Simultaneously support both - Account-Driven User Enrollment (ADUE) & Account-Driven Device Enrollment (ADDE) :

From Jamf doc :

The service discovery JSON file for your Managed Apple Account domain can only specify either account-driven Device Enrollment or account-driven User Enrollment for devices to use. It cannot be specified for both.

However Apple doc says :

  • When attempting Account-Driven ** Enrollments, the device will send a request for the .well-known URL & append user-identifier & model-family
  • Based on those 2 items, your web server may vend the same JSON document to any Apple device, or based on your defined logic, vend a different json for iPhone vs iPad vs. Mac vs. Vision Pro

So we can config server side (whatever is hosting your well-known file) to return different json output based on which device type is requesting. This will result in Macs doing ADDE, and iPads doing ADUE. (that’s the goal here).

/**
 * Refer :
 * https://hcsonline.com/support/white-papers/account-driven-enrollment-methods-with-apple-devices-using-cloudflare
 */

addEventListener('fetch', event => {
    event.respondWith(handleRequest(event.request));
});

async function handleRequest(request) {
    let json;

    // Determine response based on URL content
    if (request.url.includes("model-family=Mac")) {
        json = {
            "_comment": "Response for Macs - This is for Account-driven Device Enrollment (NOT Account-driven User Enrollment)",
            "Servers": [
                {
                    "Version": "mdm-adde",
                    "BaseURL": "https://JAMF_PRO_URL.com/servicediscoveryenrollment/v1/deviceenroll"
                }
            ]
        };
    } else if (request.url.includes("model-family=iPad")) {
        json = {
            "_comment": "Response for iPads - This is for Account-driven User Enrollment (NOT Account-driven Device Enrollment)",
            "Servers": [
                {
                    "Version": "mdm-byod",
                    "BaseURL": "https://JAMF_PRO_URL.com/servicediscoveryenrollment/v1/userenroll"
                }
            ]
        };
    } else {
        json = {
            "_comment": "Default response - This is for Account-driven Device Enrollment (NOT Account-driven User Enrollment)",
            "Servers": [
                {
                    "Version": "mdm-adde",
                    "BaseURL": "https://JAMF_PRO_URL.com/servicediscoveryenrollment/v1/deviceenroll"
                }
            ]
        };
    }

    return new Response(JSON.stringify(json), {
        headers: { 'Content-Type': 'application/json' }
    });
}

Cloudflare Workers is a lightweight serverless platform that allows developers to leverage Cloudflare’s network to augment existing applications or create entirely new ones without configuring or maintaining infrastructure.

Read their docs

  • HCS, Workers, they all have fantastic documentation. Much better than anything in this post; this really just stitches parts of them together and documents my experience.

Additional Resources: