If you are managing iOS devices with an MDM platform and you have not applied supervised mode, you are using a significantly limited version of what iOS device management can do. Supervised mode is not an advanced feature reserved for large enterprise deployments. It is the baseline configuration that enables the management capabilities that most organizations actually need: reliable kiosk lockdown, silent app installation, full hardware restriction control, and enrollment that survives a factory reset.
Understanding what supervised mode is, how it is applied, and what it unlocks is essential knowledge for anyone deploying and managing iOS devices at scale. For organizations using Moki’s iOS MDM capabilities, supervised mode is the foundation on which everything else is built.
What Supervised Mode Actually Is
Supervised mode is Apple’s designation for organization-owned iOS devices that are under full MDM management. It is not an MDM feature in the sense that Moki or any MDM vendor created it. It is a device-level state applied by Apple’s management framework that unlocks a set of management capabilities beyond what is available on unsupervised consumer devices.
The distinction between supervised and unsupervised management reflects a fundamental difference in the device’s intended use. An unsupervised device is one that belongs to an individual user who has enrolled it in MDM voluntarily and retains the ability to remove that enrollment. An organization can push some configurations and policies to an unsupervised device, but the user can remove the MDM profile, install any app they choose, and retain significant control over the device.
A supervised device belongs to the organization. The user cannot remove the MDM profile. The organization has system-level control over the device that enables management capabilities Apple intentionally reserves for the supervised context. The device is treated as organizational infrastructure rather than as a personal device with organizational access.
How Supervised Mode Is Applied
Supervised mode can only be applied through two mechanisms, both of which require the device to be in a factory-fresh or freshly-reset state.
The primary method for organizational deployments is Apple Business Manager combined with Moki’s MDM integration. When iOS devices are purchased through Apple or an authorized reseller and the reseller is linked to the organization’s Apple Business Manager account, the devices are automatically added to ABM. An MDM server token connects Moki to ABM, and devices in ABM can be assigned a supervision profile that activates when the device is powered on for the first time. The device activates as supervised without any user action and without anyone manually configuring it. This is the automated enrollment path that makes supervised management practical at scale.
The secondary method is Apple Configurator 2, a Mac application that can apply supervision directly to a device through a USB connection. This method works for devices that were not purchased through ABM-linked channels and for devices already in the field that need supervision applied. The trade-off is that it requires physical access to each device and a Mac running Configurator 2, which is manageable for small numbers of devices but does not scale to large fleets.
For new device purchases going forward, the simplest path to supervised management is purchasing through Apple’s channel or an authorized reseller linked to Apple Business Manager, ensuring every new device is automatically available for supervised enrollment without any additional configuration steps.
What Supervised Mode Unlocks
The difference between supervised and unsupervised iOS management is substantial. Several of the most important management capabilities for business and kiosk deployments are only available on supervised devices.
Single App Mode is the most operationally significant supervision-only capability for customer-facing iOS deployments. When configured through Moki, Single App Mode locks the device to one designated application at the iOS system level. The Home button behavior is controlled by MDM. Notifications from other applications are suppressed. The Control Center, Notification Center, and all system navigation outside the designated application are blocked. This is the reliable kiosk lockdown that customer-facing iOS deployments require, and it is only available on supervised devices.
On an unsupervised device, there is no equivalent to Single App Mode. The closest alternative, Guided Access, requires manual activation on the device itself and can be disabled by anyone who knows the passcode. For unattended customer-facing deployments, this is not a viable kiosk configuration.
Silent app installation is the second major supervision advantage. On supervised devices managed through Apple Business Manager’s Volume Purchase Program, applications install on the device silently through Moki’s app management capabilities without any user prompt, App Store interaction, or Apple ID on the device. The app appears on the device when the push completes without any user involvement. On unsupervised devices, app installation through MDM still requires user interaction at the device, which is not compatible with unattended kiosk deployments or any deployment where devices should not require user engagement for routine management.
Hardware and feature restrictions are significantly more comprehensive on supervised devices. Supervision enables restrictions that are not available without it, including disabling Siri, blocking AirDrop, preventing changes to cellular data settings, disabling the camera in ways that cannot be bypassed, blocking access to iCloud, and preventing factory resets by users. The full set of supervised restrictions in Moki’s configuration profile covers the complete range of device behaviors that might need to be controlled for different deployment contexts.
Enrollment persistence through factory reset is a supervision-exclusive behavior for devices enrolled through Apple Business Manager. When a supervised ABM-enrolled device is factory reset, it re-enrolls automatically in Moki when it is powered on and connected to the internet. The supervision is applied through ABM at the hardware level rather than through a profile that can be removed. This means device loss through factory reset is not possible for ABM-enrolled supervised devices, which is particularly valuable for kiosk and shared device deployments where accidental or intentional factory resets would otherwise require manual re-enrollment.
Supervised Mode and the Customer-Facing iOS Deployment
For any iOS device deployed in a customer-facing context, supervised mode is not optional. The combination of Single App Mode for reliable lockdown, silent app installation for manageable updates, comprehensive hardware restrictions for security, and enrollment persistence for operational continuity all depend on supervision.
An unsupervised iOS device in a customer-facing kiosk role is not a managed kiosk in the operational sense. It is a consumer tablet with some organizational policies applied, and a customer who finds the right sequence of taps can navigate outside the intended application. The liability for the brand experience and data exposure created by that gap is real.
Moki’s iOS platform is built around supervised management. The configuration capabilities, the enrollment workflow through Apple Business Manager, and the ongoing management tools all assume and leverage supervision. The practical steps for getting supervision applied to an existing fleet or for setting up supervised enrollment for new devices are covered in Moki’s support resources.
Schedule a Moki demo to see supervised iOS device management in action for your specific use case, or start a free trial to begin configuring supervised enrollment for your iOS devices. Moki’s support team can guide you through the Apple Business Manager setup and Moki integration process.