Enroll Apple devices with a work email

Redirect with nginx

Add this to the server block that serves your bare domain on port 443:

server {
    listen 443 ssl;
    server_name <your-domain>;
    # your existing configuration

    location = /.well-known/com.apple.remotemanagement {
        return 301 https://id.trustaige.com/mdm/apple/discovery/<your-org-id>;
    }
}

Test and reload:

sudo nginx -t && sudo nginx -s reload

Then check it is served.

Redirect with Cloudflare

Use this when your domain’s DNS is on Cloudflare and the bare domain’s record is Proxied (the orange cloud). Redirect Rules apply only to proxied traffic.

The same rule, in short:

Rules → Redirect Rules → Create rule:
  When incoming requests match: URI Path equals /.well-known/com.apple.remotemanagement
  Then: Static redirect to https://id.trustaige.com/mdm/apple/discovery/<your-org-id>, status 301

Then check it is served.

Redirect with Vercel

Add the redirect to vercel.json at the root of the project that serves your bare domain. If the file already has a redirects array, add the entry to it.

{
  "redirects": [
    { "source": "/.well-known/com.apple.remotemanagement", "destination": "https://id.trustaige.com/mdm/apple/discovery/<your-org-id>", "permanent": true }
  ]
}

Deploy to production. Vercel answers a permanent redirect with status 308, which Apple devices follow like a 301. Then check it is served.

Redirect with Netlify

Add this line to the _redirects file in your site’s publish directory (the folder Netlify deploys, such as public or dist), creating the file if it doesn’t exist:

/.well-known/com.apple.remotemanagement https://id.trustaige.com/mdm/apple/discovery/<your-org-id> 301

If you configure redirects in netlify.toml instead, the same rule is:

[[redirects]]
  from = "/.well-known/com.apple.remotemanagement"
  to = "https://id.trustaige.com/mdm/apple/discovery/<your-org-id>"
  status = 301
  force = true

Deploy, then check it is served.

Redirect with Apache

Add this line to the .htaccess file at the root of your bare domain’s site, or to its <VirtualHost *:443> block. It needs mod_alias, which is on by default, and, in .htaccess, AllowOverride FileInfo or All.

Redirect 301 /.well-known/com.apple.remotemanagement https://id.trustaige.com/mdm/apple/discovery/<your-org-id>

If you edited the virtual host, test and reload:

sudo apachectl configtest && sudo apachectl graceful

Then check it is served.

Host the file yourself

If you’d rather not redirect, serve this record at /.well-known/com.apple.remotemanagement on your bare domain:

{
  "Servers": [
    {
      "Version": "mdm-adde",
      "BaseURL": "https://id.trustaige.com/mdm/apple/account-enroll/<your-org-id>"
    }
  ]
}

It must come back with status 200 and Content-Type: application/json. Apple requires that content type, and most servers send a file without a known extension as application/octet-stream, so set it explicitly:

location = /.well-known/com.apple.remotemanagement {
    default_type application/json;
    alias /var/www/well-known/com.apple.remotemanagement;
}

<Files "com.apple.remotemanagement">
    ForceType application/json
</Files>

mdm-adde tells the device to do an account-driven Device Enrollment, which is the only kind Trustaige serves. A record you host doesn’t change when your organization does: if it ever stops managing Apple devices, remove the file.

Check it is served

Ask for the record the way a device does, following redirects:

curl -sSL -D - https://<your-domain>/.well-known/com.apple.remotemanagement

With a redirect, you should see the redirect, then Trustaige’s answer (the HTTP version and other headers vary):

HTTP/2 301
location: https://id.trustaige.com/mdm/apple/discovery/<your-org-id>

HTTP/2 200
content-type: application/json
cache-control: no-store

{"Servers":[{"Version":"mdm-adde","BaseURL":"https://id.trustaige.com/mdm/apple/account-enroll/<your-org-id>"}]}

If you host the file yourself, you see a single 200 with content-type: application/json and your file’s contents. Either way, the BaseURL must end in your organization short ID.

A 404 from Trustaige’s copy means the redirect works but your organization isn’t ready: the Apple push certificate isn’t set up yet, or Apple device management isn’t available to your organization. Tell your administrator.

You can also check the enrollment address the record points to. Asked without a sign-in, it answers 401 and tells the device where to send the person to sign in:

curl -si -X POST https://id.trustaige.com/mdm/apple/account-enroll/<your-org-id>

HTTP/2 401
www-authenticate: Bearer method="apple-as-web" url="https://id.trustaige.com/mdm/apple/account-enroll/<your-org-id>/auth"

Last, tell your administrator it’s done. They run the hub’s own check (below), which fetches the record from the internet and confirms it.