6

I'm pretty new to the whole Apple story, so i'm not sure if this is possible at all.

The story is that we have unsupervised corporate-owned iPhones at work. Now we are about to enroll an MDM (specific MobileIron) and the devices need to be in supervised mode.

What we tried so far:

Backup the iPhone (iTunes), supervise the device in Apple configurator 2, and push the backup back onto the iPhone. Somehow my Instructor managed to get it working: the iPhone was now supervised containing all user data. New day, new iPhone, he did all the same steps again (iTunes and iCloud Backup), an reproductibly we couldn't get the backup back to supervised mode. We've tried it with 3 iPhones 5s and on one iPad mini 2, it was either wiped and supervised, or it was only the unsupervised user backup.

I've been searching https://discussions.apple.com and other boards since last friday, no success so far. What i found were instructions for new, wiped devices, which didn't help.

My last hope is that you can help me solving this problem.

Is it possible to supervise a device without wiping it and restoring or keeping the users data for it?

Thanks folks!

1
  • No - you need a backup (as indicated in the answer below). Supervise intentionally forces a wipe to prevent the later destruction of data that was never backed up.
    – bmike
    Commented Mar 25, 2018 at 14:32

4 Answers 4

3

I just asked the MDM people at WWDC 2018 and they gave me this process:

  1. Take a backup of any form (iTunes un/encrypted, iCloud)
  2. Restore the backup to the same device
  3. While the device is at the setup assistant page (and Apple Configurator shows the little setup icon on the device), supervise it. The device should also have the "supervisable" trait on it in list view if you enable it.
  4. Enjoy/apply profiles from Configurator with new elevated privileges.

They weren't really sure and it took around six engineers to reach consensus because they were all familiar with the process from slightly different phases. They also suggested that on that in some setup thing (codename 'buddy'?) on iOS 9/10 it would actually let you do it but they weren't sure anymore.

1
  • The "setup thing"'s codename is purplebuddy, as prior to the iPhone shipping it was nicknamed "Project Purple"... Commented Apr 2, 2019 at 14:48
2

According to this discussion thread, you can try the following method:

WARNING: I have not tested this and you may lose data!

  1. Disable "Find my iPad” on the old iOS device, perform iCloud backup on the same device
  2. Plug in the new device to Apple Configurator, Supervise and update the device to the latest iOS
  3. Once Supervised, unplug the new device and go through the Setup Assistant to restore from iCloud
  4. When the iCloud restore of the new device is complete, do not touch the Setup Assistant, plug it back into Configurator
  5. Before you refresh, change the "Restore" and "Update iOS" options to "Do not Update/Restore"
  6. Once refreshed, proceed through the Setup Assistant, your device should now be Supervised and ready for MDM Enrollment

Note that this is for cloning a device, I have not found a way to use the backup of the same device to supervise it.

Also, it does appear that you can try this with an iTunes backup as well if you'd like. Just follow the same steps and use iTunes instead of iCloud to get a more complete backup.

It looks, however, like some versions of Apple Configurator do and do not work, so your mileage may vary.

2

I was able to supervise my iOS devices on iOS 15 and 16 without data-loss by modifying backups using the following method:

  1. Create a non-encrypted backup of the iOS device on a Mac.
  2. Click on "Manage Backup", right-click the new backup and choose "Archive" in order to prevent the backup from being overwritten by a newer backup.
  3. Make a backup of the backup. Locate the backup at ~/Library/Application Support/MobileSync/Backup and copy the newly made backup to another location (e.g. Desktop). This is in case something gets messed up when we modify the backup later.
  4. Supervise the device in Apple Configurator 2. This will erase the device.
  5. Set up the newly supervised device until you get to the home screen.
  6. Create another non-encrypted backup of the device that was just set up. Be sure to archive this backup and make a backup copy of it as well.
  7. Use Terminal to locate the file containing supervision data in both backups:
    • Navigate to ~/Library/Application Support/MobileSync/Backup and cd into the folder of one of the backups.
    • Type sqlite3 Manifest.db and hit Enter.
    • Query the database by typing select fileID from files where relativePath = 'Library/ConfigurationProfiles/CloudConfigurationDetails.plist'; and hitting Enter.
    • Note down the string of text that the query outputs. This is the name of the file containing the supervision data.
    • Do the same for the other backup. It should return the same name both times.
  8. Locate the file with that name in both backups. It is usually in the 1e folder.
  9. Replace the file in the first (unsupervised) backup with the file from the second (supervised) backup. This (first) backup now becomes supervised.
  10. Restore this modified (first) backup to the same device. The device is now supervised and all the data from the old (unsupervised) backup restored.

Be sure to make a backup of the backup before modifying to prevent data loss!

2

Inspired by the comment of jdslab I was able to supervise my iOS device (while keeping most data) by creating, modifying and restoring one single backup.

The process is as follows.

  1. Create a non-encrypted backup of the iOS device on a Mac. Click on "Manage Backup", right-click the new backup and choose "Archive" in order to prevent the backup from being overwritten by a newer backup.

  2. Make a backup of the backup. Locate the backup at ~/Library/Application Support/MobileSync/Backup and copy the newly made backup to another location (e.g. Desktop). This is in case something gets messed up when we modify the backup later.

  3. Use Terminal to locate the file containing supervision data the backup:

    • Navigate to ~/Library/Application Support/MobileSync/Backup and cd into the folder of one of the backups.
    • Type sqlite3 Manifest.db and hit Enter.
    • Query the database by typing select fileID from files where relativePath = 'Library/ConfigurationProfiles/CloudConfigurationDetails.plist'; and hitting Enter.
    • Note down the string of text that the query outputs. This is the name of the file containing the supervision data.
  4. Locate the file with that name in the backup. It is usually in the 1e folder.

  5. Rename the file by adding the .plist extension and open it with Xcode.

  6. In Xcode change the value of IsSupervised to YES and save the file.

  7. Rename the file back to the original name (remove the .plist extension).

  8. The backup now becomes supervised.

  9. Restore this modified backup to the same device. The device is now supervised and all the data from the backup restored.

The backup did not preserve all data unfortunately. After restoring the backup I had to login to some apps again, I lost all open tabs in the Safari browser (since I don't sync with iCloud) and I lost my Signal chat history. However this seems to be normal behavior when restoring (unencrypted) iOS backups.

1
  • I was able to enable supervised mode in much the same way on an encrypted backup using the iMazing app (trial worked fine) to edit the backup. The CloudConfigurationDetails.plist was in SystemSharedContainers/SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles. Copy to desktop, edit with xCode, delete the old one, copy in the edited one worked fine. I restored the backup by copying it from the iMazing location to the regular one.
    – RyanM
    Commented Jun 14 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .