Overview
With Apple Enrollment SSO, employees sign in with a Managed Apple Account on a Mac, iPhone, or iPad, and the device enrolls in Swif automatically. They don't need to sign in to Swif separately. This is Apple's account-driven enrollment.
You can set up Enrollment SSO three ways:
Method | How it works |
Host by JSON | You serve a |
Host by Proxy | Your web server, such as Nginx, forwards that address to Swif. |
Apple Business Manager service discovery | Devices get Swif's enrollment address from Apple Business Manager (ABM), when the |
BYOD and company-owned enrollments
Enrollment SSO supports two of Apple's account-driven enrollment types. Which one a device uses depends on whether you set it up for BYOD or company-owned devices.
| BYOD | Company-owned (non-BYOD) |
Apple enrollment type | Account-driven User Enrollment | Account-driven Device Enrollment |
Value in the JSON |
|
|
Who it's for | Personal devices | Company-owned devices |
What Swif can manage | A separate, managed part of the device. Personal data stays private, and many device-wide settings aren't available. | The whole device |
Swif agent | Can't be installed | Installed |
BYOD Enrollment SSO limits what Swif can manage. With account-driven User Enrollment, Apple doesn't allow many device-wide settings, and the Swif agent can't be installed. On Macs enrolled this way:
Policies that need the Swif agent don't work, such as the Apple Hardening Policy and agent-based tracking.
Some settings aren't allowed by Apple, such as approving system extensions and granting privacy permissions, like Full Disk Access. Apps that need these, such as Huntress, can't be deployed silently.
Some policy settings may make the profile fail, such as the sudo settings in the Apple User Authorization Policy.
For full management of personal Macs, enroll them with Swif's standard BYOD enrollment instead, using the Application or Silent installer method. See Swif enrollment methods for all OSs.
Choose a hosting method
You need | Use |
Only BYOD, or only company-owned enrollments | Host by JSON, with one domain |
Both BYOD and company-owned enrollments | Host by JSON, with two domains (one for each), or Host by Proxy, with one domain |
No hosting on your own domain | Apple Business Manager service discovery |
Host by JSON lets you host the file on your root domain, so each Managed Apple Account can be the same as the employee's work email.
Prerequisites
Administrator access to Swif, and to Apple Business Manager (ABM) or Apple School Manager (ASM).
For Host by JSON: the ability to upload files to your domain. For Host by Proxy: the ability to set up a proxy on your web server.
Managed Apple Accounts for your employees in ABM or ASM. See Add Managed Apple Accounts below.
ABM lets users sign in to their Managed Apple Account with Google, Microsoft Entra ID, or Okta credentials. To set this up, go to Managed Apple Accounts in ABM.
Host on your own domain
Host by JSON
Configuration | Use when |
BYOD JSON | All Enrollment SSO enrollments should be BYOD |
Non-BYOD JSON | All Enrollment SSO enrollments should be company-owned |
Get your configuration
Swif provides both configurations, and the proxy settings, with one API call:
curl -X GET "https://mdm.swifteam.com/api/v2/sso/enroll/json" \
-H "Authorization: Bearer {{TOKEN}}" \
-H "team-id: {{TEAM-ID}}"
For EU organizations, use mdm.eu.swifteam.com.
The response includes your team identifier, the static JSON for BYOD and non-BYOD, and proxy settings:
{
"teamIdentifier": "{{IDENTIFIER}}",
"adde": {
"Servers": [
{
"Version": "mdm-adde",
"BaseURL": "https://mdm.swifteam.com/api/v1/sso/enroll?team-identifier={{IDENTIFIER}}"
}
]
},
"byod": {
"Servers": [
{
"Version": "mdm-byod",
"BaseURL": "https://mdm.swifteam.com/api/v1/sso/enroll?team-identifier={{IDENTIFIER}}&isbyod=true"
}
]
},
"proxyConfigs": { ... }
}You can also download the JSON files from Swif's Enrollment SSO settings:
JSON For BYOD Device
JSON For Non BYOD Device
Option A: BYOD JSON (account-driven User Enrollment)
Use this if all Enrollment SSO enrollments should be BYOD. See BYOD and company-owned enrollments for what this means.
Download the BYOD JSON, or copy the
byodsection from the API response.Serve it at
{{YOUR_DOMAIN}}/.well-known/com.apple.remotemanagement.The address must return only the JSON text, with no
.jsonextension, and no HTML.
Option B: Non-BYOD JSON (account-driven Device Enrollment)
Use this if all Enrollment SSO enrollments should be company-owned.
Download the non-BYOD JSON, or copy the
addesection from the API response.Serve it at
{{YOUR_DOMAIN}}/.well-known/com.apple.remotemanagement.The address must return only the JSON text, with no
.jsonextension, and no HTML.
Set the content type
The file must be served with content-type: application/json. To check:
curl -sI https://YOURDOMAIN/.well-known/com.apple.remotemanagement | grep -i content-type
It should return:
content-type: application/json
Host by Proxy
Use this if some users should enroll as BYOD, and others as company-owned, on the same domain. A proxy forwards requests for /.well-known/com.apple.remotemanagement to Swif, which decides the enrollment type for each user.
How it works
You set up a proxy on your domain, so requests for
/.well-known/com.apple.remotemanagementgo to Swif.First attempt: the user signs in with their Managed Apple Account. Swif remembers their email, and asks them to close the window and start again.
Second attempt: Swif recognizes the user, and enrolls the device as BYOD or company-owned, based on the user's settings in Swif.
Why two attempts? Apple starts the enrollment before the sign-in page opens. The first attempt lets Swif identify the user, and the second completes enrollment with the right type.
Proxy settings
The API response includes ready-to-use settings for common web servers, under proxyConfigs. The proxy target is:
https://mdm.swifteam.com/api/v1/sso/well-known/{{IDENTIFIER}}For EU organizations, use mdm.eu.swifteam.com.
Nginx:
location = /.well-known/com.apple.remotemanagement {
proxy_pass https://mdm.swifteam.com/api/v1/sso/well-known/{{IDENTIFIER}};
proxy_set_header Host mdm.swifteam.com;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Caddy:
handle /.well-known/com.apple.remotemanagement {
rewrite * /api/v1/sso/well-known/{{IDENTIFIER}}
reverse_proxy https://mdm.swifteam.com {
header_up Host mdm.swifteam.com
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
}Apache:
ProxyPass "/.well-known/com.apple.remotemanagement" "https://mdm.swifteam.com/api/v1/sso/well-known/{{IDENTIFIER}}"
ProxyPassReverse "/.well-known/com.apple.remotemanagement" "https://mdm.swifteam.com/api/v1/sso/well-known/{{IDENTIFIER}}"
<Location "/.well-known/com.apple.remotemanagement">
ProxyPreserveHost Off
RequestHeader set X-Real-IP expr=%{REMOTE_ADDR}
RequestHeader set X-Forwarded-For expr=%{REMOTE_ADDR}
RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}
</Location>Traefik:
http:
routers:
apple-well-known:
rule: "Path(`/.well-known/com.apple.remotemanagement`)"
service: swif-mdm
middlewares:
- apple-well-known-rewrite
middlewares:
apple-well-known-rewrite:
replacePath:
path: "/api/v1/sso/well-known/{{IDENTIFIER}}"
services:
swif-mdm:
loadBalancer:
servers:
- url: "https://mdm.swifteam.com"
Enrollment flow on the device
Open System Settings (Mac) or Settings (iPhone or iPad), then General > Device Management (or VPN & Device Management).
Click or tap Sign in to Work or School Account.
Enter the employee's Managed Apple Account. Apple reads the JSON, or the proxy's response, from the account's domain.
Complete enrollment:
Host by JSON: enrollment completes automatically, with no separate Swif sign-in. If the
.well-knownfile isn't available, Apple checks ABM for the default MDM server, and sends the device to Swif.Host by Proxy: the user sees a sign-in page, then closes the window and starts again. The second attempt completes enrollment with the right type.
Apple Business Manager service discovery
Starting with iOS 18.2, iPadOS 18.2, and macOS 15.2, devices can get Swif's enrollment address directly from Apple Business Manager or Apple School Manager. You don't need to host .well-known/com.apple.remotemanagement on your domain.
Prerequisites
Devices running iOS 18.2, iPadOS 18.2, or macOS 15.2 or later
Swif's MDM server added under Management Services in ABM or ASM
Managed Apple Accounts for your employees in ABM or ASM
Set it up
Sign in to Apple Business Manager as an Administrator or Device Enrollment Manager.
Go to Devices > Management Services.
On the Services tab, select Default Device Assignment.
For each device type you want to support, such as iPhone, iPad, or Mac, choose your Swif MDM Server from the menu.
Save your changes.
Enrollment flow on the device
Open Settings (iPhone or iPad) or System Settings (Mac), then General > VPN & Device Management (or Device Management).
Tap or click Sign in to Work or School Account.
Enter the employee's Managed Apple Account.
Apple finds Swif as the default MDM server in ABM, and sends the device to Swif to enroll.
Add Managed Apple Accounts
Each employee who uses Enrollment SSO needs a Managed Apple Account in ABM or ASM.
You can skip this step by setting up federated Managed Apple Accounts with Google Workspace or Microsoft Entra ID. See Set up ABM Managed ID federation by Google Workspace.
Add a managed domain to ABM, such as
applesso.yourdomain.com, under Managed Apple Accounts. To verify it, add the TXT record ABM gives you to your DNS.
Create a Managed Apple Account for each employee in ABM.
Ask each employee to finish signing in to ABM, using the email ABM sends them.
Test enrollment
To enroll a device with Enrollment SSO, follow Enrollment SSO with Managed Apple ID: Device-side experience.
Troubleshooting & FAQ
Is Enrollment SSO the same as Apple's User Enrollment?
Partly. Enrollment SSO is Apple's account-driven enrollment. For BYOD, it's account-driven User Enrollment. For company-owned devices, it's account-driven Device Enrollment. See BYOD and company-owned enrollments.
A policy or app doesn't work on a BYOD device enrolled with Enrollment SSO
The device uses account-driven User Enrollment, where the Swif agent can't be installed, and Apple doesn't allow many device-wide settings. For full management, enroll the device with Swif's standard BYOD enrollment instead.
How do I support both BYOD and company-owned devices?
Host by JSON: use a separate domain for each.
Host by Proxy: use one domain. Swif chooses the right type for each user.
Can I host the JSON on Webflow?
Yes. See Webflow's guide to uploading a well-known file.
Can I use a domain with a 301 redirect?
Yes. Apple follows redirects for the .well-known file. To check where it ends up:
curl -L https://yourdomain.com/.well-known/com.apple.remotemanagement
Without -L, you'll see the redirect itself.
Do employees need to sign in to Swif separately?
No. Enrollment SSO uses the Managed Apple Account, so there's no separate Swif sign-in.
Sign-in fails with "Enrollment failed. Please try again."
On an iPhone or iPad, a leftover enrollment record on the device may be blocking the new enrollment. To fix it:
Back up any data you need. Erasing the device deletes all content and settings.
On the device, go to Settings > General > Transfer or Reset iPhone (or iPad), and tap Erase All Content and Settings.
After the device restarts, set it up, and enroll again with Enrollment SSO.