Devices

Set up Apple device management

Manage your organization's Macs, iPhones and iPads with Trustaige. Create the push certificate, connect Apple Business Manager and enroll devices.

Trustaige manages Macs, iPhones and iPads directly, with no separate device management product. Once a device is enrolled you can require a passcode, keep it up to date, push Wi-Fi and apps, check that it’s compliant before anyone signs in from it, and lock or erase it if it’s lost.

Before you begin

You need	Why
The Scale or Premier plan	Device management is part of these plans.
An Apple Account	To create the push certificate at identity.apple.com. A free account works; no paid developer membership is needed. Use a shared role mailbox, such as `mdm@yourcompany.com`, not a person’s own account: you need the same account every year to renew.
Apple Business Manager (optional)	For company-owned devices: they enroll themselves at first boot and are supervised, which unlocks more controls.
Apps and Books (optional)	To install App Store apps on devices.

Everything below happens in the hub under Devices → Providers → Apple.

1. Create the push certificate

Apple only lets a device management service reach a device through Apple’s push service, and that needs a certificate issued to your organization. It is the one thing you must set up.

In Devices → Providers → Apple, find Full MDM — APNs push certificate and click Set up push certificate.
Read Before you begin, then click Continue.
Click Generate & download request. The hub creates a signed request, trustaige-push-certificate-request.plist, and keeps its private key. You’ll be asked to confirm it’s you.
Open identity.apple.com and sign in with your Apple Account. Click Create a Certificate, accept the terms, upload the request file, and download the certificate Apple issues (a .pem file).
Back in the hub, enter the Apple Account you used, click I have the certificate, then Choose certificate file and Save push certificate.

The card now shows Push certificate configured, with its push topic, the date it expires and the Apple Account it belongs to. If you leave partway through, the card offers Resume setup or Discard.

2. Connect Apple Business Manager (optional)

Connect Apple Business Manager if your organization buys devices through it. Its devices enroll themselves the first time they start, with no one needing to install anything, and they are supervised: the person can’t remove management, and you can restart them remotely, put iPhones and iPads in Lost Mode, and use restrictions that need supervision.

In the Apple Business Manager card, click Download certificate (trustaige-abm.pem). The card appears once the push certificate is set up.
In Apple Business Manager, add an MDM server (Settings → Device Management Settings → Add) and upload that file as its key. Download the server token Apple Business Manager gives you (a .p7m file).
Back in the hub, click Upload server token and choose it. You’ll see Apple Business Manager connected.
Assign devices to Trustaige’s MDM server in Apple Business Manager, then click Check for devices. The hub also checks every hour.
Each device appears by serial number as Ready to enroll or Needs an owner. Click Assign and choose the person who will use it.

A device can’t finish setup until it has an owner: it stops with “setup is incomplete — assign an owner to this device, then restart setup”. Assign one, then restart setup on the device.

3. Connect Apps and Books (optional)

To install App Store apps, download a content token from Apple Business Manager (Preferences → Payments and Billing → Content Tokens) and click Upload content token in the Apps and Books card. Apps then appear under Apps in your Apple settings (below), as Required or Optional.

Enroll devices

How a device enrolls decides who owns it, and you don’t set this by hand. A device whose serial number is in your Apple Business Manager is Corporate. Any other device is Personal (BYOD).

Company devices from Apple Business Manager

Nothing to do on the device beyond turning it on. It contacts Trustaige during setup, enrolls, and is tied to the owner you assigned. Management can’t be removed from it.

Any other device

The person enrolls it themselves from the hub. Send them these steps:

Sign in to Trustaige, open My devices and click Enroll a device.
Choose iPhone, iPad & Mac, then Generate enrollment profile. A QR code and a link appear. They expire after 15 minutes.
On an iPhone or iPad: scan the QR code and tap Allow. Then open Settings → Profile Downloaded and tap Install. Use Safari: other browsers can’t install the profile.
On a Mac: open the link in Safari on the Mac, then go to System Settings → General → Device Management, select the profile and click Install.

If the option says “Not configured — ask your admin to set up Apple device management”, the push certificate isn’t set up yet.

A person can remove management from their own personal device; only an administrator can remove it from a corporate one.

What each enrolled Mac gets

Every Mac that enrolls also receives Trustaige’s agent and the Trustaige sign-in app automatically. The agent is what reports a Mac’s administrators and screen-lock setting, and what local admin rights uses.

Require and manage settings

Open Devices → Policy and choose the Apple MDM tab. Pick Mac or iPhone & iPad, then:

Require sets what a device must meet to be compliant:
- Mac: “FileVault is on”, “macOS is current” (with a minimum version), “Firewall is on”, “Screen lock is set”.
- iPhone & iPad: “Passcode is set”, “Passcode meets the policy”, “iOS is current”.
Manage sets what Trustaige applies to devices:
- Passcode: minimum length, wipe after failed attempts, lock after inactivity, letters and numbers.
- Software updates: a target version and an Install by deadline.
- Restrictions: about 70 controls. Some say Supervised devices only: they apply only to devices from Apple Business Manager.
- Wi-Fi networks, Web clips, Managed domains.
- Custom profiles: upload a .mobileconfig. The hub inspects it first.
- Apps: App Store apps through Apps and Books.

Save each panel with Save changes. Posture is refreshed every hour, and the top of the tab shows how many devices are reporting and how many need attention.

Commands

Open a device from Devices → Fleet and go to the Configuration tab. Commands run the next time the device checks in. You’ll see Command queued.

Command	Works on	Notes
Sync device, Refresh posture	All	Ask the device to check in and report now.
Remote lock	All	A Mac is locked at the firmware and opens only with the 6-digit PIN shown by Reveal PIN. An iPhone or iPad locks with a message on its lock screen.
Restart device	Macs; supervised iPhones and iPads
Clear passcode	iPhone and iPad	When the device has given Trustaige an unlock token.
Turn on Lost Mode	Supervised iPhones and iPads	Then Locate again or Turn off Lost Mode.
Activation Lock bypass	Supervised devices	Reveal bypass code to reuse a device after erasing it.
Re-check administrators	Macs	Asks the agent to report who has admin rights.

Erase a device

Erase device is in the device’s Danger Zone. Because erasing can’t be undone, it takes two people: you type the device’s name to request it, and a different superadmin approves it within 24 hours from the Erase awaiting approval banner (Approve reset or Deny). Your organization needs at least two superadmins to erase a device.

Remove a device from management

You: on the device page, choose Unenroll. The device removes management the next time it checks in.
The person: from My devices, for a personal device only.
A Mac that stops checking in for a week is retired from management automatically.

To stop managing Apple devices altogether, use Remove… on the push certificate card. Do this only after unenrolling devices: once the certificate is gone, removal commands can’t reach them.

Troubleshooting

You see	What it means
“certificate does not match the pending request”	The `.pem` came from a different request. Generate a new request in the hub and repeat the identity.apple.com step with it.
“no pending push certificate request”	Generate the signed request first (step 1.3).
“That file is not a PEM certificate”	Upload the `.pem` Apple issued, not the request file.
An Apple Business Manager error about terms	Sign in to Apple Business Manager and accept its latest terms, then try again.
“…needs the Device Enrollment Manager role”	The Apple Business Manager account that made the server token needs that role.
“decrypting token — was this token generated for a different certificate?”	The server token was made with another certificate. Download the certificate from the hub again, upload it to the MDM server in Apple Business Manager, and download a new token.
“Lost Mode needs a supervised device”	Lost Mode and some other commands work only on devices from Apple Business Manager.
Push certificate Expired	Devices can’t be reached. Renew it (don’t create a new one) at identity.apple.com with the same Apple Account.