iOS MDM service and MDM agent app

Question

I'm researching about MDM in iOS, and find out information about Apple’s native iOS mobile device management. Once the device is enrolled into a MDM server, server can manage the device by sending commands. I tested on a MDM server and saw that without installing MDM agent app on device, server can still send profiles and apply policies to the device.

Could anyone help me to address:

1. Is Apple’s native iOS mobile device management built inside the iOS itself?
2. Can MDM server manage device (install apps, disable camera, iTunes...) without installing a MDM agent app?
3. How can the device itself can communicate with MDM server and install profiles sent from server automatically?
4. Do I need an enterprise account to use iOS MDM service?
5. Where can I find documents about MDM API and how to use it?

Answer 1

Is Apple’s native iOS mobile device management built inside the iOS itself?

Yes - as of iOS4 devices become MDM-capable.

Can MDM server manage device (install apps, disable camera, iTunes...) without installing a MDM agent app?

Yes. The only thing an MDM Agent app will get you is the ability to report back on the device's IP address / network information, custom logging, etc. By default iOS does not allow for "tracking" a user's network details.

How can the device itself can communicate with MDM server and install profiles sent from server automatically?

This is what I refer to as "the circle of hell". Your MDM sends command/installation packets to the APNs server, the APNs server tells the device it has a pending command from the MDM, the device reaches out to the MDM for its instructions and acknowledges. My nickname is for the trouble it takes to get firewall permissions setup in large enterprises.

Do I need an enterprise account to use iOS MDM service? Where can I find documents about MDM API and how to use it?

To use an MDM service you do not need an Enterprise account. To create an MDM service and access its documentation you do need an Enterprise account at $299/year.

Answer 2

1. Yes.
2. N/A as the 'agent' is already built in iOS
3. To manage a device by MDM, the device must be enrolled manually first. During the enrollment process, a configuration file will be installed in the device containing the information of the MDM server. The MDM framework also make use of push notification to communicate with the device.
4. Yes. In addition, you also need the ability to generate MDM Vendor Certificate on Apple's Developer Portal.