Managed Mode iPhone

How to Set up a Fully Managed Personal iPhone or iPad

Learn how to set up a fully managed personal iPhone or iPad to gain remote control over advanced device restrictions.

Ben

Updated September 23, 2025

If you've ever worked for a company that issued you an iPhone or iPad for corporate use only, you might have noticed that it was configured so that the IT department could manage it remotely. This is referred to as Mobile Device Management where devices are set up as fully managed devices (not just a work profile). Full Device management gives you the most control over setting up restrictions on an iPhone or iPad.

Although managed mode is typically used for businesses, I've gone through the process of setting up my own iPhone as a fully managed device. It's not straightforward at all, so I've created this guide to help others get access to elevated restrictions for personal Apple devices (bring your own devices).

Why Adults Might Consider Managed Mode for Household iPhones and iPads

If you have several different iPhones and iPads in your household that you want to manage, and you prefer to have the advanced controls that an IT department has over corporate devices, full device management can give you the best control over the posture of all your devices. Additionally, mobile device managers tend to work for other operating systems as well. If you aren't a 100% Apple household, you can typically still have a universal management experience.

I originally went down the path of setting up full device management for my personal iPhone & iPad because I wanted to restrict myself from accessing certain websites and apps. Now that I'm a father and the mini IT department of my household, I'm realizing that mitigating the risks posed by each device is a part-time job.

Whether you are considering device management for personal reasons or because you want to mitigate risk within your household, full device management could be an approach you consider.

Consider Supervised Mode First

We recommend supervising a device instead of managing it, due to the difference in setup difficulty and minimal difference in capability. Please see https://www.techlockdown.com/guides/supervised-mode for more details.

This guide will take several weeks to complete

Due to Apple's approval process, this guide cannot be completed on the same day. Consider enabling Supervised Mode instead, which can be completed on the same day and offers similar benefits.

Here are some of the main reasons why you should manage an iOS device:

Set device restrictions that cannot be changed from the device itself
Enable Kiosk mode to turn your iPhone into a "dumb phone" without sacrificing the utility of a smartphone.
Install, delete, or block iPhone apps remotely
Force the usage of Apple's built-in content filter, which works even with a VPN
Force DNS settings on any network
Enforce Parental Controls (screen time) and block access to changing parental control settings (even as an Administrator)

Not Recommended for Parents

If you are a parent setting up a child's iPhone, we do not recommend full device management. See this guide for our recommended approach for parents at: https://www.techlockdown.com/guides/parental-controls-iphone

What's the Difference Between Device Management and Supervision?

Managed Mode, which is also called Mobile Device Management, offers similar restrictions to Supervised Mode, although it adds a few more important features:

Remote Management: Device Supervision requires physical access to your iPhone connected by cable to your Mac computer, whereas a Managed iPhone can have its settings changed remotely using any web browser logged into your MDM. This allows you to see how the device is being used (like what apps were installed) and to easily push changes (like deleting an installed app).
Profile (rules and settings) Enforcement : After the initial enrollment period, distributed profiles cannot be removed without the use of your Mobile Device Manager.
Full Feature Unlock: Mobile Device Management has the most control over an iOS device allowed by Apple. Compared to standard and supervised iOS devices, Device Management unlocks more features that you can customize. For example, removing the web browser and enabling the highly restrictive kiosk mode.
Remote App Management: You can see which apps are installed on the managed iPhone in real-time. This means you can easily remove any apps that shouldn't be installed. Furthermore, managing app Allow/Blocklists is fairly tedious using device supervision, but much easier in managed mode.

Prerequisites

1) Second Apple Device with Apple Configurator

You should have access to either a Mac computer or a second iOS (iPhone, iPad) device that can run Apple Configurator.

Download Apple Configurator from either the iPhone or Mac App Store and make sure your second device can run it.

Please confirm if this can apply to you:

I'm able to install Apple Configurator on a Mac or second iOS device.

2) Apple Business Manager (ABM) Account

Apple requires the use of an Apple Business Management (ABM) account in order to use a Mobile Device Manager (MDM). This guide will explain how you can get an ABM account as an individual.

Getting an ABM account can take some time, which is why we recommend Supervising a Device until you get an ABM account approved by Apple.

This is an unfortunate, but necessary requirement imposed by Apple.

Do I need a Business in order to create an Apple Business Manager account?

I've gone through the process of applying as an individual and talked with the ABM support team to get advice for home users who don't have an official business.

You need a DUNS number to get an Apple Business Manager account. This will be addressed in step 1.

3) ManageEngine Account and Free Tier

This setup guide uses the Mobile Device Manager called Manage Engine. The free tier is perfect for home use. The interface is a bit rough, but usable.

Go to the ManageEngine MDM free trial page

Signup for a cloud account

Note

When the 30 day free trial expires, you do not need to pay. Your account will transfer to the free tier and the free tier is limited to 50 devices but has the same functionality.

Step 1: Get a DUNS Number for Apple Business Manager

A DUNS number is required to get an Apple Business Manager account.

There are two main ways to get a DUNS number:

Apply as a business.
Pay for one as a developer.

Option 1: Get a free DUNS number by applying as a business

You can obtain a free DUNS number by applying as a business. If you already have a business, this process should be relatively straightforward.

However, you don't actually need a serious business with multiple employees to qualify for an ABM account. A sole proprietorship is an unincorporated business owned and run by one individual. There is no distinction between the business and you (the owner). You don't actually need to create a business or sign any documents to be a sole proprietor.

Please keep in mind that this advice might not apply to you depending on your region.

Option 2: Pay for a DUNS number using the Apple Developer Program

If you can't get a DUNS number applying as a business, your alternative is to pay for Apple Developer Program access. You'll get a DUNS through this process.

Apply for a DUNS Number

For both options, applying for a DUNS Number is very similar.

Apply here and enroll as an individual.

Select your region here . Since I'm US-based, this tutorial will use the US-Canada DNB website .

Select one of the "I have a Business" options (based on your region). If you have an Apple Developer account for some reason, you could use that option instead.

Fill out accurate personal information required during the registration process. If a Tax ID number/EIN is required, you would use your SSN.

In my case, I had to follow-up with personal information to verify residency. You may not have to do this.

After several days, I received an email with my DUNS number:

Notice that the business name is just my name. This is common for sole-proprietorships.

Step 2: Apply For an Apple Business Manager Account

Once you've applied for a DUNS number, you will now be able to use the DUNS number to apply for an Apple Business Manager Account.

Enroll in ABM

Use your personal information as the verification contact. If the verification contact email must be different, use another email account for that verification information.

Enter accurate personal information.

A representative from Apple will actually check the website URL that you provide. To avoid any issues, I recommend using a professional social media website, like your LinkedIn profile, if you don't have a personal website. You could also create a free, simple about.me page with a basic online resume.

Enter the verification contact information (you should be both contacts). The verification contact first name must be unique in order to submit the form, so I use the shorter version of my first name. The email must also be unique. Both emails should be valid.

The verification contact first name must be unique in order to submit the form, so I use the shorter version of my first name. The email must also be unique. Both emails should be valid.

After you submit your ABM application, you can expect to receive a phone call from an Apple representative within 1 week.

They will call you from an 800 number, so do not ignore any calls over the next 7 days.

Verification

Here's what to do when you talk to the Apple representative.

The ABM representatives are very flexible, but are mainly trying to work directly with businesses or individuals who are interested in using ABM for professional reasons.

State that you are are starting out as a freelancer/independent contractor and you need to set up a managed device for better security.You can use your current full-time profession as the type of service you plan to provide. Alternatively, you could just come up with a service that seems interesting to you. Examples: IT consulting, graphic design, website development, video editing.

You can use your current full-time profession as the type of service you plan to provide. Alternatively, you could just come up with a service that seems interesting to you. Examples: IT consulting, graphic design, website development, video editing.

During my phone call, I literally told the representative:

"I need to lock down my mobile devices for better security and to limit distractions since I work from home".

They might suggest that you use Apple Family Sharing, but you should insist that you are only interested in full device management.

They will ask you why the verification contact is obviously the same person. Explain that you are a sole proprietorship. It's ok to not have a unique verification contact in this case.

After the phone call, you should receive a notification that your account was approved.

Step 3: Connect ABM to Manage Engine

Manage Engine is a Mobile Device Manager that you can use to enforce profiles on your iPhone. ManageEngine let's you manage devices on their free tier.

You can assign a specific MDM server to a device that is added to Apple Business Manager. This allows the mobile device manager to control the device.

Go to the ManageEngine MDM free trial page

Signup for a cloud account

Note

When the 30 day free trial expires, you do not need to pay. Your account will transfer to the free tier and the free tier is limited to 50 devices but has the same functionality.

Connect ABM to ManageEngine

Once you connect Manage Engine to Apple Business Manager, you'll have the option to assign Manage Engine to a device.

In Manage Engine, navigate to Enrollment > APNs certificate and click Get Started

Download the Vendor Signed CSR

Click Sign In

Create a certificate

Open the Vendor Signed CSR you downloaded from ManageEngine previously

Upload the file you selected

Download the final certificate

Go back to ManageEngine and click "next"

Click the upload box and open the certificate you downloaded from the Apple website.

Enter your Apple Business Manager account email in the Apple ID field, then any personal email address in the email notification field.

Step 4: Back Up Important Data on your iOS Device

ManageEngine will be used to manage settings on your iPhone, but you need to add a device to start.

On the device you would like to connect, you will need to:

Hard reset your iOS device
Use Apple Configurator to add your device to ABM
Sync your ManageEngine and ABM accounts so that ManageEngine can manage the added devices

Supervising an iOS device requires you to hard reset the device.

Double-check your iCloud sync settings to ensure that you are backing up important data.

Confirm your iCloud sync settings

Once we start the supervision process and you reset your iPhone for the first time, you won't initially be able restore apps & data during the first-time setup.

You'll select Don't Transfer Apps & Data.

Confirm that you know to select Don't Transfer Apps & Data after resetting your device

You'll need to reset your iOS device in order to manage it. You can sign in to iCloud after resetting the device and get access to whatever you sync with iCloud. However, you can't restore a backup during the first-time setup process.

Ensure that the iOS device you want to manage is syncing with iCloud.

Go to general settings and find the iCloud section

Double-check that the items you want to back up are syncing with iCloud

When you sign into iCloud on a newly reset device, you'll have access to these items again.

Disable Activation Lock & Find my iPhone

iOS devices have an activation lock feature, which we temporarily need to disable to manage the device. You will re-link to iCloud after you manage the device.

Note

You only need to disable activation lock on the iOS device that you want to manage.

iOS devices have an activation lock feature, which we temporarily need to disable to supervise the device. You will re-link to iCloud after you supervise the device.

Go to www.iCloud.com/find and login with your personal Apple ID (whatever Apple login you use on the iOS device).

At the top, click All Devices.

Select the device that you are attempting to supervise

Click Remove from Account. Read more here if you don't know how to do this

Note

The device must be offline in order for you to remove it.

Double-check that your device is removed from Find My iPhone.

Step 5: Add Device to ABM

(A) Mac Apple Configurator

If you are using a Mac running Apple Configurator as your second device.

To add an iOS device to Apple Business Manager using a Mac computer, you'll need two devices:

The iOS device you want to manage and add to Apple Business Manager
A Mac computer that can run Apple Configurator

Get Started:

Connect your iOS device to your Apple computer using your USB cable (the same cable you charge your phone with).

Enter your passcode on your iOS device and authorize any connection requests. Otherwise, you will get an error in Apple Configurator.

Temporarily disable auto-lock on your iOS device so that you don't have to keep unlocking your device during this tutorial.

On your Mac computer, open the app store and download "Apple Configurator"

Open Apple Configurator

You should see your iOS device in apple configurator. If you don't, double check that your iOS device is unlocked and you have accepted connection requests.

We'll get started by creating a Wifi profile, which is required so that the MDM can automatically connect and prepare the device once it's reset.

In Apple Configurator, click file > new profile

Name the profile WiFi

Navigate to the Wi-Fi tab and add a configuration

Set the Service Set Identifier to match your Wifi network name, make sure Auto Join is selected, select Security Type:WPA / WPA2 Personal and then enter your Wifi network password.

Click the X button in the top left hand corner and save your profile

Two finger tap your device in Apple Configurator and select Prepare from the dropdown menu

Select Manual Configuration and enable most of the checkboxes, specifically Add to Apple School Manager or Apple Business Manager and Activate and complete enrollment.

Select New Server.

You can leave the server field with the default settings and enter any name

Alternatively, if you plan to use an MDM like Manage Engine, you can copy the enrollment URL from Enrollment > Apple Configurator. You might have to click Configuration Steps and scroll through until you see Enter MDM server and URL.

Select the mdm.manageengine.com trust certificate

Create a new organization. This organization will be linked to your ABM account.

If you are prompted, generate a new supervision identity

Configure the iOS setup assistant, which are the initial steps you see when you reset a phone and start it up for the first time. You can show all steps or limit the steps you have to configure during startup. These steps can be completed after initial setup, so this part is up to you.

Choose a network profile

Select the WiFi profile you created previously

If prompted, enter your Apple Business Manager login details again and click Prepare.

Erase the device when prompted

Apple Configurator will wipe the device and configure it. You might need to unlock your device if the lock screen is active.

This process can take a few minutes. You might need to manually connect to WiFi once the device resets.

(B) iPhone Apple Configurator

To add an iOS device to Apple Business Manager using an iPhone, you'll need two iOS devices:

The iOS device you want to manage and add to Apple Business Manager
A second iOS device that can run Apple Configurator.

Note

Double check your iCloud account and make sure that you are syncing everything you want access to when you reset your iOS device.

On the iOS device you want to manage, navigate to Settings > General > Reset

Select Erase All Content and Settings

Start up the new or recently reset iPhone or iPad that you want to manage.

Continue through the Setup Assistant, then stop when you see the Choose a Wi-Fi Network step.

Important

Do not proceed past the Wi-Fi network step. You must restart the iPhone or iPad if you go past this step.

Bring your second iPhone with Apple Configurator close to the iPhone or iPad that you want to manage, then do one of the following:

Option 1: Scan the image that appears in Setup Assistant.

Option 2: Pair Manually

Tap Pair Manually in the lower-left corner of the Setup Assistant, then tap Manual Pairing in Apple Configurator and enter the six-digit code that appears.

Important: Don't restart the phone yet

Don’t restart the phone until you complete the task “Assign an iPhone, iPad, or Mac to an MDM server” in Apple Business Manager (see next section about assigning a MDM server in ABM).

Step 6: Sync Added Devices On ABM to ManageEngine

Your Device Should now be visible in Apple Business Manager, but we now need to configure ABM to use ManageEngine.

In ABM, select the device and click Edit MDM Server

Assign Manage Engine as the MDM

Back in Manage Engine, navigate to Enrollment > Apple Enrollment and click Sync Devices

Assign a user. This step is more useful for organizing things on your end. You could assign this to yourself or add more users to Manage Engine if needed.

Your iOS device is set up for management.

Manage Profiles

On Managed iPhones, you will need to enforce restrictions using profiles. These profiles are pushed to your managed devices using ManageEngine.

Create a Device Group in ManageEngine

If you are self-managing, you likely will just need to create one group for your iPhone or iPad. If you are managing for other people, you should create a group for each set of devices that will use the same restrictions.

Navigate to Device Mgmt > Groups & Devices click the Create Group dropdown and select Device Group

Create a group name describing the types of devices in that group (iPhones, iOS devices)

Add devices and select any iOS devices that you've synced from ABM and finish creating the group

Create Profile

Profiles are used to configure restrictions on your iPhone remotely. You create these using ManageEngine's interface.

Navigate to Device Mgmt > Profiles and click the Create Profile dropdown and select iOS/iPadOS.

Click Save and then Publish

Associate Profile with Device Group

Go to Device Mgmt > Groups & Devices click the Actions dropdown and select Associate Profile

Select your profile and click Associate

The profile should push to all devices associated with that group within about 2 minutes.

Update and Sync Profile Changes

When making changes to a profile, updates aren't automatically published to devices in your group. Here's how to update profiles so that devices are synced with the latest changes.

Navigate to Device Mgmt > Profiles and select the profile that you want to update

Click Modify and on the next page click Continue

Make the desired changes then Save/publish

Note

When you save and publish changes to a profile, your devices are not automatically updated with the changes. Every time you save a profile, a new version is created and must be distributed via "upgrading"

Once the profile is saved/published and you are directed back to the screen that lists all of the profiles, open up the profile again and click the Upgrade All link under the Devices with older version section

Here is another method for upgrading a changed profile:

Navigate to Device Mgmt > Groups & Devices then select the group associated with your profile and click the Profiles tab.

Select the profile you updated and click Upgrade Profile

Your devices should sync with the profile changes.

Recommended Restrictions and Profile Settings

Here are some highlighted configurations that are more useful to home users who want to prevent bypassing filtering/blocking capabilities.

Note

After making changes to a section in the profile, make sure you click the Save button. Click the Publish button after you are done making all changes. Then go to your group and upgrade the profile to distribute the new profile version to all devices in the group. See the Update Profile section for more information.

Application restrictions

Consider customizing the following restrictions:

Users can install unapproved apps (set list of approved apps using MDM)
Deleting apps
Remove system apps
Download Books content > Erotic content

Browser Restrictions

Consider restricting Safari.

Network and Roaming

Connect to Wi-Fi, only if distributed via MDM

Selecting this option will limit the Wi-Fi networks a user can connect to based on the networks you manually define. This is useful if you only want a device to connect to your home internet connection.

Always on Wi-Fi

Useful if you want to stop a user from switching off of a filter home network connection Wi-Fi to a roaming connection when at home.

Allow users to configure VPN

This setting should be restricted - a VPN should only be configured by the MDM.

Content Ratings

This section isn't as useful, but it's worth showcasing that you can restrict explicit music & podcasts. Note that this setting won't impact third-party apps like Spotify.

Wi-Fi

Optionally, you can configure Wi-Fi settings via the MDM.

For home networks, enter your Wi-Fi name in the Wi-FI SSID field, select WPA/WPA2 security type, then enter your WiFi password.

Combine this with Restrictions > Network & Roaming > Always on Wifi and Connect to Wi-Fi, only if distributed via MDM if you want to significantly restrict internet access to known/filtered internet connections.

Kiosk Mode

Kiosk mode is a powerful profile configuration that lets you narrow down the features a user has access to on the device. You can easily turn your iPhone into a "dumb phone" without sacrificing useful features like maps, camera, email, etc.

After enabling kiosk mode in multi app mode, I've restricted the following iPhone to have access to only a few features.

You can completely customize this as needed using Multi-app mode.

One of the most useful things about Kiosk mode is that you can specifically define what apps a user can see and access. This means that you can set up a filtering app, but make it impossible for the user to access or even see. The app is still running, but it's not visible to the user.

Enable single-app mode if you want to enforce the use of only one kiosk app. This is useful if you are using a parental control kiosk app.

Most commonly: enable multi-app mode to specify exactly what apps the user can see and access.

Hide the MDM app

Content Filtering

You can take advantage of the Screen Time Content Filter built-in to all iPhones.

Allowlist Mode

With the Filter type:Allowlist mode, you can restrict access to all websites except the ones you specify. This is a restrictive approach that is very limiting, but also one of the most thorough ways to narrow down only a few approved websites.

Blocklist Mode

Alternatively, you can toggle on the Filter type: Blocklist and add a list of URLs that should be blocked.

Manage Apps On Your iPhone or iPad

One of the biggest features that management unlocks on your iPhone is remote management. With remote management, you can:

Remotely install and enforce apps.
Force uninstalls a program using your MDM.

Install App Remotely

Remotely force install an app directly on your iOS device without interacting with the device.

Navigate to Device Mgmt > App Repository and click the Apple App Management tab

Click Configure apps for business

In Apple Business Manager, navigate to preferences > Payments and Billing > Apps and Books

Click Get Started and finish the setup process so that you get a location token. It will ask you to attach a payment method to the account in case you purchase any apps licenses.

Download the location token

Back in Manage Engine, upload the location token

Search for an app, we'll use a Blocker app in this example

Modify the app policy settings. This will vary depending on the app.

Save changes and then click the distribute button

If you don't have a distribute button, go back to the App Repository > Select the app, then click the Actions dropdown in the top right and select Distribute

Select your iOS group, check Silent Installation if you want to automatically install it on the device. Otherwise, select Distribute to App Catalog and then click Distribute App.

The app should be installed on the device

Block Apps

Follow the previous steps to add the app you want to block to your app repository.

Navigate to Inventory > Apps select the app you want to block, then click the Blocklist App dropdown and block the app for your iOS group (or all devices, whichever you prefer).

If you don't see your app in this list, remove any of the applied filters. The default filter just shows the apps that are installed on a device.

Blocked apps will be removed from the device and cannot be reinstalled.

Frequently Asked Questions

How can I prevent an App from getting deleted?

This process varies depending on your goals.

Using Kiosk mode, you can select the apps that the user should have access to. All other apps won't be visible or accessible, but they will still exist on the device.

You can install a filter app that configures your network settings and the user won't be able to delete or stop the app.

In the MDM policy under Restrictions > Applications, you can restrict Deleting apps.

There's a method for preventing the deletion of apps distributed by MDM, but this requires you to upload an app configuration file. This process is fairly technical right now and I'm working on making it more accessible.

How do I block VPNs, Proxies, or other apps that configure DNS?

Update the MDM profile Restrictions > Network and Roaming > Allow users to configure VPN:no.

Consider updating the MDM profile to include pre-configured Wi-Fi networks so that the user can only connect to approved Wi-Fi networks.

Using Kiosk mode, you can provide a limited iOS experience without access to all installed apps and capabilities.

Consider configuring the MDM profile Restrictions > Applications > Allow user to download unapproved apps:restrict. This will limit the apps a user can install to a pre-curated list of apps that you've added to Device Mgmt > App Repository.

What are the most restrictive setups?

Kiosk multi-app mode with only the bare essentials enabled or using the single app mode with a parental control kiosk app.

Updating the MDM profile restrictions so that Wi-Fi is always forced on and is limited to the Wi-Fi networks you pre-configured in the MDM profile > Wi-Fi.

Disabling the personal hotspot in the MDM profile >Restrictions > Network and Roaming > Modify Personal Hotspot:No.

Updating the MDM profile > Web Content Filter and toggling on the Filter type: Allowlistso that only the approved websites can be accessed (everything else is blocked).

Best approach to filtering and blocking content?

Configure the Web Content Filter with websites that should be blocked. Websites added to this blocklist will be blocked even if use iPhone is configured to use a Proxy or VPN. This layer is the hardest one to bypass.

Add a content-filtering app that configures an always-on VPN.

Limit apps that can be downloaded using either multi-app Kiosk mode or by manually maintaining your own app allow/blocklists using the MDM app repository and inventory.

How to Set up a Fully Managed Personal iPhone or iPad

Why Adults Might Consider Managed Mode for Household iPhones and iPads

What's the Difference Between Device Management and Supervision?

Prerequisites

1) Second Apple Device with Apple Configurator

2) Apple Business Manager (ABM) Account

Do I need a Business in order to create an Apple Business Manager account?

3) ManageEngine Account and Free Tier

Step 1: Get a DUNS Number for Apple Business Manager

Option 1: Get a free DUNS number by applying as a business

Option 2: Pay for a DUNS number using the Apple Developer Program

Apply for a DUNS Number

Step 2: Apply For an Apple Business Manager Account

Enroll in ABM

Verification

Step 3: Connect ABM to Manage Engine

Sign up for ManageEngine's Free Tier

Connect ABM to ManageEngine

Step 4: Back Up Important Data on your iOS Device

Disable Activation Lock & Find my iPhone

Step 5: Add Device to ABM

(A) Mac Apple Configurator

Get Started:

(B) iPhone Apple Configurator

Option 1: Scan the image that appears in Setup Assistant.

Option 2: Pair Manually

Step 6: Sync Added Devices On ABM to ManageEngine

Manage Profiles

Create a Device Group in ManageEngine

Create Profile

Associate Profile with Device Group

Update and Sync Profile Changes

Recommended Restrictions and Profile Settings

Application restrictions

Browser Restrictions

Network and Roaming

Connect to Wi-Fi, only if distributed via MDM

Always on Wi-Fi

Allow users to configure VPN

Content Ratings

Wi-Fi

Kiosk Mode

Content Filtering

Allowlist Mode

Blocklist Mode

Manage Apps On Your iPhone or iPad

Install App Remotely

Block Apps

Frequently Asked Questions

How can I prevent an App from getting deleted?

How do I block VPNs, Proxies, or other apps that configure DNS?

What are the most restrictive setups?

Best approach to filtering and blocking content?