Apple is making MDM migration so much easier

If you’re using Apple products in your business, it is essential you also use a device management service, — but migrating between services has always been challenging. That will change with the release of Apple’s upcoming operating systems, which should make it easier to move between MDM platforms, including the big names such as InTune or Jamf.

MDM migration was a pain

This has been something Apple IT has wanted for a long time. It understands the many reasons it might be necessary for a company to switch between MDM services, such as:

Moving to a cloud-based device management service from an on-premises solution.

Combining devices into a single device management service when acquiring another company.

Migrating between services for more specific corporate reasons.

The process was difficult because a single device could only carry a single MDM profile, and Apple’s Automated Device Enrollment locked devices to one MDM. The only way to migrate was to remove a device from the original MDM, wipe the device (!) and then manually reenroll it with the new MDM provider.

Those steps are time-consuming and need to be repeated for each enrolled device — and the requirement to wipe a device was frequently a problem just waiting to happen.

Apple made migration easier

Apple announced a major improvement to this at June’s WWDC when it introduced Management Migration within Apple Business Manager. It lets admins assign which device management systems they want to use from the management console within ABM and set schedules for the migration to ensure all managed devices are covered. There is no need for a factory reset — data and apps stay intact and devices enrolled via Automated Device Enrollment can be migrated using the system.

Better yet, Declarative Device Management (DDM) means IT can mandate users shift to a new MDM. Once IT has scheduled the change, a user will get a warning explaining what’s happening and requesting they complete enrollment to the new service by the scheduled date. If the user doesn’t act, the organization can enforce migration onto a managed device. 

The way Apple crafted the system means that after enrollment, the new service creates a new Activation Lock. But the really good news is that you no longer need to remove a device or wipe it, which should make the whole process easier.

This noteworthy improvement builds on Apple’s existing support for device management, which the company sees as an essential component to remotely manage and secure Apple hardware.

Why does it matter?

What Apple has done here is remove a widely known pain point from its systems. Not only has it greatly reduced the amount of time IT must spend managing migration between providers, but it has managed to do so in a way that should not take too much time for end users. Scalable and verifiable, it’s another illustration of Apple’s methodical approach to improving what it provides to business.

There is always a list of wants, of course, and there always will be tweaks and improvements Apple’s enterprise customers wish for. For Apple, answering these needs will always be an iterative process — it can’t fix everything all at once, and what may seem to be problems now might later turn out to be solutions that weren’t quite complete. (Can anyone else recall the removal of support for kext files? I reckon Delta does.)

Apple’s decision to facilitate moves between MDM providers isn’t the only great improvement the company made for the enterprise at WWDC. Others include new APIs to provide even more information about what is happening across a managed device fleet, automated device enrollment, much-improved App Management and new device support for Shared Devices. You can  read more about the enterprise improvements here.

Follow me on social media! Join me on BlueSky,  LinkedIn, and Mastodon.