Apple iPad Provisioning with signageOS MDM

signageOS MDM is our own mobile device management (MDM) service for iPad. We built it and we run it, and it connects directly to Apple Business. You manage the iPads in Box, next to your displays.

With signageOS MDM, a new iPad sets itself up the first time it is turned on:

• It enrolls in signageOS MDM over the air, with no cable, and becomes supervised.
• signageOS MDM installs the signageOS app silently, without an Apple Account.
• The app verifies itself into your Organization and reports the iPad's serial number to Box.
• The kiosk lock keeps the iPad on signageOS, also after a restart, a power loss or a crash.
• A technician on site can lift the kiosk lock for 30 minutes with the device PIN. It locks again by itself.

Prerequisites

• An Apple Business account for your company (business.apple.com, formerly Apple Business Manager), and a user in it whose role can manage device management services
• iPads with iPadOS 18, 26 or 27
• The Organization in Box that the iPads should join

Provisioning steps

1. 1

   Get the signageOS MDM certificate

   Contact us and tell us the Organization the iPads should join. We send you the signageOS MDM certificate (a public key file) for Apple Business.

2. 2

   Connect signageOS MDM in Apple Business

   In Apple Business, go to Devices → Management Services and choose Connect external device management (or Get Started if it's your first service). Name the service signageOS, upload the signageOS MDM certificate, then choose Download Service Token. Provide the token file to signageOS. It is encrypted with the certificate, so only signageOS MDM can use it.

   Apple's guide: Link to an external device management service. The token is valid for one year. Before it expires, download a new one in Apple Business and provide it to signageOS again.

3. 3

   Add the iPads to Apple Business

   iPads bought from Apple or from a reseller linked to your Apple Business account appear in Apple Business automatically.

   Add other iPads with Apple Configurator for iPhone or Apple Configurator for Mac, following Apple's guide. The iPad must be on the Setup Assistant screen, and it is erased.

4. 4

   Assign the iPads to signageOS MDM

   In Devices → Inventory, select the iPads, choose Assign Device Management and select signageOS. To send every new iPad to signageOS MDM automatically, set signageOS for iPad in Default Device Assignment.

   An iPad enrolled in Apple Business's built-in device management must be unenrolled before it can move to signageOS MDM. Apple's guide: Assign, reassign, or unassign devices.

5. 5

   Set up the iPads

   Turn on the iPads. An iPad that was set up before has to be erased first: Settings → General → Transfer or Reset iPad → Erase All Content and Settings.

   Go through Setup Assistant. At Remote Management, the iPad enrolls in signageOS MDM. signageOS MDM installs the signageOS app and turns on the kiosk lock. The app opens, verifies itself into your Organization and appears in Box.

6. 6

   Assign an applet

   In Box, assign an applet to the new devices.

   On the first launch, iPadOS asks whether signageOS may use your location. Tap Allow While Using App if you want Box to show the name of the Wi-Fi network the iPad is connected to. No MDM can answer this prompt for you. signageOS doesn't collect the location, and everything else works if you don't allow it.

Manage the iPads in Box

Everything signageOS MDM does is in Box:

Where in Box	What you do there
Device detail → Apple MDM	One iPad: kiosk lock and maintenance, installed apps, restrictions, configuration profiles, iPadOS updates, Lost Mode and Activation Lock, iPad name and time zone, restart, shut down and lock screen
Device policy → iPadOS	Many iPads at once: kiosk lock and its options, required apps and their managed configuration, restrictions, Wi-Fi with proxy, iPadOS updates, device name, time zone, wallpaper, Lock Screen message, Home Screen layout and Setup Assistant panes to skip
Packages → iPadOS apps	Your iPad apps: add App Store apps, Custom Apps from Apple Business and your own builds, install and update them, edit their managed configuration and lock iPads to one of them

What each action does is listed in iPad Capabilities With signageOS MDM.

Kiosk lock

The kiosk lock is Apple's Single App Mode (App Lock). Nobody can leave the app, and iPadOS opens it again after a restart, a power loss or a crash. signageOS MDM turns it on for the signageOS app when the iPad enrolls, with Auto-Lock off so the screen stays on.

Change the lock options in the device policy, under Kiosk and apps → App Lock options:

Option	Recommendation
Disable Auto-Lock	on, so the screen stays on
Disable sleep/wake button	on, so nobody turns the screen off on site
Disable volume buttons	on, unless people on site should change the volume
Disable touch	off for interactive content. It also disables the on-site menu.

On-site maintenance mode

A technician on site can take the iPad out of the kiosk lock: hold three fingers on the screen for 3 seconds, enter the device PIN and choose Start maintenance. The kiosk lock is lifted for 30 minutes and comes back by itself, or right away with End maintenance. The PIN is shown in the device detail in Box.

From Box, do the same in the device detail, Apple MDM → Kiosk: Lift for 30 min and Lock now.

Other iPad apps

signageOS MDM deploys and locks other apps too, such as an ordering or check-in app. In Packages → iPadOS apps, choose Add iPad app and pick an App Store app, a Custom App that Apple Business assigned to your organization, or upload your own .ipa. Then install it on the iPads and, if the iPads should run only that app, choose Lock to Single App Mode. Each App Store app uses one licence per iPad, which you get in Apple Business under Apps and Books.

What's next

• iPad Capabilities With signageOS MDM: everything you can do on the iPads from Box
• iPad Limitations Without MDM: what app-only iPads can't do