Skip to main content
Solved

iOS/iPadOS Enrollment Workflow

  • February 11, 2026
  • 4 replies
  • 81 views
C
Forum|alt.badge.img+4

Thanks in advance for your input...

Our current scenario: our newly purchased iOS/iPadOS devices are automatically enrolled into Jamf Pro and then go into a default group. This group has a relatively restrictive Configuration Profile that prevents users from adding an Apple Account. If the user needs a different configuration or apps on their device, they need to submit a form to the device management team. From there, the device mgmt team works with the user and so on. Since we’re in education, we’re dealing with a full gamut of needs, business apps, engineering, utility/infrastructure, scientific, entertainment, media, development...you get the idea. So, we can’t anticipate ALL of the apps users want beforehand.

Questions: what is your organization's workflow for newly purchased iOS/iPadOS devices? And how do you communicate to end-users where to go for additional support/apps/configs when they power on their new device?

We're thinking either a wallpaper with messaging about reaching out to IT for assistance...or a "start here" app that guides end-users to IT...or something else. We're interested in hearing what other solutions you all have developed.

Best answer by h1431532403240

Great question — this is a common challenge in education environments where you can't predict every app or configuration need upfront. Here's a recommended approach that combines several Jamf Pro features:

Recommended Workflow:

1. Automated Device Enrollment (PreStage) → Default Group → Self Service

Your current flow (ADE → default group with restrictive profile) is solid. The key missing piece is giving users a clear, self-service path for additional needs. Jamf Self Service for iOS is purpose-built for this — it acts as your "start here" app and ongoing app catalog in one.

You can auto-deploy Self Service to all devices via Volume Purchasing (VPP) so it's on the device from the start. From there, users can browse and install approved apps, configuration profiles, and web clips on their own without submitting a form for common requests.

2. Wallpaper as a Communication Channel

Your wallpaper idea is a great complement. Use the Set Wallpaper remote command via Smart Device Groups to push a branded wallpaper on the Lock Screen with a message like "Need apps or support? Open Self Service or contact IT at help@school.edu." This works on supervised devices and you can lock it down with a Restrictions profile to prevent users from changing it.

3. Enrollment Customization for First-Time Setup

Use Enrollment Customization in your PreStage to show a branded welcome screen during initial setup. This is the first thing users see and can include instructions like "Once setup is complete, open Self Service for additional apps."

Practical Combination:

  • Enrollment Customization → Welcome message during setup with IT contact info
  • Self Service for iOS → Auto-installed, serves as the ongoing app/config catalog
  • Set Wallpaper → Reinforces where to go for help on Lock/Home Screen
  • Web Clip → Pin an IT help desk shortcut to the Home Screen as a fallback

This way you don't need a custom "start here" app — Self Service + wallpaper + a web clip covers the same need with zero development effort.

References:

4 replies

h1431532403240
Forum|alt.badge.img+6
  • h1431532403240
  • Contributor
  • Answer
  • February 12, 2026

Great question — this is a common challenge in education environments where you can't predict every app or configuration need upfront. Here's a recommended approach that combines several Jamf Pro features:

Recommended Workflow:

1. Automated Device Enrollment (PreStage) → Default Group → Self Service

Your current flow (ADE → default group with restrictive profile) is solid. The key missing piece is giving users a clear, self-service path for additional needs. Jamf Self Service for iOS is purpose-built for this — it acts as your "start here" app and ongoing app catalog in one.

You can auto-deploy Self Service to all devices via Volume Purchasing (VPP) so it's on the device from the start. From there, users can browse and install approved apps, configuration profiles, and web clips on their own without submitting a form for common requests.

2. Wallpaper as a Communication Channel

Your wallpaper idea is a great complement. Use the Set Wallpaper remote command via Smart Device Groups to push a branded wallpaper on the Lock Screen with a message like "Need apps or support? Open Self Service or contact IT at help@school.edu." This works on supervised devices and you can lock it down with a Restrictions profile to prevent users from changing it.

3. Enrollment Customization for First-Time Setup

Use Enrollment Customization in your PreStage to show a branded welcome screen during initial setup. This is the first thing users see and can include instructions like "Once setup is complete, open Self Service for additional apps."

Practical Combination:

  • Enrollment Customization → Welcome message during setup with IT contact info
  • Self Service for iOS → Auto-installed, serves as the ongoing app/config catalog
  • Set Wallpaper → Reinforces where to go for help on Lock/Home Screen
  • Web Clip → Pin an IT help desk shortcut to the Home Screen as a fallback

This way you don't need a custom "start here" app — Self Service + wallpaper + a web clip covers the same need with zero development effort.

References:

    woaikonglong
    Forum|alt.badge.img+9
    • woaikonglong
    • Jamf Heroes
    • February 12, 2026

    We are a smaller independent school with users ranging from adult to 3 year olds. Newly purchased devices go in, everyone gets the “basic” config profile, after that we work individually with departments to provide the group what they need based on smart groups that we then create. Sometimes we have a user that says “I don’t need ‘App A’, only ‘that guy’ does,” so we tell them to ignore it, and it has worked so far. In terms of how we communicate to reach out to IT (me) for help, it was the verbal message when I handed them their device and said to be nice to it.

    Alison Wojahn, Technology Manager & "imposter extraordinaire"
    C
    Forum|alt.badge.img+4
    • chobee
    • Author
    • New Contributor
    • February 12, 2026

    ...it was the verbal message when I handed them their device and said to be nice to it.

    Thank you for the reply Alison. Is it more of a command or a plea? 😄

    woaikonglong
    Forum|alt.badge.img+9
    • woaikonglong
    • Jamf Heroes
    • February 12, 2026

    ...it was the verbal message when I handed them their device and said to be nice to it.

    Thank you for the reply Alison. Is it more of a command or a plea? 😄

    To be honest, we take away their app store and push out all apps ourselves, and lock some things they would like to do in settings, so it is more informing them that they do not have a choice in the matter, but that we are happy to help. HR even requested Candy Crush and Netflix for their group when they go to conferences, and the ability to have a device lock (we are a “no locks” community). We let them have it since there was no good reason not to in those instances. When security tried to get Netflix through the web and reported the failure as a “bug” for a device they argued they needed to monitor cameras, we didn't allow it without HR approval, which was denied since it was supposed to be a monitoring device.

    Alison Wojahn, Technology Manager & "imposter extraordinaire"
      Terms & ConditionsCookie settingsAccessibility statement