Create a Device Level macOS MDM Custom Configuration Profile Policy

JumpCloud policies can help you customize, manage, and secure macOS or iOS devices that are enrolled in MDM. If you need a policy that isn’t available as a ready-to-use policy in the JumpCloud Admin Portal, you can create an MDM custom configuration profile policy to help you distribute payloads and policies to devices.

A custom configuration profile is an XML file with an extension of .mobileconfig. You can use GUI tools like Apple Configurator 2 or iMazing Profile Editor, or a manual tool like Apple’s Configuration Profile Reference to create the custom configuration profile. To see available payloads you can include in a configuration profile, use the Profile Reference Documentation maintained by the MacAdmins community.

Considerations

• The custom MDM configuration profile is automatically installed to all users on a device. JumpCloud signs the custom configuration profiles that are uploaded to the policy and modifies the following attributes within the profile:
• PayloadIdentifier
• PayloadUUID
• PayloadRemovalDisallowed
• MacOS devices with M1 chips require additional considerations if you are deploying kernel extensions as part of a custom MDM profile .mobileconfig payload. See Apple's Documentation and consider using system extensions instead.

Prerequisites

• MDM is configured for your organization. See Manage Apple Devices with MDM to learn more.
• Your devices are enrolled in MDM.

Creating the Policy

To create a Recovery Lock policy for Mac computers, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select Device Policy to assign the policy to devices and device groups. On the New Device Policy page:
   • Select the macOS tab.
   • Search and select the required policy and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

• Under Settings, click upload file. 
• Select the .mobileconfig file you want to upload and click Open. 

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy only applies when a user logs into a supported Mac computer that is enrolled in Apple MDM.
• Or, select the Devices tab. Select one or more devices whom you want to add this policy to.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.