DEP is not required for the VPN profile configs, that can be applied with just MDM (or even manually). The VPN payloads are documented here https://developer.apple.com/enterprise/documentation/Configu...
If the device was purchased on or after March 1st 2011 you can do the following:
1. Work with your reseller if they participate in DEP to get the devices enrolled retroactively. Sometimes you have to put the nails on the reseller (they can pretty bad about this. Looking at you Verizon) but it absolutely can be done.
2. If your devices are eligible and were a direct purchase from Apple you should contact Apples enterprise support and they can start the process of double checking eligibility and getting those devices enrolled accordingly. This is pretty straightforward.
3. You can enroll eligible devices via Apple Configurator 2 into DEP using the process described here:
https://help.apple.com/configurator/mac/#/cad99bc2a859
Using Apple Configuratior 2 will allow you to bypass any reseller to enroll into DEP so it’s your best move if you are having issues getting people to do it fast enough. Any eligible device can be enrolled this way
Here’s a relevant help link with phone numbers more On eligibility and enrolling etc
https://support.apple.com/en-us/HT204142#manual
I see this misinformation so much so please help share it if you can
https://support.jamfnow.com/hc/en-us/articles/360000004483-U...
So you need to provide a DEP-authorized account number to the salesperson in an Apple store? Is this possible when buying online from apple.com?
Any idea why Apple does not provide a service to test whether a device serial number is DEP-managed? It would deter attempts to resell DEP-managed devices.
Any idea why Apple does not provide a service to test whether a device serial number is DEP-managed?
Because once you know the serial number of a DEP device you can enroll into the MDM. There is virtually no security. See https://duo.com/labs/research/mdm-me-maybe
> an attacker that obtains such a serial number ... will be able to enroll a device of their own as if it were owned by the organization, as long as it's not currently enrolled in the MDM server.
So, the rule is at-most-once enrollment.
And further down:
> some organizations elect not to require user authentication as part of MDM enrollment.
IOW, if you are not enabling authentication, you have only yourself to blame.
Commercial MDM providers only whitelist a handful of VPN client apps for per-app VPN profiles. Why are those needed when there is already a native iOS VPN client for IPSEC?
That's all commercial vendors do, push these XML files to your device.
