Contents

How to List DEP Profiles Across All Macs

Using Kolide, you can easily view and query Mac DEP Profiles across your fleet.

Introduction

Device Enrollment Program (DEP) now referred to as Automated Device Enrollment, is an enterprise feature of the Apple ecosystem, which allows administrators with an Apple Education or Apple Business account to preconfigure the Apple devices purchased for their organization before they are shipped from Apple to the end-user.

This allows administrator initiated Mobile Device Management (MDM) enrollment and simplifies initial device setup. Administrators can supervise devices during activation without touching them, and lock MDM enrollment for ongoing management.

Certain security features of the device are also modified such as Activation Lock which can be disabled by an administrator without impacting the Find My functionality.

What Mac DEP Profile Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Mac DEP Profiles from Macs in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Mac DEP Profiles Schema

Column	Type	Description
id	Primary Key	Unique identifier for the object
device_id	Foreign Key	Device associated with the entry
device_name	Text	Display name of the device associated with the entry
allow_pairing	Boolean	`true` if the device may pair with a host computer (`AllowPairing`)
await_device_configured	Boolean	`true` if Setup Assistant waits for the MDM server to send `DeviceConfigured` before it finishes (`AwaitDeviceConfigured`)
configuration_url	Text	The URL of the MDM server the Mac is told to enroll in (`ConfigurationURL`)
dep_local_file_updated_at	Timestamp	When the Mac last saved the activation record to disk, usually during Setup Assistant or a `profiles renew -type enrollment`
mandatory	Boolean	`true` if the user cannot skip MDM enrollment in Setup Assistant (`IsMandatory`)
mdm_unremovable	Boolean	`true` if the user cannot remove the MDM enrollment profile (`IsMDMUnremovable`)
multi_user	Boolean	`true` if the device is configured for multiple users, as with Shared iPad (`IsMultiUser`)
organization_address	Text	The organization's full address (`OrganizationAddress`)
organization_address_1	Text	The first line of the organization's address (`OrganizationAddressLine1`)
organization_address_2	Text	The second line of the organization's address (`OrganizationAddressLine2`)
organization_city	Text	The organization's city (`OrganizationCity`)
organization_country	Text	The organization's country (`OrganizationCountry`)
organization_department	Text	The organization's department, as entered in Apple Business Manager (`OrganizationDepartment`)
organization_email	Text	The organization's contact email address (`OrganizationEmail`)
organization_magic	Text	An opaque identifier Apple assigns to the organization (`OrganizationMagic`)
organization_name	Text	The name of the organization that owns the Mac in Apple Business Manager (`OrganizationName`)
organization_phone	Text	The organization's phone number (`OrganizationPhone`)
organization_support_phone	Text	The organization's support phone number (`OrganizationSupportPhone`)
organization_zip_code	Text	The organization's postal code (`OrganizationZipCode`)
supervised	Boolean	`true` if the Mac is supervised after enrollment, which allows additional MDM restrictions and commands (`IsSupervised`)
collected_at	Timestamp	Time the row of data was first collected in the database
updated_at	Timestamp	Time the row of data was last changed in the database

Why Should I Collect Mac DEP Profiles?

Collecting DEP information allows administrators to track and review which Apple devices are part of the Apple Automated Device Enrollment, which impacts things like device initial setup, device reimaging, and device recovery.

Identifying devices which are not DEP enrolled can be important for administrators who need to work with end-users to perform post-setup configuration such as installing an MDM or disabling the Activation Lock on their device.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

DEP Profiles information contains details about your Security or IT team such as the point of contact's email, phone number, and physical address, it does not contain information about the end-user.

When you use Kolide to list Mac DEP Profile data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.