Enroll a Mac in Apple MDM

Before you start

• This is an IT task. It assumes you look after your company’s Macs and can sign in to Apple’s websites for your company. If that is not you, do this together with the person who does.
• You can manage devices in Zonitix. In the built-in set, administrators have that permission, and so do members of the “IT” group.
• The Zonitix agent is a separate thing and comes first: see Enroll a device. Installing the agent does not enroll a Mac in MDM, and MDM is optional.
• For the push certificate: an Apple ID that belongs to the company, not to one person. Whoever owns it controls the yearly renewal.
• Each Mac has to be in the hands of the person enrolling it. They install the profile themselves, in System Settings.

Connect Apple MDM

1. 1

   Step 1: Open the macOS setup checklist

   Go to DevicesSettings and pick the “macOS” card. In the “Enrollment” section, open the step “Apple MDM & push certificate”. It is marked optional and sits after “Install the agent”.

2. 2

   Step 2: Connect

   On the “Apple MDM” card (it carries a “beta” label), click “Connect Apple MDM”. There are no keys to enter. When it has worked, the card shows “Connected”.

Install the Apple push certificate

1. 3

   Step 3: Open the certificate window

   On the “Apple push certificate” card, click “Set up push certificate”. The window lists five steps and has the uploader at the bottom.

   Macs can enroll and receive locked settings without the certificate. Adding it is what allows instant changes and remote lock and erase.
2. 4

   Step 4: Get the signing request

   Apple only issues a certificate against a signed request file. When yours is ready the window shows “Your signing request is ready.” with a “Download request” button. Click it and keep the file.

   If the window says the request is still being prepared, the button appears there once it is ready.

3. 5

   Step 5: Create the certificate at Apple

   1. Open Apple’s Push Certificates Portal, identity.apple.com, and sign in with the company Apple ID.
   2. Click “Create a Certificate” and upload the request file from step 4.
   3. Download the certificate Apple gives you. It is a file ending in .pem.
4. 6

   Step 6: Upload it to Zonitix

   Back in the certificate window, under “Upload push certificate”, click “Choose Apple certificate (.pem)” and pick the file Apple gave you. Your instance already holds the private key that matches the request it gave you, so the .pem is all you upload.

   The window checks the file and shows “Valid Apple push certificate”. Click “Install”.

   If your certificate was made another way, click “Use a different key / .p12”. Then either choose “Single .p12 file”, pick the file and enter its “.p12 password”, or choose “Certificate + key (.pem)” and pick both files.

Enroll a Mac

1. 7

   Step 7: Enroll the Mac you are sitting at

   Once connected, the “Apple MDM” card shows “Enroll a Mac”. If you are signed in on the Mac you want to enroll, click “Download enrollment profile” there and go to step 9.

2. 8

   Step 8: Or send someone else the link, with a code if they have no account

   Under “Share the enrollment link”, copy the link and send it to the person. They open it in Safari on their Mac. The page is titled “Enroll this Mac”.

   • Someone who can sign in to Zonitix clicks “Sign in instead”, signs in, and the profile downloads.
   • Someone without an account needs a code. Under “Or share a one-time code”, click “Single-use code” (it expires in about 15 minutes) or “Reusable code (24h)” for several Macs. They type it under “or use a one-time code” and click “Enroll with code”.
3. 9

   Step 9: Install the profile on the Mac

   After the download the page says what to do next: open System Settings, then General, then VPN & Device Management, and install the Zonitix profile.

What you should see

If something goes wrong

The Apple MDM card says connecting cannot be finished from this page

The connection to the MDM service was not completed when your instance was built, and nothing on the screen can complete it. See Contact Zonitix support. The agent and its settings work without MDM in the meantime.

"Connect Apple MDM first." in the certificate window

The certificate is installed into the MDM connection, which does not exist yet. Close the window and do step 2.

The code is shown crossed out, with "This code has expired"

A single-use code lasts about 15 minutes. Click New single-use or New reusable (24h) under it and send the new one.

"That code did not work." on the Mac

Check the code was typed exactly as shown. If it still fails, generate a new one and use that.

The certificate is about to expire, or has expired

Apple push certificates last 12 months. Click Renew certificate on the card, sign in to identity.apple.com with the same Apple ID and renew there, then upload the new file. Do not create a new certificate with a different Apple ID: every Mac would have to enroll again.

A warning that some enrolled Macs will not receive push commands

Those Macs were enrolled under an earlier certificate. On each one, remove the Zonitix MDM profile in System Settings and install the enrollment profile again (steps 7 to 9).

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Enroll a device
• Push a compliance profile
• Manage a device day to day
• Get the recovery key for a locked disk