When an RSR is applied to iOS, iPadOS, or macOS, Apple adds asingle letter (such as “a”, “b”, or “c”)to the OS version. For example, iPadOS 16.5 (a) indicates an RSR patch has been installed. Apple Learning documents clarify that these patches can later be incorporated into full OS updates, at which point the letter disappears. This simple identifier lets IT admins and users quickly confirm whether a device has received critical security protections.

Apple requires the use ofApple Configurator for iPhoneto manually add Macs into Apple Business Manager or Apple School Manager. The workflow involves placing the target Mac into Device Enrollment mode and then scanning an on-screen image with the Configurator app running on an iPhone. Once completed, the Mac is added to the organization’s ABM account with a 30-day provisional period. Apple Configurator for Mac, while useful for restoring and preparing iOS/iPadOS devices, does not support manually adding Macs to ABM. System Settings and Xcode are unrelated to device enrollment workflows. This method is Apple’s prescribed approach for organizations acquiring Macs outside normal reseller channels.

Devices wait for a threshold drop. TheApple Platform Deployment Guidestates, " Apple devices use a roaming trigger threshold; they won’t switch to a closer access point until the current signal falls below this level. "

Activations store values. TheMobile Device Management Protocol Referencestates, " Declarative Device Management uses Activations declarations to store values on a device, enabling proactive state management. "

Apple explains that for a device to enroll into a new MDM server through Automated Device Enrollment (ADE), it must go through the Setup Assistant workflow again. This requires the device to beerasedbefore it will attempt to re-enroll. Simply reassigning the device in Apple Business Manager does not trigger enrollment until the device is reset and Setup Assistant runs. Apple stresses that erase is necessary because ADE workflows are tied to the initial setup sequence. Remote wipe from ABM/ASM is not a feature, and Revive is a low-level restore process for Apple silicon, not for standard redeployment. Releasing devices removes them entirely from ABM. Therefore, erasing is the only required action before the device can enroll in the new MDM.

The provisional period starts post-enrollment. TheApple Configurator User Guidestates, " The 30-day provisional period begins after the device enrolls in the MDM server, allowing users to opt out of supervision. "

Apple Business Manager (ABM) enables device and content management by providing a portal to enroll devices via ADE, purchase and distribute apps/books through Managed Distribution, and manage user accounts. This centralizes organizational control over Apple deployments. Personalization (option A) is user-driven, not an ABM benefit. Network performance (option C) is enhanced by content caching, not ABM. Data separation (option D) is a User Enrollment feature. TheApple Business Manager User Guidehighlights device and content management as ABM’s core benefit.

Automated Device Enrollment (ADE) provides the most control over organization-owned devices by integrating them with an MDM solution during initial setup, without user intervention. Devices enrolled via ADE are automatically supervised, allowing restrictions like mandatory MDM enrollment and advanced policies. Device Enrollment (option B) offers control but requires manual profile installation and doesn’t inherently supervise devices unless paired with supervision tools. User Enrollment (option C) is for BYOD, offering less control to protect user privacy. TheApple Platform Deployment Guidepositions ADE as the most robust option for organization-owned devices.

Mobile Device Management (MDM) provides IT administrators with the capability to remotely wipe a device, either fully (factory reset) or selectively (removing managed data), via commands sent over APNs. This is a core MDM feature for security and compliance. Activation Lock (option A) prevents unauthorized reactivation after a wipe but doesn’t perform the wipe. Find My (option B) allows users to wipe their own devices, not administrators. iCloud (option D) supports personal wipes via Find My, not organizational ones. TheMDM Protocol Referenceconfirms MDM’s remote wipe functionality.

Apple Configurator is the tool for manually adding devices to ABM or ASM, especially for devices not purchased directly from Apple. TheApple Configurator User Guidestates, " Use Apple Configurator to add devices to Apple Business Manager or Apple School Manager by connecting them to a Mac via USB. This process supervises the devices and assigns them to your organization’s MDM server. " Options A, B, and C serve other purposes and cannot perform this task.

Preserving eSIM speeds redeployment. TheMobile Device Management Protocol Referencestates, " When erasing a supervised iPad, the preserveDataPlan option retains the existing eSIM, avoiding reactivation delays. "

Apple divides administrative responsibilities into roles with specific privileges. According to the Apple Business Manager and School Manager role matrix, only theAdministratorandLocation Managerroles can create and manage locations. Locations in ABM are critical for organizing apps, books, and device assignments, especially for large institutions with multiple campuses or departments. Device Enrollment Managers focus only on device enrollment tasks, while People Managers handle user accounts. Content Managers can distribute apps and books but cannot add new locations. Apple’s training emphasizes that locations are tied directly to license management and content distribution, so Apple restricts this privilege to higher-trust roles like Administrators and Location Managers. This ensures organizational structure remains consistent and controlled.

Apple’s MDM architecture only allowsone enrollment profileper managed device. Apple Learning makes clear that a device can be managed by only one MDM server at a time. This enrollment profile defines the server connection, authentication, and management relationship. Attempting to install another enrollment profile overwrites the existing one, ensuring there is no conflict or dual management. While devices may have multiple configuration profiles for settings, restrictions, or certificates, the enrollment profile itself is unique. This ensures clear accountability and prevents devices from being subject to conflicting MDM commands. Options suggesting two or three enrollment profiles, or unlimited enrollment, do not align with Apple’s management model.

Kerberos is the most widely deployed authentication technology used by both Active Directory (AD) and single sign-on (SSO) systems in enterprise environments. It provides secure, ticket-based authentication, allowing users to access multiple services with a single set of credentials. AD relies on Kerberos as its default protocol, and Apple’s SSO integration with AD leverages Kerberos for seamless authentication on macOS and iOS. MSCHAPv2 (option B) is used in VPNs, not broadly in AD or SSO. OAuth (option C) and SAML (option D) are modern web-based standards, less common in traditional AD-SSO integration. TheApple Platform Security Guideconfirms Kerberos’ prevalence.

SSO extensions support modern protocols. TheApple Platform Deployment Guidestates, " Single sign-on (SSO) extensions allow IdPs to integrate modern authentication protocols like OAuth 2.0 or OpenID Connect across iOS, iPadOS, and macOS. " Options B, C, and D (corrected from " WireGuar " ) are networking technologies, not authentication-focused.

System+User Mode supports pre- and post-login connectivity. TheApple Platform Deployment Guidestates, " System+User Mode for 802.1X allows a Mac to connect to Wi-Fi using system credentials before login and switches to user credentials after login, ensuring network access at all stages. " Option B is not a standard term, C requires login first, and D uses only system credentials.

Upgrading macOS requires volume ownership, tied to an admin account with permissions to modify the system volume. ThemacOS Deployment Referencestates, " To install or upgrade macOS, the user must have volume ownership, which allows the system to authenticate the operation against the secure volume. " Option B is for MDM updates, C is insufficient alone in newer macOS versions, and D is for content, not upgrades.

User Enrollment, designed for BYOD, requires a Managed Apple ID to separate personal and managed data cryptographically. Created via Apple Business Manager (ABM) or Apple School Manager (ASM), Managed Apple IDs enable organizational policies while preserving user privacy. Personal Apple IDs (options A and C, the same) are not used for User Enrollment, as they lack organizational control. There’s no “Shared Apple ID” (option D); Shared iPad uses Managed Apple IDs differently. TheApple Platform Deployment Guidemandates Managed Apple IDs for User Enrollment.

Configuration profiles allow IT administrators to manage Screen Time settings on iOS/iPadOS devices (and macOS to a lesser extent), such as setting app limits, restricting content, or enforcing downtime. These profiles are deployed via MDM or manually, aligning with organizational policies. Find My (option B) and iCloud (option C) are unrelated to Screen Time management. MDM (option D) delivers profiles, but the profiles define the settings. TheApple Platform Deployment Guidedetails Screen Time configuration via profiles.

Supervision provides enhanced management capabilities on iPhones and iPads, such as enabling Managed Lost Mode or enforcing restrictions. Apple Learning materials are clear that the only enrollment method that automatically enables supervision for iOS and iPadOS devices isAutomated Device Enrollment (ADE)through Apple Business Manager or Apple School Manager. Account-driven and User Enrollment methods focus on user-based or BYOD scenarios and do not grant supervision. Profile-driven enrollment, once used in older iOS versions, no longer provides supervision in modern deployments. ADE ensures devices are flagged as organization-owned during initial setup, activating the supervised state automatically. This distinction is crucial because many advanced management and security features require supervision and cannot be applied to devices enrolled through BYOD workflows.

When evaluating Mobile Device Management (MDM) solutions, a critical factor to consider is the pricing structure and subscription model. Organizations must assess their budget, the number of devices to manage, and projected growth to ensure the MDM solution is cost-effective and scalable. This includes understanding per-device licensing fees, subscription tiers, and additional costs for features. While support for watchOS (option A) may be relevant for specific use cases, it’s not a universal consideration for all MDM evaluations. A device’s life cycle and trade-in value (option C) pertains to hardware management, not the MDM solution itself. TheApple Platform Deployment Guideemphasizes aligning MDM costs with organizational needs, making pricing structure a key evaluation criterion.

For iPads under organizational control, the correct feature to protect a lost or stolen device isManaged Lost Mode. Apple Learning specifies that when Managed Lost Mode is activated via MDM, the iPad is immediately locked and displays a custom message defined by IT, such as contact details for return. Importantly, Lost Mode does not require the user to have enabled Find My; MDM can enable location tracking temporarily to assist recovery. FileVault is a macOS-only disk encryption feature, not available on iPad. Recovery Lock is designed for Apple silicon Macs to protect Recovery mode, not iPad. “Managed Find My” is not an Apple feature. Thus, the documented method for iPad protection under enterprise control isManaged Lost Mode.

The networkQuality command tests responsiveness. ThemacOS Deployment Referencestates, " Introduced in macOS Monterey, the networkQuality command measures upload and download responsiveness, providing insight into network performance inside and outside your local network. "

Service discovery aids account-driven User Enrollment. TheiOS Deployment Referencestates, " Account-driven User Enrollment uses service discovery to automatically locate the MDM enrollment URL, streamlining the process. " Option A is false (Managed Apple ID required), C applies to ADE, and D is incorrect (federation is supported).

Enrollment SSO streamlines account-driven enrollment. TheiOS Deployment Referencestates, " Enrollment SSO simplifies authentication during account-driven enrollment by allowing users to authenticate once with their Managed Apple ID across the process. " Option B is incorrect as it’s not a distinct technology here.

Administrator and People Manager roles can add Locations. TheApple Business Manager User Guidestates, " Users with the Administrator or People Manager roles have permissions to add and manage Locations in Apple Business Manager. " Option D’s “Location Manager” isn’t a standard role.

Lost Mode, an MDM feature for supervised devices, allows device tracking by locking the device, displaying a custom message, and reporting its location (if Location Services are enabled). It’s a security tool for recovering lost or stolen devices. Additional restrictions (option B) are a supervision feature, not Lost Mode’s benefit. Network performance (option C) and data separation (option D) are unrelated. TheMDM Protocol Referencehighlights tracking as Lost Mode’s primary benefit.

To link a new Apple Authorized Reseller to your Apple Business Manager (ABM) or Apple School Manager (ASM) account, you must add the reseller’s Reseller Number (also known as the Apple Customer Number). TheApple Business Manager User Guidestates, " To ensure devices purchased from a new Apple Authorized Reseller appear in Apple Business Manager, add the reseller’s Reseller Number in the ‘Resellers’ section of your account settings. " Option B (Organization ID) is provided to the reseller, not added in ABM/ASM, while A and C are not required for this purpose.

Shared iPad, a feature for multi-user environments like education or business, requires devices to be supervised and enrolled via Automated Device Enrollment (ADE) through Apple School Manager (ASM) or Apple Business Manager (ABM). ADE ensures the device is pre-configured with an MDM solution that supports Shared iPad settings, such as user session management with Managed Apple IDs. Device Enrollment (option B) can supervise devices but isn’t optimized for Shared iPad’s automatic setup. User Enrollment (option C) is for BYOD and doesn’t support Shared iPad, which is for organization-owned devices. TheApple Platform Deployment Guidespecifies ADE for Shared iPad deployment.

Apple Business Manager (ABM) supports the distribution of multiple app types via Managed Distribution: custom apps (developed in-house), free apps (from the App Store), and purchased apps (bought through ABM’s Apps and Books section). This flexibility allows organizations to manage all app needs within ABM, assigning them to users or devices via MDM. Options A, B, and C are all correct individually, but D encompasses them all, aligning with ABM’s comprehensive capabilities as outlined in theApple Business Manager User Guide.

Apple’s MDM framework allows organizations to take ownership of apps that users may have installed manually. This process is calledconverting unmanaged apps to managed. When an administrator deploys the same app via MDM to a supervised device, Apple documentation specifies that the system silently converts the app to a managed state. No user interaction is required, and the existing app data remains intact. This avoids disruption while still giving the organization control over the app, including the ability to configure settings, update it, or remove it remotely. Options like requiring user approval or uninstalling the app are not part of the standard workflow; Apple designed the feature to ensure seamless transition for end users while granting IT management authority.

Post-deadline, updates install automatically. TheMobile Device Management Protocol Referencestates, " If a user defers a managed software update past the MDM-enforced deadline, macOS will automatically install it to ensure compliance. "

Content token expiration disrupts app sync. TheApple Business Manager User Guidestates, " If the content token expires, app licenses won’t sync to the MDM solution until it’s renewed. " Option B affects notifications, not apps.

Apple Push Notification service (APNs) is a critical service that Apple devices rely on for real-time notifications. Functions requiring continuous APNs access include notifications for operating-system and app updates, MDM policy enforcement (e.g., remote commands), and incoming messages (e.g., iMessage). These depend on APNs to push data to devices over ports 5223 or 443. Options A (Bonjour, caching, sharing), B (SSO, VPN, roaming), and D (tracking, backups, suggestions) involve other mechanisms like local networking or iCloud, not continuous APNs access. TheApple Platform Deployment Guidedetails APNs’ role in these functions.

Enterprise SSO leverages Kerberos. TheApple Platform Deployment Guidestates, " Enterprise Single Sign-On in iOS, iPadOS, and macOS is based on Kerberos, enabling seamless authentication to enterprise resources. " Options B, C, and D serve different purposes.

When Activation Lock is enabled on a supervised Apple device, the organization needs a way to recover the device if a user leaves or forgets credentials. Apple Learning states that MDM can escrow and store abypass codefor Activation Lock. This code can then be used by IT administrators to unlock and reactivate the device without needing the original Apple ID. It is not stored in ABM/ASM, nor tied to the user’s Managed Apple Account or personal Apple ID. Instead, it resides in the organization’s MDM solution for controlled use. This ensures organizations can always return supervised devices to service while still maintaining theft deterrence against unauthorized users.

Cryptographic separation isolates managed and personal data. TheApple Platform Deployment Guidestates, " Account-driven User Enrollment and Account-driven Device Enrollment provide cryptographic separation by isolating managed data (tied to a Managed Apple ID) from personal data (tied to a personal Apple ID). " A creates a managed container, and B extends this to device-level management. Options C, D, and E lack this separation.

Skipping local account creation requires alternative login. ThemacOS Deployment Referencestates, " If ADE skips local account creation, users must log in with a network account or another pre-existing account created outside Setup Assistant. " Option C is incorrect as Managed Apple IDs don’t become local accounts.

Shared iPad is a feature introduced for educational and business environments, allowing multiple users to share an iPad with separate user sessions, each tied to a Managed Apple ID. It requires iPadOS 13.4 or later and is supported only on compatible iPad models (e.g., iPad Pro, iPad Air 2 or later). iPhones (option B), Macs (option C), and Apple Watches (option D) don’t support Shared iPad, as it’s an iPad-specific feature. TheApple Platform Deployment Guidespecifies the system requirements for Shared iPad.

When FileVault is enabled, the encryption of the disk is tied to either user credentials or recovery keys. Apple documentation explains that thePersonal Recovery Key (PRK)is unique to each device and can be escrowed to the MDM solution. If a user forgets their password, the IT admin retrieves the PRK from the MDM and provides it to the user. In macOS Recovery, the PRK can then be used to unlock the disk and reset the account password. Institutional recovery keys exist for organizations but require certificate infrastructure and are less common in MDM workflows.

Apple introducedEnrollment Single Sign-On (SSO)to simplify the account-driven enrollment workflow. Normally, users must repeatedly authenticate when setting up device enrollment. With Enrollment SSO, authentication can be completed once, and the credentials are securely passed across enrollment steps. This reduces complexity, prevents password fatigue, and minimizes enrollment errors. Apple Learning materials highlight that this feature is specifically designed foraccount-driven enrollmenton iPhone and iPad, aligning with modern identity provider integrations. Unlike “Sign in with Apple,” which is consumer-focused, Enrollment SSO is tailored for enterprise identity workflows with Microsoft Entra, Okta, or Google Workspace.

Deploying macOS configuration profiles to devices requires an MDM solution, which pushes the profiles remotely via APNs to enrolled devices, ensuring centralized management. An Apple Developer account (option A) is for app development, not profile deployment. User acceptance (option C) is needed for manual installation but not for MDM deployment, especially on supervised devices. A VPN configuration (option D) is unrelated. TheApple Platform Deployment Guidespecifies MDM as the standard method for deploying profiles to macOS devices.

In the Bring Your Own Device (BYOD) model with User Enrollment, users own the devices and can personalize them with their own apps and data before and after enrolling in an MDM solution. User Enrollment is designed for personal devices, offering a separation between personal and managed data while allowing user customization. BYOD, organization-owned (option B) is not a valid model, as BYOD implies user ownership. Nonpersonalized, organization-owned (option C) restricts personalization, and personally enabled, organization-owned (option D) applies to organization-owned devices, not personal ones. TheApple Platform Deployment Guideconfirms that BYOD with User Enrollment supports personalization on personal devices.

Automated Device Enrollment (ADE), used with Apple Business Manager (ABM) or Apple School Manager (ASM), supports Activation Lock management by allowing administrators to enable, disable, or bypass Activation Lock on supervised devices via MDM. This is critical for organization-owned devices to ensure they can be reactivated after a wipe without user Apple IDs. Device Enrollment (option B) can manage Activation Lock if the device is supervised, but it’s not inherent without ADE. User Enrollment (option C) doesn’t support full Activation Lock management, as it’s for BYOD with limited control. The Apple Platform Deployment Guide ties Activation Lock management to ADE.

Managed Distribution in Apple Business Manager (ABM) and Apple School Manager (ASM) enables administrators to assign apps (purchased or free) to users or devices via an MDM solution. It replaced the legacy Volume Purchase Program (VPP, option D), integrating app purchasing and distribution into ABM/ASM. Automated Device Enrollment (option A) is for device enrollment, not app assignment. User Enrollment (option C) is a BYOD enrollment type, not an app distribution feature. TheApple Business Manager User Guidedetails Managed Distribution as the mechanism for app assignment.

Apple devices follow specific roaming behavior standards. Instead of automatically connecting to the nearest access point, iPhone, iPad, and Mac remain on their current access point until the received signal strength indicator (RSSI) drops below a definedroam trigger threshold. For example, Apple documents that iOS devices typically consider roaming when the RSSI falls around –70 dBm. Until this threshold is reached, the device does not initiate roaming, even if a stronger access point is nearby. This design avoids excessive roaming, which could degrade performance. Therefore, users may stay connected to the initial AP until the signal strength truly weakens.

An enrollment profile establishes MDM control. TheMobile Device Management Protocol Referencestates, " An enrollment profile must be installed on a device to establish a connection with the MDM solution, enabling management. " Options A, B, and D are unrelated to basic MDM enrollment.

Configuration profiles allow IT administrators to manage email settings on a device, preconfiguring accounts with details like server addresses, ports, and authentication (e.g., OAuth, certificates). These profiles are deployed via MDM or manually, ensuring consistent email access. Find My (option B) and iCloud (option C) are unrelated to email management. MDM (option D) delivers profiles, but the profiles define the settings. TheApple Platform Deployment Guidedetails email configuration via profiles.

Activation Lock prevents reuse. ThemacOS Security Overviewstates, " Activation Lock, manageable via MDM, prevents a lost or stolen Mac from being reactivated without the owner’s credentials. " Option C is iOS-specific.

802.11r enhances roaming. TheApple Platform Deployment Guidestates, " 802.11r, or Fast BSS Transition, improves Wi-Fi performance by enabling faster roaming between access points, reducing authentication overhead. " Option C is a QoS feature, not a standard, and A and D are unrelated.

Federated Authentication allows administrators to link Apple School Manager or Apple Business Manager with identity providers like Google Workspace or Azure AD, streamlining Managed Apple ID creation by syncing user data (e.g., names, emails). Users can then sign in with their existing credentials, leveraging SSO. MSCHAPv2 (option A) is a VPN authentication protocol, not related to ID creation. Active Directory (option C) is an IdP but not the feature itself. SAML (option D) is a protocol used in federation, but “Federated Authentication” is the broader Apple feature. TheApple Platform Deployment Guidedetails this process.

Apple provides IT with the ability to control software updates, including beta releases, using MDM restrictions. Apple Learning states that administrators canrestrict beta updatesby applying the appropriate configuration profile. This prevents users from installing developer or public beta software, ensuring devices remain on stable, production-ready OS versions. This control is important because beta releases may not be compatible with enterprise apps or workflows. The Mac Evaluation Utility and Feedback Assistant are tools for Apple’s feedback and testing programs, not for controlling update access. Restricting beta updates is a direct MDM function and aligns with Apple’s emphasis on IT ensuring compliance and stability in managed environments. This protects organizations from instability and reduces IT support issues caused by unauthorized beta installations.

Apple documents that devices prioritizepreferred networksfirst — these are networks the user or MDM has explicitly joined and saved. If no preferred networks are available, devices then attempt to joinprivate networks(those that do not broadcast public hotspots but are available locally). Finally, as a last resort, devices may joinpublic networks, such as captive Wi-Fi portals or unsecured hotspots. Apple Learning highlights this hierarchy to ensure consistent enterprise behavior and user experience. Administrators can influence priority through MDM-delivered Wi-Fi payloads, placing organizational SSIDs at the top of the preferred list. Public networks are deliberately last in the sequence because they are less secure and more likely to involve captive portals, which disrupt automatic connectivity.

Unenrolling a supervised device from an MDM solution requires an administrator’s approval, typically executed by removing the MDM profile via the MDM server. For supervised devices (via ADE or Apple Configurator), users cannot remove the profile themselves, ensuring organizational control. An Apple ID (option B) isn’t required for unenrollment, though it may relate to Activation Lock. User acceptance (option C) isn’t needed for supervised devices. A wipe command (option D) may accompany unenrollment but isn’t mandatory. TheApple Platform Deployment Guideoutlines this process for supervised devices.