Remote Apple TV setup, in the right order.

1. 1

   Create one screen code.

   In SignCloudNine, open Screens → Add screen. Name the Apple TV, choose its site and initial board state, and create the code.

   Use a different single-use code for every Apple TV. The manager’s code expires after 24 hours.
2. 2

   Install SignCloudNine.

   Assign the tvOS app to the Apple TV or its install group. Confirm the MDM reports the app installed before continuing.

3. 3

   Send managed app configuration.

   Send quickBoardServer, quickBoardPairingCode, and the device identity values to the SignCloudNine app. The app claims the code on first successful launch.

4. 4

   Launch and let content activate.

   Open the app with the MDM’s supported launch path, or launch it locally once. Keep the Apple TV online while the app downloads and verifies its assignment.

5. 5

   Verify Playing in the manager.

   Check the screen name, assignment, last check-in, and content state. Playing is the acceptance gate—not merely “app installed” or “device online.”

6. 6

   Remove the code, then apply App Lock.

   Blank or remove quickBoardPairingCode from the managed configuration. Move the Apple TV into the Signage lock group and apply App Lock / Single App Mode to the SignCloudNine bundle ID.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>quickBoardServer</key>
    <string>https://signcloudnine.com</string>
    <key>quickBoardPairingCode</key>
    <string>{{scn_pairing_code}}</string>
    <key>quickBoardDeviceId</key>
    <string>{{scn_device_id}}</string>
    <key>quickBoardDeviceName</key>
    <string>{{scn_device_name}}</string>
</dict>
</plist>

SimpleMDM setup: In Configs → Attributes, create scn_pairing_code as a secret custom attribute plus scn_device_id and scn_device_name. SimpleMDM replaces double-brace attributes separately for each device. If an attribute is missing, the placeholder remains unchanged and enrollment fails closed.

POST /api/v1/admin/pins/batch
{
  "boardId": "BOARD_UUID",
  "devices": [
    { "deviceId": "lobby-atv-01", "deviceName": "Lobby Apple TV" },
    { "deviceId": "drive-thru-atv-01", "deviceName": "Drive-thru Apple TV" }
  ]
}

Automated handoff: The batch response contains the exact scn_* values for every device. SignCloudNine operators can use the included provision-simplemdm-fleet.mjs utility to write them through the SimpleMDM API. It previews by default and changes SimpleMDM only with an explicit --apply.

Why two groups? App installation or updates can be blocked while Single App Mode is active. Moving verified devices into the lock group creates an inspectable handoff instead of racing the install.

Evidence boundary: MDM success, app installation, workspace enrollment, content playback, and restart behavior are separate checks. A green result in one system does not prove the others.