MDM Deployment
Zero-Touch Setup
via MDM
Push every setting — credentials, room assignment, theme and branding — from your MDM, with no on-device configuration
How It Works
The Room Display supports Apple's Managed App Configuration standard, which every major MDM implements (SimpleMDM, Jamf, Mosyle, Kandji, Intune, and others). Your MDM pushes a set of key/value pairs to the app; the iPad boots straight into the room display with no on-device setup at all — ideal combined with Single App Mode.
- Settings delivered via MDM appear disabled in the app's Settings screen with a "Managed by your organization (MDM)" label, so on-site staff can't change them.
- Configuration changes pushed by the MDM apply live, without relaunching the app.
- Any subset of keys works: push only the theme and let staff configure calendar access on-device, or manage everything for full zero-touch deployment.
- Interactive Google/Microsoft sign-in cannot be pushed via MDM — zero-touch calendar access uses the Google Service Account method.
Configuration Keys
Calendar Access (Google Service Account)
All three keys must be present together; see the Google Workspace guide for how to create the service account.
| Key | Type | Value |
|---|---|---|
serviceAccountEmail |
String | Service account email (...@...iam.gserviceaccount.com) |
serviceAccountPrivateKey |
String | PEM private key from the service account JSON file — literal \n escapes are accepted as-is |
adminEmail |
String | Google Workspace admin email to impersonate |
Room Assignment
| Key | Type | Value |
|---|---|---|
roomEmail |
String | Room resource calendar email for this device |
Most MDMs support per-device variables here — in SimpleMDM, set the value to a custom attribute like {{room_email}} so a single app configuration serves the whole fleet.
Theme & Branding
| Key | Type | Value |
|---|---|---|
theme |
String | classic, midnight, or custom |
brandName |
String | Brand name shown with the custom theme |
logoURL |
String | HTTPS URL to a PNG/JPEG logo; the app downloads and caches it |
themeColor… |
String | #RRGGBB hex color per role (custom theme): themeColorAvailable, themeColorInUse, themeColorEndingSoon, themeColorAccent, themeColorBackground, themeColorCardBackground, themeColorTextPrimary, themeColorTextSecondary, themeColorNotConfigured, themeColorMeetingTitle, themeColorTimeRemaining, themeColorDurationButtonText. Any subset works; missing colors fall back to the Midnight palette |
Policies
| Key | Type | Value |
|---|---|---|
checkinRequired |
Boolean | Require meeting check-in |
checkinTimeoutMinutes |
Integer | Check-in timeout in minutes (e.g. 5, 10, 15) |
deviceMode |
String | door_display or room_controller |
microsoftClientId |
String | Custom Microsoft Entra app client ID (sign-in itself remains interactive) |
SimpleMDM Walkthrough
- In SimpleMDM, go to Apps → The Room Display → Managed Configuration.
- Add the keys you need from the tables above as key/value pairs.
- For per-device room assignment, create a custom attribute (e.g.
room_email) with a value per device, and set theroomEmailkey to{{room_email}}. - Assign the app — and optionally a Single App Mode profile — to your device group and push.
For MDMs that accept raw AppConfig XML:
<dict>
<key>serviceAccountEmail</key>
<string>meeting-room-display@my-project.iam.gserviceaccount.com</string>
<key>serviceAccountPrivateKey</key>
<string>-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBg...\n-----END PRIVATE KEY-----\n</string>
<key>adminEmail</key>
<string>admin@example.com</string>
<key>roomEmail</key>
<string>boardroom@example.com</string>
<key>theme</key>
<string>custom</string>
<key>brandName</key>
<string>Acme Inc</string>
<key>logoURL</key>
<string>https://example.com/logo.png</string>
<key>themeColorAccent</key>
<string>#B7CF4F</string>
<key>themeColorBackground</key>
<string>#100E24</string>
<key>checkinRequired</key>
<true/>
<key>checkinTimeoutMinutes</key>
<integer>10</integer>
</dict>
Security Notes
Apple delivers Managed App Configuration into the app's sandboxed preferences — that is inherent to the AppConfig mechanism, so the service account private key is not stored in the iOS Keychain when supplied this way (the app never copies it anywhere else, and removing the key from your MDM configuration removes it from the device on the next push). Deploy to supervised devices and restrict who can edit the MDM app configuration.