apple-device-management-mdm/mdm/checkin/authenticate.yaml

title: Authenticate
description: Authenticates a user during MDM payload installation.
payload:
  requesttype: Authenticate
  supportedOS:
    iOS:
      introduced: '4.0'
      supervised: false
      requiresdep: false
      sharedipad:
        mode: allowed
        devicechannel: true
        userchannel: false
      userenrollment:
        mode: allowed
    macOS:
      introduced: '10.7'
      devicechannel: true
      userchannel: false
      supervised: false
      requiresdep: false
      userenrollment:
        mode: allowed
    tvOS:
      introduced: '10.2'
      supervised: false
    visionOS:
      introduced: '1.1'
      supervised: false
      requiresdep: false
      userenrollment:
        mode: allowed
    watchOS:
      introduced: '10.0'
      supervised: false
  content: Check-in protocol authenticate request and response.
payloadkeys:
- key: DeviceName
  supportedOS:
    iOS:
      introduced: n/a
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <string>
  presence: required
  content: The device's name.
- key: ModelName
  supportedOS:
    iOS:
      introduced: n/a
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <string>
  presence: required
  content: The device's model name.
- key: Model
  supportedOS:
    iOS:
      introduced: n/a
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  type: <string>
  presence: required
  content: The device's model.
- key: MessageType
  type: <string>
  presence: required
  rangelist:
  - Authenticate
  content: The message type, which requires a value of `Authenticate`.
- key: Topic
  type: <string>
  presence: required
  content: The topic that the device subscribes to.
- key: UDID
  supportedOS:
    iOS:
      userenrollment:
        mode: forbidden
    macOS:
      userenrollment:
        mode: forbidden
    visionOS:
      userenrollment:
        mode: forbidden
  type: <string>
  presence: optional
  content: The device's UDID (unique device identifier). The system requires this
    value if the enrollment type is a device enrollment.
- key: EnrollmentID
  supportedOS:
    iOS:
      introduced: '13.0'
      userenrollment:
        mode: required
    macOS:
      introduced: '10.15'
      userenrollment:
        mode: required
    tvOS:
      introduced: n/a
    visionOS:
      userenrollment:
        mode: required
    watchOS:
      introduced: n/a
  type: <string>
  presence: optional
  content: |-
    The per-enrollment identifier for the device. The system requires this value if the enrollment type is a user enrollment.

    Available in iOS 13 and later, macOS 10.15 and later, and visionOS 2 and later.
- key: OSVersion
  supportedOS:
    iOS:
      introduced: '9.0'
      accessrights: AllowQueryDeviceInformation
    visionOS:
      accessrights: AllowQueryDeviceInformation
    watchOS:
      introduced: '10.0'
      accessrights: AllowQueryDeviceInformation
  type: <string>
  presence: optional
  content: The device's OS version.
- key: BuildVersion
  supportedOS:
    iOS:
      introduced: '9.0'
      accessrights: AllowQueryDeviceInformation
    visionOS:
      accessrights: AllowQueryDeviceInformation
    watchOS:
      introduced: '10.0'
      accessrights: AllowQueryDeviceInformation
  type: <string>
  presence: optional
  content: The device's build version.
- key: ProductName
  supportedOS:
    iOS:
      introduced: '9.0'
      accessrights: AllowQueryDeviceInformation
    visionOS:
      accessrights: AllowQueryDeviceInformation
    watchOS:
      introduced: '10.0'
      accessrights: AllowQueryDeviceInformation
  type: <string>
  presence: optional
  content: The device's product name (such as `iPhone17,2`).
- key: SerialNumber
  supportedOS:
    iOS:
      introduced: '9.0'
      accessrights: AllowQueryDeviceInformation
      userenrollment:
        mode: forbidden
    macOS:
      accessrights: AllowQueryDeviceInformation
      userenrollment:
        mode: forbidden
    visionOS:
      accessrights: AllowQueryDeviceInformation
      userenrollment:
        mode: forbidden
    watchOS:
      introduced: '10.0'
      accessrights: AllowQueryDeviceInformation
  type: <string>
  presence: optional
  content: The device's serial number.
- key: IMEI
  supportedOS:
    iOS:
      introduced: '9.0'
      accessrights: AllowQueryDeviceInformation
      userenrollment:
        mode: forbidden
    macOS:
      introduced: n/a
    tvOS:
      introduced: n/a
    visionOS:
      accessrights: AllowQueryDeviceInformation
      userenrollment:
        mode: forbidden
    watchOS:
      introduced: '10.0'
      accessrights: AllowQueryDeviceInformation
  type: <string>
  presence: optional
  content: The device's IMEI (International Mobile Equipment Identity).
- key: MEID
  supportedOS:
    iOS:
      introduced: '9.0'
      accessrights: AllowQueryDeviceInformation
      userenrollment:
        mode: forbidden
    macOS:
      introduced: n/a
    tvOS:
      introduced: n/a
    visionOS:
      accessrights: AllowQueryDeviceInformation
      userenrollment:
        mode: forbidden
    watchOS:
      introduced: '10.0'
      accessrights: AllowQueryDeviceInformation
  type: <string>
  presence: optional
  content: The device's MEID (Mobile Equipment Identifier).
notes:
- title: ''
  content: On success, the server needs to respond with a `200 OK` status. Don't assume
    that the device has installed the MDM payload at this time because other payloads
    in the profile may still fail to install. When the device successfully installs
    the MDM payload, it sends a `Token-Update` message.