MaaS360.

com

Using the Apple Configurator and MaaS3360

Overview
Apple Configurator Utility (ACU) is a free Apple tool that enables a Mac to configure up to 30 iOS devices
simultaneously via a USB. There are two modes of provisioning devices, Unsupervised and Supervised. This
document will focus on Supervised mode, which offers additional administration benefits.
Provisioning a device in Supervised mode gives MDM administrators additional control. You will be able to leverage
an additional set of policies, some of which include:

AirDrop control
Game Center control
iBookstore control
Configuration Profile Installation control
Prevent removal of apps
Prevent erase all content and settings
Restrictions control
iMessage control
Global HTTP Proxy settings
Application Lock
Web Content Management

iOS devices can be enrolled into MaaS360 by installing the MaaS360 Enrollment profile through the ACU. This allows
multiple devices to be rapidly provisioned without any interaction with the end user.

Configuring the Device for MaaS360

Prerequisites
To configure a device, you must have the following:

A Mac with OS X 10.8 or later

An iOS device (iPhone, iPad or iPod touch) to be managed
An Apple USB cable to connect the iOS device to the Mac
Apple Configurator
Details on your wireless profile if supervising wireless only devices. You will need to configure a Wi-Fi
Payload in Apple Configurator in addition to importing the MDM enrollment profile; otherwise enrollment will
fail as the device needs to have an internet connection for this process.

Apple Configuration can be downloaded to your MAC through the MAC App Store. Search for Apple Configurator.
Configuration Steps
1. Download and install Apple Configurator from the MAC App Store. From the Launchpad, open Apple
Configurator.
2. Connect the iOS device you want to manage to the Mac using the USB cable. The Prepare screen will appear,
and the highlighted indicator at the top will show that one device is connected to the Mac. Turn on
Supervision and click Options. Fill out your company information and then click Prepare. This will make the
device enable supervision.
Warning: All data on the device will be erased after this step.
The ACU will prepare the device by performing the following:
1

MaaS360.com

a. Installing the specified version of iOS onto the device (the latest version is the default)
b. Checking the device state
c. Activating Supervision

3. The device is now ready to be supervised and needs the MDM profile to be installed. To stop the Prepare
process, click the blue button at the bottom of the screen.

MaaS360.com

4. Enable Apple Configuration integration in MaaS360 by selecting Setup -> Deployment Settings, checking the
box next to Setup Supervised Devices using Apple Configurator under Advanced Management for
Corporate iOS Devices and clicking Save.

5. Import the MaaS360 MDM enrollment profile by selecting Devices -> Enrollment -> Apple Configurator then
clicking Download under Step 1.
Note: Do not install the downloaded MaaS360 profile on the Mac, as it will not work.

MaaS360.com

6. On the Supervise tab, click on the plus sign (+) and select Import Profile.

7. Browse to the MaaS360 MDM enrollment profile and open it.

MaaS360.com

8. The MaaS360 MDM profile should now be listed in the Profiles section.

9. Select the profile to be installed on the device and click Apply at the bottom of the screen.

The device is now enrolled in MaaS360, and is ready for use.

MaaS360.com

Confirmation
To confirm that the device has been successfully enrolled, you can check in
MaaS360, or you can look at the Settings on the device.
Select Settings > General > Profiles. You should see at least two profiles:
the Supervision Profile and the MaaS360 MDM Profile.
Note: Other policy payloads, apps and docs will not distribute to the device
until a user is assigned to the device. Details on options for user assignment
are below.

Assigning a User to the Device

You can assign a user to a device in two different ways.
Bulk User Assignment:
1. Under Devices -> Enrollment -> Apple Configurator, go to Step 3 and click the here option.

2. A separate box will pop up with details as to how to bulk import the information. A sample file is also
available in this workflow.

MaaS360.com

Manually per device:

1. Under Devices -> Inventory, find the device in question and click View, alternatively search for the device.
2. Once in the Device View, click the More or Actions (dropdown depending on your UI) and select Assign User.

Policy support for Supervised mode

Once a device is in Supervised mode and managed by MaaS360, restrictions & network, app lock and web content
may be managed through policy settings in the portal.
To access these settings, open the Policies screen and click on the Supervised settings tab on the left hand side.
The default settings can be edited to control access to features such as Game Center, iBookstore, iMessage, and
more. Features specific to iOS 7 and iOS 8 are marked as such and can be used to layer restrictions on Shared Photo
Streams, AirDrop, etc.

On iOS 7 devices, policy settings can also allow Bypassing of proxy to access captive networks, and restrict AirPlay
to only Whitelisted devices.
On iOS 8 devices, policy settings can also allow erasing all content and settings or user enabled restrictions.
Additionally, the Global Proxy settings can be configured by providing details on the configuration mode, server
address, server port, username, password, and server URL as well as AirPlay settings by whitelisting the approved
AirPlay devices.

MaaS360.com

App Lock is another feature that enables devices to be used for only a single application. This is extremely useful in
cases where the device is intended for only a single purpose. To activate App lock, first add the app to MaaS360
under App Catalog. The platform will display an Application ID (or Bundle ID) for each app. (For example,
com.facebook.Facebook is the Application ID for Facebook.) Copy this ID into the Application identifier field in the
App Lock tab under Supervised Settings.
Note: The app needs to be installed on the device before using App Lock.

Please note that once a policy with App lock is published, affected devices will be locked into the specified app.
The only ways to exit it are:
1. Republish the policy without the App lock
2. Remove supervision of the device
3. Wipe the device
Web Content is another feature that allows for configuration of the Web Content Settings, such as Web Content
Filtering.

MaaS360.com

Copyright 2014 Fiberlink, an IBM Company. All rights reserved.

Information in this document is subject to change without notice. The software described in this document is
furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in
accordance with the terms of those agreements. No part of this publication may be reproduced, stored in a
retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and
recording for any purpose other than the purchasers personal use without the written permission of Fiberlink
Communications Corporation.
All brands and their products are trademarks or registered trademarks of their respective holders and should be
noted as such.
Fiberlink Communications Corporation
1787 Sentry Parkway West
Blue Bell, PA 19422
October 2014
9