Automating Device Enrollment with AirWatch DEP
Rolling out a fleet of corporate MacBooks used to mean a help desk ticket per device, a USB stick per laptop, and a queue of staff waiting for an IT bod to sit down and click through setup screens. The Apple Device Enrollment Program, now folded into Apple Business Manager, paired with the AirWatch (formerly) / VMware Workspace ONE Unified Endpoint Management console, turns that grind into a background process that finishes before the courier even reaches the loading dock in Sydney.
For Australian organisations juggling hybrid teams between Brisbane, Perth, and regional Queensland, the appeal is obvious. A device purchased from a local reseller such as JB Hi-Fi Business or directly through Apple Authorised Resellers can be shipped to a home address in Adelaide, switched on, and pull its ownership profile straight from the cloud. IT never touches the keyboard.
This walkthrough explains how to set up automated device enrolment with AirWatch DEP, from linking Apple Business Manager to assigning smart profiles that recognise a device by serial number the moment it powers on. It is written for Australian IT managers who want the technical steps without the marketing fluff.
Most guides skim the high-level benefits and then skip the wiring. The mechanics matter, particularly when the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner holds your security team to account. A missed step in DEP can mean a lost laptop leaves the country with corporate data still inside.
Understanding Automated Enrollment and DEP Foundations
DEP, or the Device Enrollment Program, is Apple's framework for binding a device to an MDM server at the factory stage. When a Mac or iPad ships with DEP active, it phones home to Apple during the first boot, downloads an assigned MDM profile, and hands control to that server without the user being able to refuse.
AirWatch sits on the other end of that handshake as the MDM authority. It receives the enrolment request, evaluates the device's serial number, and applies the right configuration profile based on the smart group rules an admin has defined. The user sees a streamlined Activation Lock screen and a few guided prompts before landing on the desktop with email, VPN, and security tooling already in place.
This matters in Australia because so many staff work from satellite offices or fully remote. A mining contractor based in Kalgoorlie, a hospital clinician in Hobart, or a graduate analyst in Parramatta all benefit from receiving gear that works on first power-on rather than waiting days for a remote hand-holding session across time zones.
Prerequisites for a Smooth Setup
Before touching the AirWatch console, three things must be in place. First, an Apple Business Manager account tied to an Australian ABN or registered company name, since Apple verifies the legal entity when approving DEP activation.
Second, a verified MDM server token generated inside AirWatch. Admins navigate to Devices > Settings > Devices & Users > Apple > Device Enrollment Program and upload the public key from ABM. AirWatch responds with a download link containing the server token, which goes back into Apple Business Manager under Settings > MDM Server Assignment.
Third, a fleet of DEP-eligible devices. Modern MacBook Air, MacBook Pro, and iPad Pro models purchased from approved channels ship with DEP serial numbers pre-registered. Second-hand gear from a Brisbane office clear-out will not work, even if the serial looks clean.
It is also worth confirming that the corporate Apple ID used for Apple Business Manager belongs to someone who will not leave the company next quarter. Reassigning ownership of an ABM instance is laborious and may require contacting AppleCare Enterprise support in Sydney.
Linking Apple Business Manager to AirWatch
With the prerequisites sorted, the actual linking process takes around fifteen minutes. Inside Apple Business Manager, navigate to Settings > MDM Server Assignment, choose Assign a server, and select the AirWatch instance. Admins can assign by Default for all devices or create specific assignments by purchase order or order number, which is useful when different departments need different policies.
Back in AirWatch, refresh the Devices > Enrollment > Apple DEP page. The console will display a list of available servers and assignment groups. Selecting the freshly linked server triggers a one-time sync that pulls serial numbers, model identifiers, and purchase records into the AirWatch database.
For organisations operating across multiple states, configuring assignment groups by Apple purchase order lets the Sydney head office get one policy and the Melbourne innovation lab get another, without juggling separate ABM instances. This is particularly handy for Australian universities running BYOD programmes alongside managed staff fleets.
Building Smart Profiles That Match Real Workflows
Smart groups sit at the heart of any DEP rollout. They are dynamic queries that look at device attributes such as serial number prefix, model family, operating system version, or user-assigned tags, and push the right combination of profiles, apps, and restrictions to each device automatically.
A practical example: a healthcare provider in Western Australia might define one smart group for clinical iPads running iPadOS 17 with the Epic Haiku app, another for shared kiosk iPads in waiting rooms, and a third for staff MacBooks used for telehealth consultations. Each group receives a tailored payload including Wi-Fi certificates for the hospital network, single sign-on settings for the patient management system, and a lock-screen message directing anyone who finds a lost device to call the Perth switchboard.
Profiles themselves are created under Profiles & Resources > Profiles, then published to the relevant DEP smart group under Assignments. Because the device enrols over DEP, the profile is delivered during the Setup Assistant, before the user even creates their local account. There is no opportunity for the user to skip, refuse, or partially complete the configuration.
Comparing the Main Apple Enrollment Methods
| Feature | DEP / ABM Automated | Manual MDM Enrollment | Apple Configurator 2 |
|---|---|---|---|
| User interaction required | Minimal, guided setup | Full manual steps | None, supervised via Mac |
| Activation Lock bypass | Admin can release | Requires user passcode | Requires USB + host Mac |
| Best for Australian scale | Large fleets, distributed teams | Small offices, single site | Repurposed or legacy devices |
| Initial setup time per device | Under 5 minutes | 20-45 minutes | 10-15 minutes |
| Ongoing management overhead | Low | High | Medium |
| Supervision over-the-air | Yes, automatic | No | Requires re-attach via USB |
| Suitability for field staff in remote regions | Excellent | Poor | Acceptable |
For a deeper look at how the AirWatch console handles ongoing managing macOS with AirWatch once devices are enrolled, the overview from WindowsUEM reviews the day-to-day admin experience in detail.
Rolling Out Across Australian Workspaces
Pilot first, then scale. Pick one site, ideally a single office in Canberra or a small Adelaide branch, and run a ten-device pilot over two weeks. Capture every issue, from certificates failing to authenticate against the local ADFS proxy to users mistyping their corporate Apple ID into the iCloud prompt during setup.
Once the pilot is clean, schedule the broader rollout in waves. Many Australian IT teams stagger deployments by department to avoid flooding the help desk, a sensible approach given local engineering culture that prizes a quick arvo catch-up over formal change windows.
Communication matters as much as configuration. Send staff a one-page guide in plain English explaining that the Mac will prompt for their network credentials, then settle into the desktop within minutes. Mention that the device is supervised and managed, since the word supervised occasionally raises eyebrows among staff who associate it with surveillance rather than configuration.
Keeping the Deployment Healthy Long Term
Automation is not a set-and-forget exercise. Devices enrolled via DEP can drift out of compliance if users install rogue profiles, decline OS updates, or roam onto unsecured public Wi-Fi at a Melbourne cafe without realising the VPN is not yet connected. Build compliance dashboards in AirWatch that flag non-compliant devices daily, and pair them with automated remediation actions that wipe corporate data after seven days of no check-in.
Watch the Apple Business Manager assignment list for stale entries. When a device is sold, lost, or returned to a leasing partner, remove its serial from the ABM assignment before the new owner boots it up. Otherwise the next user inherits your management profile, which is awkward at best and a privacy breach under the Australian Privacy Principles at worst.
Schedule quarterly audits of the DEP smart groups, the profiles assigned to them, and the apps pushed through the Volume Purchase Program. As teams restructure, policies often drift behind the real org chart, and a quick tidy keeps the automation trustworthy for the next device that arrives at the Parramatta loading bay.
Ready to put this into action? Start the free 30-day AirWatch trial, map out your smart groups, and book a call with the VMware ANZ sales team to scope a pilot that suits your head count and device mix.