Documentation

Every screen explained

What each Vamiq screen does, what healthy looks like, what needs your attention and what to expect day to day. No device-management background needed.

Last checked 21 October 2026 · 11 min read

How to read this guide

Each screen below has four parts: what it is, what healthy looks like, what needs your attention and what to expect day to day.

Your branded app store and the release controls (Release Guard, Risk Forecast and Evidence Packs) come with Distribution and with the 14-day trial.

Overview and setup checklist

What it is: The first screen after you sign in. Until setup is finished, admins see a short checklist: branding, Apple Business, your first app, an enrolment link, the first device, the first app installed on it, and billing. Below it are headline numbers for apps, installs and the people with access to your workspace. Once a device has enrolled, a fleet summary adds enrolled devices, devices checked in today, devices not heard from in 7 or more days and required apps installed, with a health label: Healthy, Needs attention or Degraded.
What healthy looks like: Every checklist step ticked, and numbers that move as your people install apps.
Needs attention: A step that stays unticked for days, especially Create an employee enrolment: it needs the Apple push certificate, and nothing reaches a device without it. A rising count of devices not heard from in 7 or more days, or a health label of Needs attention or Degraded.
What to expect: The checklist is a one-time journey. After that, the Overview is your daily glance. To see whether people use your app store, open Reports → Adoption. After the 14-day trial the workspace stays on the Free plan; add billing when you need more than 5 devices or your own app store.

Your branded app store

What it is: Your branded app store is where your people find your company’s apps, at /w/your-slug or your own web address. It shows your logo, your brand colour and the apps you list, and a My install status option that emails each person a link to see what is happening on their company device.
What healthy looks like: Every app shows a version and an install button in your brand colour (Get App, or Install when app detail pages are on), and the page shows your logo.
Needs attention: People saying nothing happens after they tap install, or a page that still shows the default logo.
What to expect: Private apps install on enrolled company iPhones and iPads; the person may be asked to accept. You can ask people to enter their work email before they see your apps. Your branded app store comes with Distribution and with the 14-day trial. Set it up step by step.

Applications catalogue

What it is: Every app you can deliver: apps synced from Apple Business (Apps and Books), your own signed .ipa builds for enrolled iPhones and iPads, Web Clips, and apps added from an Apple redemption-code spreadsheet. On Enterprise, we also set up signed Android APK delivery with you. Each row shows the platform, version, delivery method and when it was added.
What healthy looks like: Every app has a version and a clear delivery method, and Apple Business apps show how many licences are left.
Needs attention: Licences close to zero, an app still on an old version after you released a new one, or a Release Guard result of Blocked.
What to expect: An Apple Business sync takes a minute or two. Buy more licences in Apple Business when the count runs low.

Release Guard

What it is: An automatic check of each uploaded build before it can reach a device: its bundle identifier, that its version matches the catalogue, the OS versions and devices it supports, its privacy descriptions, and its signing and provisioning profile. Release Guard comes with Distribution and with the 14-day trial.
What healthy looks like: Passed on every build you intend to release.
Needs attention: Blocked: the build is refused at release time, and the reason names what to fix. A check that can’t run shows as unknown, never as passed.
What to expect: It runs on upload without you asking. A blocked build usually means a signing or provisioning mistake: send the reason to whoever built the app.

Device groups and app assignments

What it is: The heart of managed deployment. You put devices into groups and assign apps to each group; Vamiq then keeps every device in line with that: installing on new members, updating to newer versions and removing apps you unassign. This is called desired state, and the matching process is called reconcile.
What healthy looks like: Every device in the group shows Installed (confirmed) for every assigned app, and a device added to the group gets its apps with no further step from you.
Needs attention: Devices stuck on Queued or Sent to device for more than a day (the device is probably off, or no longer enrolled), or repeated Failed results on one device. Open Why pairs are not converged: it names the cause, such as not assigned, Release Guard blocked, device not enrolled, no licence or OS too old, and the action that fixes it.
What to expect: Reconcile runs straight after any change and again on a regular schedule. A device must be online to act, so an install on a phone in a drawer waits until it is switched on. Apps install on enrolled devices; the person may be asked to accept.

Devices and device facts

What it is: Every enrolled device: who has it, model, OS version, whether it is supervised, and when it last checked in. Facts are the details a device reports about itself, such as its OS, security settings and installed managed apps, with the date they were collected.
What healthy looks like: Last seen within the last few hours for devices in daily use, facts collected recently, and company-owned devices showing Supervised.
Needs attention: Last seen more than a week ago (the device is off, erased or no longer enrolled), Supervision unknown on a company device, or a device that stays on enrolling.
What to expect: Devices check in on Apple’s schedule and whenever Vamiq wakes them for a change. Supervised devices, usually those that joined through Apple Business, allow the full set of actions; an action a device does not support says why. With Asset register download switched on in Features, you can download a list of every device with model, serial number, owner, encryption and last check-in.

Enrolment (links, QR codes, zero-touch)

What it is: How a device joins management: a single link for one named person (you enter their email; it lasts 1 to 168 hours), bulk links from a CSV of up to 500 people, an open link or QR code that any number of devices can use until you cancel it, and, for devices bought through Apple Business, zero-touch enrolment during the device’s first setup.
What healthy looks like: The checklist at the top of Enrolment is complete before you send any link, people enrol in a few steps, and zero-touch devices reach the Home Screen already managed.
Needs attention: A Finish setup before creating enrolment links banner (usually the Apple push certificate or your first app is missing), links that were used but no device appears, or a zero-touch device that never gets your enrolment during setup: check that it is assigned to Vamiq in Apple Business.
What to expect: If Enrolment is not in the sidebar yet, choose Set up device management first. Open links stay valid until you cancel them; single links expire after the hours you set. Every enrolment page tells the person plainly what the company can and cannot see on their device.

Device actions (lock, clear passcode, erase)

What it is: Remote controls for one device: lock it with a message, clear a forgotten passcode, or erase it. Vamiq offers only what that device supports.
What healthy looks like: Greyed-out buttons with a reason underneath are normal. Actions on a device that is online are acknowledged within minutes.
Needs attention: A request that waits a long time (the device is offline), a Failed result with Apple’s error, or erase requests waiting for a second administrator with nobody approving them.
What to expect: Clear passcode and erase need a written reason, the device’s exact name typed back and a code from your authenticator app. With two-person approval on, a second administrator approves an erase before anything is sent. A lock request waits up to an hour for a device that is offline, and an erase up to 24 hours; after that, cancel it if it still shows as pending and send it again. Every action is recorded in the audit log. What to do when a device is lost.

Configuration profiles

What it is: Settings you send to devices: passcode policy, Wi-Fi networks and restrictions, plus VPN and certificates, a lock screen message or company app data protection when those are switched on in Features. Enterprise workspaces can also upload a custom configuration profile. Each change creates a new numbered revision; old revisions are kept.
What healthy looks like: Every assigned device shows installed on the latest revision.
Needs attention: Devices still on an older revision days after you published a new one, or install errors: some restrictions work only on supervised devices, and the error says so.
What to expect: A new revision replaces the old one on the device; unassigning removes it. Secrets inside profiles, such as Wi-Fi passwords, are stored encrypted and never shown again after you save them.

Compliance: evidence, gaps and not evaluated

What it is: A check of every device against the rules that matter: passcode set, OS up to date, required apps and profiles present. Each result is one of three states: Evidence available (the device reported and meets the rule), Gap detected (it reported and does not), or Not evaluated (there is no recent evidence: the device has not reported, or the rule does not apply).
What healthy looks like: Mostly Evidence available, a short and shrinking list of gaps, and a small Not evaluated group whose reasons you know, such as a device on holiday or a new rule.
Needs attention: Gaps on security basics such as no passcode, or a Not evaluated group that keeps growing: devices are not reporting, which needs a different fix from a gap.
What to expect: Missing or old evidence is shown grey and explained; it is never shown as a failure. Choose Take snapshot when you want a dated record, or Download CSV. With Compliance history switched on in Features, Vamiq records each device’s compliance once a day.

Risk Forecast and update settings

What it is: The Risk Forecast, on Compliance, lists what is likely to need attention in the next 14 days, from evidence you already hold: devices that will fall behind on updates, certificates about to expire, unsupported versions and licences running short, each with the number of devices affected. With iPhone and iPad update settings switched on in Features, you can also delay, pre-download and remind staff about iOS and iPadOS updates.
What healthy looks like: An empty or short forecast, and devices updating well before any date you set.
Needs attention: Forecast items marked high confidence, or many devices showing unknown for updates.
What to expect: The forecast is a projection from evidence, kept separate from today’s results; it never invents facts. You can choose only the versions Apple has published for your devices. Risk Forecast comes with Distribution and with the 14-day trial.

Evidence Packs

What it is: A dated download, per app, that records what was released, to which devices and with what outcome, with checksums anyone can check. Download it from Applications, where each app has a Download Evidence Pack action. Evidence Packs come with Distribution and with the 14-day trial.
What healthy looks like: Evidence available against every mapped control you care about.
Needs attention: Gap detected on a security update control: devices are running versions older than your policy allows.
What to expect: Every mapping names its source, version and review date, and says what it does not cover. A manifest in the pack gives each file’s SHA-256 checksum, and the manifest’s own hash is written to your audit log when the pack is downloaded.

Reports and goals

What it is: Install attempts, success rate and adoption over time, and the goals you set for them, with each number compared with the previous period. Reports also show adoption, failures and events.
What healthy looks like: A success rate above 90%, adoption rising toward your goal, and trends pointing the right way.
Needs attention: A falling success rate, or failures clustering on one app or one device: that is where to look first.
What to expect: Failure reasons lists the most common failure codes for the period, and the latest install attempts are listed below it. Set a goal and the report shows the gap in plain numbers.

Audit logs

What it is: An append-only record of every sensitive action: who did it, when, from where and to what, including sign-ins, role changes, deployments, device actions and API key creation.
What healthy looks like: Every action you expect is there, under the right person’s name.
Needs attention: Actions you don’t recognise. Treat them as a possible compromised account: change the password and rotate any API keys or webhook secrets that account could reach.
What to expect: Entries cannot be edited or deleted, each workspace sees only its own records, and the log exports as CSV. Records are kept for two years. Organisation Admins and Auditors can open it.

Features

What it is: Workspace admins choose the features their workspace uses on one Features page. Each switch says what it does, which devices it applies to and what changes when it is on.
What healthy looks like: The features you rely on are on, and the audit log shows who switched each one on.
Needs attention: A screen or setting you expected is missing: its feature may be off.
What to expect: Nothing is switched on by itself. Changes may ask you to confirm it’s you, and are recorded in the audit log.

API keys and webhooks

What it is: API keys let your own systems read device and app records or manage assignments without signing in. Webhooks send events, such as a device enrolled or an assignment changed, to an address you choose, signed so you can check they came from Vamiq. Both are in Settings → Developer.
What healthy looks like: A few keys, each with the narrowest scope that works, rotated now and then, and webhook deliveries showing delivered.
Needs attention: Events marked dead (your endpoint kept failing: fix it, then replay), keys nobody can account for, or a key that has never been rotated.
What to expect: A secret is shown once, when it is created. Failed deliveries are tried up to eight times, with growing delays, before they are marked dead; a replay keeps the original event ID so your system can ignore duplicates.

Settings

What it is: Settings holds Billing, Workspace (name, logo, brand colour, web address and who can open your app store), Apple (the Apple push certificate, then the zero-touch certificate and server token), Connections (Slack and Microsoft Teams) and Developer (API keys and webhooks). Your Apps and Books token is on Applications → Apple Business. Single sign-on and SCIM are Enterprise features we set up with you.
What healthy looks like: The push certificate valid with months to spare, the zero-touch token current, and the devices you manage within the number on your plan (Settings → Billing).
Needs attention: A push certificate close to expiry: when it expires, app installs and device commands stop for every device at once. Vamiq emails the first Organisation Admin in your workspace 90, 30, 7 and 1 days before; act on the first reminder. An expired zero-touch token, or a notice that you manage more devices than your plan includes, also needs action that week.
What to expect: Renew the push certificate every year at Apple, with the same Apple Account: Apple push certificate. Each device you enrol and manage counts as one device; people who only use your app store are not counted.