iPhones in business: How to set restrictions on devices provided to employees

Question

I was recently able to use an iPhone supplied by a tech startup to one of its affiliates. The phone had limited apps, several disabled settings, and no icon for the App Store among its restrictions. The device Restrictions feature in Settings was set to Off (it was not being used). The iPhone was essentially set up to serve as a tool for affiliates to use in their work and nothing more.

How can a company that wants to provide employees or affiliates with iPhones strictly for limited business work set similar restrictions as those set by the startup? Are there specific tools available to make this happen short of compromising the device's security settings?

Related: As part of your answer, please feel free to comment on similarities and differences to Android devices if you have a broad knowledge of this topic.

Answer 1

The iPhone was setup and restricted with a mobile device manager (MDM for short.)

Apple Configurator is designed to do just what you experienced. I use Configurator to maintain >200 iPads at my school. Not every facet of the iPhone's configuration points can be locked down, but it is has more than enough details to keep 12-year-olds from making a bad mess.

The VPP for Business program is designed to allow you to purchase license codes for apps that can be distributed to individual users or installed by Configurator.

With Apple's new MDM and Managed Distribution system, apps and configuration profiles can be distributed and revoked remotely. You can also distribute private apps designed by your company/organization.

We also use the provider Meraki for location tracking, remote wipe, passcode reset, etc. Meraki is free. It can also do Managed Distribution, and we plan to use Meraki for our institution.

For more information about MDMs, including MDMs which can also be used to manage Android devices, check out EnterpriseiOS' comparison of MDM providers.

Answer 2

Apple Configurator can be used to configure devices in various ways including restricting apps, features and connectivity.

Payloads can be configured in these profiles that customise the device in various ways, such as pre-configuring certain settings or restricting functionality.

These profiles are by default able to be removed at any time, however they can be set to only allow removal with authorisation, or never.

These .mobileconfig files can be installed on a device simply by downloading them through Safari, or can be installed over USB to the device.