Apple iPad Provisioning with MDM

With a mobile device management (MDM) server, iPads install the signageOS app without anyone touching them, verify themselves into your Organization, report their serial number to Box and stay locked to signageOS after restarts and power loss.

This guide works with any MDM that supports Automated Device Enrollment, Apps and Books licences, managed app configuration and Single App Mode (App Lock), for example Jamf Pro, Microsoft Intune, Mosyle or Kandji. Menu names differ between MDMs; the steps are the same.

note

Apple Business's built-in device management can supervise iPads and install apps, but it doesn't send managed app configuration. Without it, the app can't verify itself or report the serial number. Use a full MDM for signageOS iPads.

Prerequisites

• An Apple Business account for your company (business.apple.com, formerly Apple Business Manager)
• An MDM server linked to your Apple Business account, for Automated Device Enrollment and for Apps and Books
• iPads with iPadOS 18, 26 or 27
• The UID of the Organization the iPads should join, from the Organization detail in Box

Provisioning steps

1. 1

   Add the iPads to Apple Business

   iPads bought from Apple or from a reseller linked to your Apple Business account appear in Apple Business automatically.

   Add other iPads with Apple Configurator for iPhone or Apple Configurator for Mac, following Apple's guide. The iPad must be on the Setup Assistant screen, and it is erased.

2. 2

   Assign the iPads to your MDM server

   In Apple Business, assign the iPads to your MDM server, or set your MDM server as the default for iPad. When an assigned iPad goes through Setup Assistant, it enrolls in your MDM and becomes supervised, which Single App Mode requires.

3. 3

   Get the signageOS app in Apps and Books

   In Apple Business, open Apps and Books, search for signageOS and get as many licences as you have iPads. The app is free, but Apple requires a payment method on file. Assign the licences to the location your MDM uses.

4. 4

   Add the app to your MDM

   Sync Apps and Books in your MDM and add signageOS as a managed app:

   • Use device-based licence assignment. The app then installs silently on supervised iPads, without an Apple Account.
   • Install it automatically and keep it up to date automatically.
   • Scope it to your signageOS iPads.
5. 5

   Add the managed app configuration

   Add the configuration below to the signageOS app in your MDM. See Managed app configuration for every key.

6. 6

   Lock the iPads to signageOS

   Create a Single App Mode (App Lock) profile for the app io.signageos.display.ipados and scope it to the same iPads. See Single App Mode.

7. 7

   Set up the iPads

   Turn on the iPads, or erase them if they were set up before, and go through Setup Assistant. At Remote Management, the iPad enrolls in your MDM. The MDM installs signageOS with its configuration and the Single App Mode profile. signageOS opens, verifies itself into your Organization and starts the applet assigned to it.

Managed app configuration

Key	Type	Value	What it does
organizationUid	String	your Organization UID	The device verifies itself into this Organization, with no verification code. Leave it out to verify each iPad with its code instead.
deviceName	String	a name, or your MDM's device name variable	Name of the device in Box when it verifies itself
serialNumber	String	your MDM's serial number variable	Serial number shown in Box
deviceUid	String	optional, for example your MDM's serial number variable	Fixes the signageOS device UID, so an erased and reinstalled iPad comes back as the same device. Leave it out to let the app create one. Changing it later creates a new device in Box.
kiosk	Boolean	true (default)	The app asks iPadOS for Autonomous Single App Mode when it starts. It only takes effect when your MDM allows it; see below.

The variable names depend on your MDM: for example $SERIALNUMBER and $DEVICENAME in Jamf Pro, or {{serialnumber}} and {{devicename}} in Microsoft Intune.

Example in the XML format most MDMs accept:

<dict>
  <key>organizationUid</key>
  <string>YOUR_ORGANIZATION_UID</string>
  <key>deviceName</key>
  <string>$DEVICENAME</string>
  <key>serialNumber</key>
  <string>$SERIALNUMBER</string>
</dict>

The app reads the configuration when it starts, so a change applies after the next restart of the iPad.

The app reports its signageOS deviceUid and applicationVersion back to the MDM as managed app feedback. If your MDM shows feedback, use it to match MDM records with devices in Box.

Single App Mode

Single App Mode (the App Lock payload, com.apple.app.lock) keeps the iPad on signageOS. Nobody can leave the app, and iPadOS opens it again after a restart, a power loss or a crash. It requires a supervised iPad.

In the profile, set the app to io.signageos.display.ipados and consider these options:

Option	Recommendation
Disable Auto-Lock	on, so the screen stays on
Disable Sleep/Wake button	on, so nobody turns the screen off on site
Disable volume buttons	on, unless people on site should change the volume
Disable touch	off for interactive content. It also disables the on-site menu.

To get back to the Home Screen, remove the profile from the iPad in your MDM. The app can't leave Single App Mode by itself.

Autonomous Single App Mode

If your MDM can't send an App Lock profile, allow the app to lock itself instead: add io.signageos.display.ipados to the apps allowed to use Autonomous Single App Mode in a restrictions profile. With kiosk set to true, the app locks the iPad every time it starts.

Unlike App Lock, this doesn't open the app after a restart. Prefer App Lock where your MDM offers it.

What's next

• iPad Capabilities With MDM: what your MDM can do on the iPads
• iPad Limitations Without MDM: what app-only iPads can't do