How to manually add an iPhone to Apple Business Manager

Apple allows you to fully automate the MDM enrollment process for most of their devices using Automated Device Enrollment (ADE). In combination with the MDM, ADE allows you to customise and automate the device activation process without the need for an administrator to ever touch the device. To use ADE with your MDM of choice, the devices have to be purchased through an authorized reseller. The reseller can then add the devices to your Apple Business Manager (ABM) instance. There you can then assign them to your MDM servers. For devices that you already own or which were not purchased through a reseller that can add the devices to your ABM instance, there is a manual way to add them. The manual approach requires the use of Apple Configurator – either on an iPhone or Mac. The following steps describe how you can add an iPhone to ABM using another iPhone. It works exaclty the same when you want to add an iPad. I find these steps much easier than using a Mac to add a device to Apple Business Manager.

What you need to prepare and have ready before you begin

Before you begin, make sure to install Apple Configurator on your iPhone and login with your ABM account. After the login you should be presented with the below view. Notice the view finder in the center of the screen. We will use this view finder later on to scan the enrollment code.

Preparing Apple Configurator

  • Tap on the cogwheel in the lower left corner
  • Make sure the “Share Wi-Fi” is selected
  • Make sure that “None” is selected under “MDM SERVER ASSIGNMENT”
    • We will assign the device to the correct MDM server instance later
  • Tap on “Done” in the top left corner

Adding the iPhone to Apple Business Manager

  • Now get the iPhone or iPad you want to add.
  • Turn on the iPhone and swipe up on the “Hello” Screen
  • You will be presented with the language selection screen
  • Continue the OOBE (out of the box experience) setup until you get to the Quick Start screen. There you will have to tap on Set Up Without Another Device
  • Continue with the OOBE setup until you get to the Choose a Wi-Fi Network screen
  • Now get the iPhone where you have previously installed Apple Configurator. When iPhone is in proximity, the screen on the device you want to add, should change to the below view.
  • Make sure to position the image in the frame of the Apple Configurator to initiate the enrollment process into Apple Business Manager
  • The enrollment process will beginn immediately
  • Leave the iPhone with Apple Configurator open, unlocked and next to the device you are adding. If you close Apple Configurator to soon, the enrollment process will fail and you will have to repeate the whole procedure.
  • When the enrollment process is finished, you will get the below screen showing that the iPhone was added to your ABM instance. Please tap on Erase iPhone to complete the enrollment to your ABM instance

You can now login to your ABM and assign the device to your MDM server instance.

Apple Private Relay causing mail delivery issues

A few months ago, a customer reached out to me and reported that their users running iOS 18 on their iPhones and iPads were seeing an issue where they would not get push notifications for new mails. Unlike with iOS 17, the Mail app would not have fetched emails in the background. Users would have to open the Mail app to update their inbox.

All customer devices affected were running iOS 18 and enrolled to BlackBerry UEM. As the Exchange server is behind the firewall, we used Per-Account VPN to reach the users mailboxes. The VPN tunnel was configured to only allow access to the Exchange server as this was all we need for the mail profile to send and receive messages.

In our test environment we were unable to reproduce the issue. Activating the same device against the customer’s environment immediately showed the issue. As there were multiple variables, MDM, VPN setup, customer’s network, Exchange server configuration, the troubleshooting continued for a few weeks. The actual root cause could not be identified.

About two weeks ago, I was told that Apple’s Private Relay feature might causing the problem. Initially I ruled this out as a cause because none of the customer devices had Private Relay enabled. Apple documents which servers need to be reached for Private Relay to work: mask.icloud.com & mask-h2.icloud.com. I was told that mail delivery for IMAP mailboxes on iOS 18 can be delayed if these two host names cannot be resolved or reached.

  • Could it be that the Mail app is trying to reach these two hosts while Private Relay is disabled?
  • Could this be the cause for Exchange ActiveSync Push Notifications not working in my customer’s setup?

To test this theory, I prepared my test environment. To rule out any issues with the MDM setup, I worked with a manually added Exchange mailbox. For the VPN, I opted for a different solution than my customer. I used a device-wide VPN instead of a Per-Account VPN. This allowed me to simplify my testing a bit. I made sure that these two Private Relay hosts are reachable on my network. I sent multiple emails, and all were instantly delivered, and I got notifications for these emails.

I then repeated my testing with the two Private Relay hosts blocked. I would not get any push notifications for new e-mails. When opening the Mail app, it took very long for the messages to be downloaded to the device. It looked like the Mail app had to run into a timeout before it would fetch the emails from the Exchange server.

A second and third round of testing confirmed the results. With the two hosts mask.icloud.com & mask-h2.icloud.com blocked, no push notifications would appear on the device. For all my tests I kept Apple’s Private Relay feature disabled in the iOS settings. I did all my testing on a device with iOS 18.2.1. I did not test if this issue is fixed with iOS 18.3, which was released today.

Today I shared this finding with my customer. After they updated their VPN configuration and made sure that the Per-Account-VPN tunnel can reach the two Apple Private Relay hosts, the issue disappeared and the Mail app worked as expected. Push Notifications were delivered instantly and messages would be downloaded in the background. Finally, we can close this issue.

I know that Per-Account-VPN for Exchange mailboxes is not that common, especially with many organizations already on Exchange Online. Keep in mind that this issue was not caused by the Per-Account-VPN configuration, it only appeared in that specific setup. The VPN tunnel had only a limited set of hosts it was allowed to reach. There is a high chance that you will notice the same issue if mask.icloud.com and mask-h2.icloud.com are not reachable on your network, regardless of if VPN is used or not. It is not an issue occurring only with Microsoft Exchange mailboxes. This issue can also appear when accessing an IMAP mailbox while the device is on a network where the two hosts are blocked.

[Addendum, vowe] If you use Pihole, make sure you whitelist the two mask domains.

Mirror your iPhone screen to your Keynote presentation

This week I have learned a new trick with Keynote on macOS. Using the Live Video feature you can mirror the screen of an iPad or iPhone into your presentation slides.

To use the screen mirroring in Keynote, open an existing presentation or create a new one. From the menu bar select Insert-> Live Video. By default your Facetime camera will be added to the slide deck. To change view to your iPhone or iPad screen, make sure that your device is connected to your Mac using a USB C or Lightning cable. The cable that shipped with your device is sufficient for this to work. On the right side of the Keynote window, click on the plus sign next to Live Video Sources. Give the source a name, e.g., iPhone. Select the connected iPhone or iPad from the drop down list. Click on Add. Your iPhone or iPad screen should now be mirrored to your slide deck as shown below. To make the mirrored device look like the real device, you can overlay the screen mirror with the actual device frame. During your next presentation you can now show the live screen of your iPhone or iPad without the need to leave your presentation. I think this approach can be much more convenient than switching to QuickTime or a third-party app to show your device screen during a presentation.

Bonus tip: You can also use this to mirror your Apple Watch screen. On your iPhone navigate to Settings-> Accessibility-> Apple Watch Mirroring and turn on the mirroring feature.

Apple Platform Security Guide – December 2024 Edition

Just in time for these long Christmas nights, Apple has released an updated version of their Platform Security Guide. If you want to understand how security on Apple’s platforms works, you must read this document. But it will take time. The updated guide has 302 pages. If you did read the May 2024 edition, go to page 290. There you will find a revision history with all the updated and added topics.

Collect sysdiagnose logs using AssistiveTouch

When troubleshooting issues on iPhones or iPads, it can be helpful to collect sysdiagnose logs. To get the device to collect these types of logs, you must simultaneously press both volume buttons and the side or top button, depending on the iPhone or iPad model you have. When the device vibrates for a brief moment, the log collection was triggered successfully. It can be very trick to get the button pressing right. There is a much easier way to trigger sysdiagnose log collection. You can use AssistiveTouch to simplify the process.

  • Go to Settings-> Accessibility-> Touch-> AssistiveTouch.
  • Turn on the switch for AssistiveTouch. Your device will now display a bright button on your screen (not shown in the screenshots).
  • Under Custom Actions tap on Single-Tap.
  • Select Analytics from the menu list
  • Tap on the AssistiveTouch button shown on the device screen to trigger the log collection.

Your device will display a message (second device screen) that it is gathering analytics. The log collection will take about ten minutes to complete. When the log collection is completed, another message will be displayed (third device screen). You can then collect the logs from Settings-> Privacy & Security-> Analytics & Improvements-> Analytics Data. The log files you want always start with the name sysdiagnose_. As the log files are usually a few hundred Megabytes in size, I recommend sending them via AirDrop to your Mac for further analysis. Thank you, Markus B. for reminding me of this feature.

For extended logging, Apple provides debug profiles. Usually, Apple support or the software vendor will tell you when it is necessary to install these debug profiles.

Quick fix for slow iOS update downloads

When new iOS updates are released, it can happen that even small updates take exceptionally long to download. In my experience the easiest fix to speed up the download is to delete the partially downloaded update and start the software update again. To delete the update in progress, navigate to Settings-> General-> iPhone Storage. Scroll down to the list of apps. There you should have an entry for the iOS update, e.g., iOS 18.1.1. Open that entry and tap on Delete Update as shown in the screenshot. Go back to Settings-> General-> Software Update to start the download again. This time the download should happen much faster. The same fix will work on your iPad, too.

Alle Macs jetzt mit 16 GB (und mehr)

Schnäppchenjäger aufgepasst. Normalerweise kauft man seine Macs besser bei Amazon, weil der Apple Shop dort die Listenpreise unterbietet. Aber wer jetzt einen MacBook Air mit M2 oder M3 kaufen will, der sollte die Ausstattung vergleichen. Bei Amazon gibt es noch Geräte mit 8 GB RAM, während alle Geräte bei Apple im Shop nun mindestens 16 GB Speicher haben. Das betrifft nicht nur die neu angekündigten Macs mit M4-Prozessor, sondern auch die MacBook Air mit M2 und M3.

Wo kommt die Sinneswandlung bei Apple her? Für Sprachmodelle braucht man gehörig Speicher und Apple will diese Modelle ja lokal laufen lassen, weil sie überhaupt nicht die Serverkapazität für alle Kunden haben. Fehlender Hauptspeicher ist auch der Grund, warum Apples AI nicht auf iPhone 15 und älter laufen wird.

Bei Copilot+PCs ist das Minimum auch 16 GB und mehr ist immer gut:

AirPods Pro 2 als Hörgerät

Meine Ohren zeigten sich im Test erfreulich gut erhalten und so kann ich die Hörgerätefunktion nicht testen. Das hat jetzt Thorsten erledigt und er schreibt dazu:

Ich habe heute mit IOS 18.1 und den passenden AirPods den Hörtest durchgeführt, die Ergebnisse passen zu meinem Gehör. Die Hörgerätefunktion funktioniert erstmal, hört sich aber anders (ungewohnt) an als mit den “normalen” Hörgeräten, da muss ich den Hörtest wohl wiederholen. Die AirPods brauchen viel Strom, sind nach ca. 3h bei 50%, die Hörgeräte laufen mit 312er Batterien mehrere Tage, außer bei viel Telefonie über Bluethooth-MFi. Bei der Chefin läuft noch der klassische Fernseher, wenn ich mich mit den Hörgeräten dazu setze, ist mir das zu leise, mit den AirPods ist das besser / besser einstellbar.

Ich denke, der Strombedarf verbietet die AirPods Pro 2 als Dauerlösung. Das ist unbefriedigend, wenn man sie nicht den ganzen Tag nutzen kann. Über Nacht aufladen wäre akzeptabel, aber sie müssten mindestens dreimal so lange durchhalten wie bisher.

Apple bewirbt die AirPods Pro 2 auch nicht als Konkurrenz zu professionell angepassten Hörgeräten sondern als “better than OTC hearing aids”, also unangepassten Hörgeräten, die über die Ladentheke verkauft werden. Dennoch erwarte ich mehrere positive Entwicklungen: Mehr Menschen werden erkennen, dass sie zu schlecht hören und etwas dagegen unternehmen. Wir werden uns daran gewöhnen, dass Menschen mit weißen Ohrstöpsel uns nicht etwa schlechter, sondern besser hören.

Es gibt noch einen anderen heilsamen Effekt. Diese AirPods Pro 2 schützen Ohren in lauten Umgebungen. Das hilft nicht gegen einen “Knall”, aber gegen einen zu hohen Geräuschpegel. Und sie können einen Gesprächspartner, der genau vor einem spricht aus dem ganzen Hintergrundlärm heraus isolieren, so wie es professionelle Hörgeräte machen.

#reklame

Apple Intelligenz in sechs Monaten

Aus der heutigen Apple-Pressemitteilung:

Mac Anwender:innen in der EU können mit macOS Sequoia 15.1 auf Apple Intelligence in Englisch (USA) zugreifen. Im April werden die Apple Intelligence Features für Nutzer:innen von iPhone und iPad in der EU eingeführt. Dazu gehören viele der Kernfunktionen von Apple Intelligence, darunter Schreibwerkzeuge, Genmoji, ein überarbeitetes Siri mit besserem Sprachverständnis, ChatGPT Integration und vieles mehr.

Auch das Kleingedruckte ist interessant: “Apple Intelligence ist auf iPhone 16, iPhone 16 Plus, iPhone 16 Pro, iPhone 16 Pro Max, iPhone 15 Pro, iPhone 15 Pro Max, iPad mit A17 Pro oder M1 und neuer sowie auf dem Mac mit M1 und neuer verfügbar.”