Apple response setup

This operator guide covers the separate Beam response channel. Keep high-impact operations disabled while provisioning. You need a pinned NanoMDM deployment, HTTPS, persistent storage, APNs, an enrollment CA, and SCEP. NanoMDM does not supply TLS, SCEP, or an enrollment-profile builder by itself.

Configure the response service

Add an Apple response configuration to the workspace's MDM service tenant. Use unique secrets and origins per workspace. The following is the shape of the response object; replace example values through your secret manager:

{
  "apple": {
    "url": "https://apple-mdm.example.com",
    "apiKey": "REPLACE_WITH_AT_LEAST_32_RANDOM_CHARACTERS",
    "webhookKey": "REPLACE_WITH_AT_LEAST_64_RANDOM_CHARACTERS"
  },
  "devices": [
    {
      "hostId": 123,
      "inventoryUuid": "VERIFIED_FLEET_INVENTORY_UUID",
      "deviceId": "VERIFIED_NANOMDM_CHANNEL_ID",
      "platform": "macOS",
      "enabled": false,
      "allowWipe": false,
      "eacsCapable": false
    }
  ]
}

Configure NanoMDM's webhook URL to https://YOUR_MDM_SERVICE/apple-response/WORKSPACE_ID and its HMAC key to the workspace webhook key. Restrict administrative /v1/ access and avoid recording callback bodies in proxy logs.

Enroll and bind the device

Enroll with the appropriate lock/erase permissions. A device using Fleet as MDM authority needs planned re-enrollment; Beam's Fleet OTA profile is not a NanoMDM profile. Maintain the Fleet inventory presence required for identity checking.

Match the exact Fleet host ID, inventory UUID, platform, and NanoMDM device channel. Do not substitute a hostname match. Re-provision the binding when hardware is replaced and never recycle identifiers for another device.

Enable in stages

Verify an authenticated device acknowledgement with a non-destructive operator test. Test lock and local recovery on disposable hardware, then enable the response binding and workspace high-impact setting. Enable allowWipe separately after an erase test.

For macOS, set eacsCapable only after verifying Apple silicon/T2 hardware and Erase All Content and Settings readiness. Save each lock PIN in an external vault. Beam does not retain it for recovery; NanoMDM necessarily stores the command payload, so protect its storage and backups.

Reconcile delivery

NanoMDM owns delivery and APNs wake-up. Beam authenticates callbacks and binds them to the command and device channel. Accepted commands have no Beam expiry or cancellation. When the result is uncertain, inspect the NanoMDM queue and device before further action, retaining operation and callback evidence.