Defining Jamf Pro Enrollment Information for Account-Driven Enrollment

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

A device must authenticate with the Jamf Pro server to initiate the service discovery process and direct a user to the enrollment portal.

After a user enters the email address of their Managed Apple Account, the following process occurs:

  1. The device extracts the domain information (information following the @ symbol) from the Managed Apple Account.

  2. The device sends an HTTP request to the web server hosting the enrollment information.

    Example:

    If the user Samantha Johnson signs in to a device with the Managed Apple Account samantha.johnson@mycompany.com, the device extracts mycompany.com and uses the service discovery process to make an HTTP request for the enrollment information that is hosted at mycompany.com.

  3. If the computer or mobile device cannot retrieve service discovery information directly from the account's domain, the device will query Apple for an alternate service discovery resource (e.g., the JSON file hosted by Jamf Pro). For more information, see Account-driven enrollment methods with Apple devices in Apple Platform Deployment.

  4. The device uses that information to redirect the user to the Jamf Pro enrollment portal.

For more information about the service discovery process, see the Discover Authentication Servers documentation from the Apple Developer website.

To enable a device to discover your Jamf Pro server's enrollment endpoint, you must create a JSON file named com.apple.remotemanagement and define the following properties in it:
BaseURL

The full URL for your Jamf Pro instance followed by /servicediscoveryenrollment/v1/deviceenroll (account-driven Device Enrollment) or /servicediscoveryenrollment/v1/userenroll (account-driven User Enrollment).

Version
The enrollment version
Important:

This must be defined as mdm-adde (account-driven Device Enrollment) or mdm-byod (account-driven User Enrollment).

The contents of the JSON file should look similar to one of the following:

  • Account-driven Device Enrollment

    {
"Servers": [
{
"Version":"mdm-adde",
"BaseURL":"https://JAMF_PRO_URL.com/servicediscoveryenrollment/v1/deviceenroll"
}
]
}

  • Account-driven User Enrollment

    {
"Servers": [
{
"Version":"mdm-byod",
"BaseURL":"https://JAMF_PRO_URL.com/servicediscoveryenrollment/v1/userenroll"
}
]
}
:
Note:

The service discovery JSON file for your Managed Apple Account domain can only specify either account-driven Device Enrollment or account-driven User Enrollment for devices to use. It cannot be specified for both.