Skip to content
This repository has been archived by the owner on Jun 24, 2024. It is now read-only.

Commit

Permalink
Update 10039.md
Browse files Browse the repository at this point in the history
  • Loading branch information
parjohns authored Dec 1, 2023
1 parent 38ec083 commit a875429
Showing 1 changed file with 19 additions and 9 deletions.
28 changes: 19 additions & 9 deletions content/notes/wwdc23/10039.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,19 +19,25 @@ https://developer.apple.com/videos/play/wwdc2023/10041

### Enrollment Flow
Starting with a managed iPhone device, the administrator will send a new declaration to the phone. This example shows the new Watch Enrollment configuration
(1configuration)
![Configuration][configuration]

[configuration]: ../../../images/notes/wwdc23/10039/2configuration.JPG
This signifies that any Watch paired to the iPhone needs to be enrolled in MDM.

The payload would look like this
(2examplepayload)
The payload would look like this:
![payload][payload]

[payload]: ../../../images/notes/wwdc23/10039/2examplepayload.JPG

In this payload:
- `EnrollmentProfileURL` delivers the MDM profile that the Apple Watch will download and install
- `AnchorCertificateAssetReferences` is an optional item that specifies an array of anchor certificates


Once the user initiates pairing from the phone, they will be prompted to accept Remote Management. The pairing flow will end if the user does not accept.
(3flow)
![enrollment][enrollment]

[enrollment]: ../../../images/notes/wwdc23/10039/3enrollment.JPG

### Secure Enrollment Process
There are two key pieces to ensure security.
Expand All @@ -46,9 +52,9 @@ The new enrollment flow is as follows:
5. Random UUID string inside 403 response will be used by the Apple Watch to start the pairing token retrieval flow
6. The iPhone will receive the security token from the Apple Watch
7. The iPhone will use the security token to do a `gettoken` check-in request with the server
8. The `gettoken` request looks like this (4checkin)
8. The `gettoken` request looks like this ![checkin][checkin]
9. The server creates a secure pairing token and sends it to the iPhone
10. The token looks like this (5token)
10. The token looks like this ![token][token]
11. The iPhone sends the pairing token to the watch
12. The Apple Watch adds the pairing token to its machine info
13. The watch will once again send a request to the server, which will now succeed since it contains a pairing key
Expand Down Expand Up @@ -77,8 +83,8 @@ The following payloads are available on WatchOS:
- Password policy
- Restrictions

Restrictions and passcode rules taht are applied on iPhone are synced to the paired Apple Watch
(6passcode)
Restrictions and passcode rules that are applied on iPhone are synced to the paired Apple Watch
![passcode][passcode]

**Restrictions applied directly to the Apple Watch will not be synced to the paired iPhone**

Expand All @@ -94,4 +100,8 @@ Apple Watch has three deployment types for applications:
2. Dependent apps - require a companion iPhone app to be functional
3. Standalone apps - exist only on WatchOS

Administrators will need to install paired and dependent apps on iPhone first before isntalling them on the Apple Watch.
Administrators will need to install paired and dependent apps on iPhone first before installing them on the Apple Watch.

[checkin]: ../../../images/notes/wwdc23/10039/4checkin.JPG
[token]: ../../../images/notes/wwdc23/10039/5token.JPG
[passcode]: ../../../images/notes/wwdc23/10039/6passcode.JPG

0 comments on commit a875429

Please sign in to comment.