A request that comes up again and again from operators sounds roughly the same each time. A crew needs a few phones for photo documentation in a Zone 1 or Zone 2 area, the devices are shared across a rotating shift, and the IT and HSE teams want the camera to work and very little else. No App Store, no browser, no messaging, no Bluetooth, no cellular connection. In other words, They want the phone to do the specific job at hand, with none of the distractions.
Buying the hardware is the straightforward part. Configuration is where these projects stall, usually because the gap between what iOS permits on a managed device and what it permits on an ordinary one is wider than most teams expect. This article walks through how that lockdown is actually achieved, what Apple Business Manager has to do with it, and what remains possible when full IT involvement is not availabe.
The requirement list for shared inspection phones varies across firms, but teams generally ask for some combination of the following.
Supervision is a one-time enrollment status applied to a company-owned iPhone or iPad. It tells iOS that the organization, and not the person holding the device, is the owner. Apple reserves a specific set of management controls for supervised devices, and no MDM platform can apply them to a device that is not supervised, regardless of licensing.
On a supervised iPhone you can force Bluetooth off so the user cannot re-enable it, block eSIM installation, place the device in Single App Mode so it launches straight into the camera and stays there, prevent removal of the management profile, and push policy or a remote wipe centrally.
On an unsupervised iPhone, App Store, Safari, Messages and other apps can still be restricted locally, but through a more rudimentary Screen Time limit.
Apple Business Manager (ABM) is Apple's registry of company-owned devices. Every supervised iPhone is assigned to a specific ABM organization, which owns that device's enrollment and links it to your MDM platform. Setting one up is a relatively simple exercise. It takes around thirty minutes, and requires your company's D-U-N-S number and a verification call from Apple.
A common question at this stage is whether a managed service provider or an integrator can simply handle all of it on your behalf. The answer is yes. An external partner can be granted Administrator or Device Enrollment Manager rights inside your ABM and run enrollment, configuration and ongoing policy. The account itself still has to exist in the name of the legal entity that owns the devices, because Apple ties ABM to that entity. So, outsourcing the effort and configuration is possible, but outsourcing the ownership is not.
Apple provides a couple of key ways to bring an iPhone into supervision, and which ones are open to you depends largely on how the devices were purchased.
This is the cleanest route. An Apple Authorized Reseller or carrier assigns the device serial numbers to your ABM organization at the time of sale, using their Reseller ID. The phones arrive already registered, and supervision applies automatically the first time each device is activated.
This route closes if the purchase went through a general trading company or a non-authorized distributor, which happens frequently in regions where local sourcing is faster or where a plant buys through an existing supply contract. No party in that chain holds the Reseller ID needed to register those particular serials afterwards, and Apple does not add them retroactively on request.
The route that most teams in this position overlook. Since iOS 16, the Apple Configurator app running on an ordinary iPhone can add another iPhone or iPad to ABM wirelessly, with no cable and no Mac involved.
The process is short. An IT staff member installs the free app on their own iPhone and signs in with a Managed Apple Account holding Administrator or Device Enrollment Manager permissions. The target device is factory reset and taken through Setup Assistant as far as the Choose a Wi-Fi Network pane, where it stops. Holding the two devices close together, the admin scans the pairing image shown on screen or enters a six-digit code. The device uploads to ABM, becomes supervised, and picks up its MDM profile.
Everything in that sequence happens through the touchscreen, which is why it works for a phone already mounted in an explosion-proof cover. No ports, no cable and no disassembly are involved. One caveat applies. Devices added this way carry a thirty-day provisional period, during which a user still has the option to release the device from ABM, supervision and management. After thirty days, enrollment becomes permanent.
With supervision in place, the MDM profile does the rest. Camera runs in Single App Mode, Bluetooth is forced off, App Store, Safari and Messages are blocked, eSIM installation is refused, and the sync client uploads photos automatically whenever the device reaches known Wi-Fi. Crews never see a home screen, and a lost device can be wiped from the office.
The camera itself is worth a moment of thought, since it is the one function you are deliberately leaving switched on. Recent iPhone generations changed what field documentation looks like, with high resolution sensors that hold detail when an inspector crops into a weld or a corroded flange, macro capability for close work, and low-light performance that matters inside vessels and under decks. Xshielder builds explosion-proof covers for the iPhone 17 Pro Max, the iPhone 17 and the iPhone 16 Pro Max, so the imaging quality a plant already relies on above ground carries into the classified area with it.
Sometimes ABM is genuinely not going to happen quickly. A joint venture structure complicates who owns the devices, IT is stretched, or the phones are needed on a vessel next week. A usable, if weaker, configuration is still available.
Screen Time, found under Settings and then Content and Privacy Restrictions, functions as a lightweight local policy engine. IT can switch off Safari and FaceTime under Allowed Apps and Features, and remove the App Store by setting Installing Apps to Don't Allow. Messages doesn't have an equivalent toggle, but it can still be restricted by taking the app out of Always Allowed so an all-day Downtime schedule catches it, or via a one-minute App Limit, in both cases with the blocking option turned on. A Screen Time passcode known only to the IT team and stored in the company password manager holds all of it in place, and crew cannot reverse the settings without it. There are limits to this approach though. Screen Time cannot disable Bluetooth, block eSIM installation or push a remote wipe - and a factory reset can clear all of these settings entirely.
Guided Access, under Accessibility, gets closer to a camera-only experience by pinning the device to a single app behind a passcode. It is configured by hand on each device with no central oversight, so it suits a small number of phones held by a supervisor more than a fleet passed around a rotating crew.
Unsupervised MDM enrollment is the third option where the platform is already licensed for iOS. It adds inventory and app distribution, though blocking apps, forcing Bluetooth off, refusing eSIM and running Single App Mode all sit behind supervision, so the restrictions themselves still come from Screen Time on the device.
What remains is procedural control. Bluetooth switched off at handover, documented in the SOP, with crew instructed to leave it alone. Needless to say, that's not completely infallible, and a security team has to accept it as sufficient before the devices go out. One requirement does often get solved by the hardware itself - since a physical SIM tray is not reachable while the phone sits in its enclosure, leaving eSIM as the only cellular path to manage.
If the devices are already on site and the enclosure keeps the ports out of reach, wireless enrollment through Apple Configurator for iPhone is usually the fastest way to a fully enforced configuration, and an internal IT team can run it in an afternoon.
If a fresh batch is being ordered, buying through an Apple Authorized Reseller with enrollment applied at the point of sale avoids the provisional period and sets up a clean channel for every future device. The unsupervised path fits situations where speed outweighs enforcement and the risk assessment supports procedural control on the remaining items.
The broader lesson sits in procurement. Once a plant knows it will manage its hazardous area phones centrally, the purchasing channel stops being a commercial detail and starts determining which controls are available on day one.
If you are specifying protected iPhones for inspection or maintenance work and want the configuration side mapped out alongside the hardware, our team can talk through the enrollment route that fits your existing IT setup. Get in touch to discuss your requirements, or browse the full Xshielder range.
Yes, using Single App Mode, which requires the device to be supervised through Apple Business Manager and managed by an MDM platform. Without supervision, Guided Access can pin a device to one app locally, but it has to be set up by hand on each phone.
To force Bluetooth off so the user cannot switch it back on, yes, because that restriction only applies to supervised devices. On an unsupervised iPhone, Bluetooth can be turned off manually and controlled by procedure.
Yes. Apple Configurator for iPhone pairs two devices wirelessly through the touchscreen during Setup Assistant, so no cable or port access is needed.
They cannot be added to Apple Business Manager at the point of sale, because only Apple, an Apple Authorized Reseller or a carrier can assign serial numbers at purchase. Wireless enrollment through Apple Configurator for iPhone remains available as a retroactive route.
Create one dedicated device account per phone using company email addresses and hold the credentials centrally with IT. Supervised devices can also run without any user-facing account once the MDM profile is applied.
Yes. A cloud sync client such as OneDrive uploads automatically over corporate Wi-Fi, which lets the device stay off the cellular network entirely.