Shared iPad requires Managed Apple IDs, created via Apple School Manager (ASM) or Apple Business Manager (ABM), to enable multiple users to log in with separate sessions. These IDs are organization-controlled and integrate with MDM for session management. Personal Apple IDs (options A and C, the same) are for individual use and incompatible with Shared iPad. There’s no “Shared Apple ID” (option D); Shared iPad uses individual Managed Apple IDs or temporary sessions. TheApple Platform Deployment Guidemandates Managed Apple IDs for Shared iPad.

Apple Business Manager (ABM) supports the distribution of multiple app types via Managed Distribution: custom apps (developed in-house), free apps (from the App Store), and purchased apps (bought through ABM’s Apps and Books section). This flexibility allows organizations to manage all app needs within ABM, assigning them to users or devices via MDM. Options A, B, and C are all correct individually, but D encompasses them all, aligning with ABM’s comprehensive capabilities as outlined in theApple Business Manager User Guide.

Apple documents that devices prioritizepreferred networksfirst — these are networks the user or MDM has explicitly joined and saved. If no preferred networks are available, devices then attempt to joinprivate networks(those that do not broadcast public hotspots but are available locally). Finally, as a last resort, devices may joinpublic networks, such as captive Wi-Fi portals or unsecured hotspots. Apple Learning highlights this hierarchy to ensure consistent enterprise behavior and user experience. Administrators can influence priority through MDM-delivered Wi-Fi payloads, placing organizational SSIDs at the top of the preferred list. Public networks are deliberately last in the sequence because they are less secure and more likely to involve captive portals, which disrupt automatic connectivity.

When Activation Lock is enabled on a supervised Apple device, the organization needs a way to recover the device if a user leaves or forgets credentials. Apple Learning states that MDM can escrow and store abypass codefor Activation Lock. This code can then be used by IT administrators to unlock and reactivate the device without needing the original Apple ID. It is not stored in ABM/ASM, nor tied to the user’s Managed Apple Account or personal Apple ID. Instead, it resides in the organization’s MDM solution for controlled use. This ensures organizations can always return supervised devices to service while still maintaining theft deterrence against unauthorized users.

Anenrollment profileis what links an Apple device to an MDM server. Apple Learning resources are clear that the enrollment profile must always contain anMDM payload. This payload defines the server address, authentication method, and settings required for the device to establish secure management. Without the MDM payload, the device cannot receive configuration profiles, apps, or commands from the MDM solution. Other items such as configuration profiles or provisioning profiles may be distributed after enrollment, but they are not part of the required enrollment profile. The MDM payload is therefore the critical element that makes enrollment functional.

On FileVault-enabled Macs, disk encryption ties directly to the user password. If the password is lost, recovery relies on keys. Apple supports two key models: thepersonal recovery key (PRK)and the institutional recovery key (IRK). The PRK is unique per device and can be escrowed securely to an MDM solution. In the event of a forgotten password, the IT administrator can retrieve the PRK from MDM and provide it to the user for unlocking the Mac. Apple strongly recommends escrow of PRKs in enterprise deployments to ensure encrypted Macs remain recoverable without requiring device erasure.

Apple’smanaged software updatesallow MDM administrators to enforce deadlines for macOS upgrades or patches. Apple Learning specifies that if the user does not manually install the update before the deadline, theupdate installs automatically. This occurs regardless of user activity, ensuring the Mac is brought into compliance. Users may receive reminders before the deadline, but once the deadline passes, the update is forced to install. This guarantees that security patches or new OS versions are not indefinitely delayed by end-user inaction. Notifications are not suppressed, and there is no 30-day deferral once a deadline is in effect. The entire purpose of this mechanism is to ensure organizations can enforce timely compliance with critical security or functional updates.

Custom local networks and public IP settings span subnets. ThemacOS Deployment Referencestates, " To optimize bandwidth across subnets, use ‘Cache content for devices using custom local networks’ to specify multiple subnets and ‘devices using the same public IP address’ for broader reach. "

Apple introducedUser Enrollmentto support BYOD (Bring Your Own Device) scenarios. In bothAccount-driven User EnrollmentandAutomated User Enrollment, data separation is cryptographically enforced between organizational and personal data. Apple Learning emphasizes that apps like Calendar, Contacts, Notes, and Mail can store both personal and work accounts, but the data is kept in separate containers that cannot interact. For example, an organization’s managed calendar events cannot be copied into a user’s personal calendar. This guarantees user privacy while protecting organizational data. Automated Device Enrollment, by contrast, fully manages the device and does not enforce the same cryptographic separation. Profile-driven User Enrollment is deprecated in favor of account-driven. The key principle here is thatUser Enrollment modes create strong boundaries between personal and managed data.

On supervised devices, conversion is seamless. TheMobile Device Management Protocol Referencestates, " On supervised devices, MDM can convert an unmanaged app to managed without user interaction when deploying the managed version. "