How to enroll devices while “Can enable remote management” is disabled

It's now 2017 so this is much easier than in 2012.

Start with either:

• Apple Configurator
• Jamf Now

Both are free to start, well documented, capable in the long term. As you get started in what you need, then look to see if perhaps a different single solution or combination of solutions makes sense for your budget, number of devices, and skillset(s).

For those interested in how it was in 2012 and the next several dozen months, it was a bit harder to manage iOS since the tools and iOS itself didn't have the hooks and maturity for this function. Then, the least expensive way to manage iOS mobile devices is to use the iPhone configuration utility. It is free, runs on Macs and Windows PC and you can email and host the configuration profiles on traditional web and file sharing solutions. I'm amazed it's still called the "iPhone" utility since it long ago became the iOS configuration profile utility.

The free support method would be FaceTime and iMessages and you can have your users take advantage of Apple's free tutorials, guides and retail worships and training. Past that, some businesses prefer to enroll in Joint Venture for training where your core team can get personalized business level training from Apple.

The next level of mobile device management would be Lion Server or one of the pay as you go MDM solutions like Robot Cloud where you can get started with MDM for $5 a month before deciding if your workplace needs the extra features of a full management suite like JAMF Software's Caspar Suite or Mobile Iron type solutions.

Whether you use profiles made by the Configuration Utility or a server based solution that hooks into Apple's Push Notification Service (APNS) so you can push remote wipe and remote updates to the devices in the field - all of these MDM solutions use the built in iOS management hooks and have various costs and expenses to acquire, learn and automate controlling change to 10 or 10,000 iOS devices.

Start small, and consider that your users will be highly motivated to learn on their own. You will want to make sure you have open feedback channels and learn from them. iOS deployments generally are less IT headache than many expect and much of the learning and support can be self-paced, on-demand and as needed. Getting iPads into the hands of the decision makers and support people months ahead of a wide scale deployment is critical to remaining nimble and avoiding making decisions before you know how the devices work in your work environment. Small pilot programs are also ideal to measure and adjust deployment when you are unsure how you will ultimately be managing these devices. Hang on, iOS deployment is a fun ride.

Having an MDM doesn't change the permissions and app deletion behavior on iOS so it only facilitates getting a redemption code onto the device.

What really matters is who signed the app. If the app is signed from Apple - then it doesn't matter if it came from iTunes, iCloud restore, MDM or Apple's app store. A user can either delete all apps or no apps based on the iOS profile in force.

Now, for enterprise signed apps (or developer signed apps), you can tie a signing certificate or trust chain to a configuration profile and ensure that apps signed by that cert get deleted when the profile is deleted.

So a user can decide to remove one app or remove all apps or remove the profile. But the user can't remove the profile and have the apps remain.

This is a nice general overview. If you select a particular MDM solution (Casper, AirWatch, Mobile Iron, etc..) or just use iPhone Configuration utility or Apple Configurator - you can re-ask this to nail down your particular deployment scenario and we can dive deeper into what you seek to accomplish.