MDM Commands

Mobile Device Management (MDM) commands let you remotely execute certain management commands on devices that use MDM. These commands help you remotely control macOS, iOS, and iPadOS devices. Admins with the requisite permission level can run these MDM commands from the JumpCloud Admin Portal: 

Prerequisites:

• MDM is configured for your organization.
  • See Set up Apple MDM.
• Admins require command running permissions to run MDM Commands.
  • See Admin Portal Roles for more information.

Considerations:

• MDM commands appear in Directory Insights under the event type mdm_command_result. The specific command is detailed in the request_type field, such as clear_passcode.
  • See Get Started: Directory Insights

Verify a Device Can Be Managed Using MDM Commands

Before proceeding, verify that a device can be managed using MDM commands:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, select the device, then select the MDM tab.
4. Verify that this device is enrolled in MDM.
   

Lock a macOS Device

To remotely lock a lost device, you must set a PIN. The device remains locked until the user enters the PIN. The user cannot log in until the PIN is entered.

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then find the macOS device.
4. In the device row, click Actions > Lock Device.
5. In the Lock This Device dialog box, enter a six-digit PIN. Use a number that’s easy to remember, or save it in a safe place, as JumpCloud does not save this information. This is the PIN that the user will need to enter to unlock the device.
6. Click yes, lock. The device immediately restarts and displays a screen to enter the PIN to unlock the device. Allow 5-10 minutes for the device’s status to change in the JumpCloud Admin Portal.

Restart a macOS Device

Send the restart command to immediately restart the device. Any unsaved work on the device is lost. If the device restarts quickly, the device’s status in the JumpCloud Admin Portal might not change.

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then find the macOS device.
4. In the device row, click Actions > Restart Device.
5. In the Restart This Device dialog box, click yes, restart.

Shut Down a macOS Device

Send the shut down command to immediately shut down the device. Any unsaved work on the device is lost. If the device restarts quickly, the device’s status in the JumpCloud Admin Portal might not change.

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then find the macOS device.
4. In the device row, click Actions > Shut Down.
5. In the Shut Down This Device dialog box, click yes, shut down.

Erase a macOS Device

Send the erase command to immediately erase the hard drive on the macOS device, even if the device is locked. Everything on the hard drive, including macOS software, is removed. The user is not warned of this action. See Apple's Developer Documentation.

1. Log in to the JumpCloud Admin Portal..
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then select the device.
4. From the device page, click Actions > Erase Device.
   
5. In the Erase This Device dialog box, enter or paste in a six-digit PIN. Use a number that’s easy to remember, or save it in a safe place, as JumpCloud does not save this information.
6. Click yes, erase. If an error displays when you run the erase command on a Monterey device, the device still erases (which conforms with Apple's Big Sur obliteration behavior). 

Lock an iOS or iPadOS Device

When you remotely lock a lost iOS or iPadOS device, the device remains locked until the user enters the iPhone’s passcode. 

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then find the iOS device.
4. In the device row, click Actions > Lock Device.
   
5. In the Lock This Device dialog box, click yes, lock. The iOS device is immediately locked and displays a lock screen.

Erase a Corporate-Owned iOS or iPadOS Device

Send the erase command to immediately remove all data from a corporate-owned device, even if the device is locked. The user is not warned of this action. The user can't access this device until you unlock it and complete the setup. For more information on remote wipe, see Apple’s documentation. 

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then select the iOS device.
4. From the device page, click Actions > Erase Device.
5. In the Erase This Device dialog box, click yes, erase.

Unenroll a Personal iOS or iPadOS Device

Removing an iOS device from MDM enrollment can only be done for personal devices. The user is not warned of this action. The device will be unenrolled from MDM and all of the data and apps allowed by MDM will be removed when the partition is deleted. You cannot unenroll a corporate device through the Admin Portal; that can be done only through the API.

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then select the iOS device.
4. From the Actions menu, click Unenroll Device to remove a user-enrolled iOS device from MDM.
5. Click yes, unenroll.
   
6. To verify the unenrollment, click the MDM tab. The MDM Enrolled status will now be No. Note that unenrolling a device does not remove the device from the Devices List.

Delete an iOS or iPadOS Device Passcode

This command is applicable for the following devices:

• iOS 4.0+
• iPadOS 4.0+

Deleting a device passcode unlocks the device for the end user, allowing anyone to access the device without entering the passcode on the lock screen.

To clear the device password:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then select the iOS or iPadOS device.
4. From the Actions menu, click Delete Device Passcode.
5. On the confirmation, click yes, clear.

Delete an iOS or iPadOS Screen Time Passcode

This command is applicable for the following devices:

• Supervised iOS 8.0+
• Supervised iPadOS 8.0+

Deleting this clears the passcode on the device's Screen Time settings to unlock them, and removes any restrictions that have been set within Settings > Screen Time.

To clear the Screen Time Passcode:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices.
3. Select the Devices tab, then select the iOS or iPadOS device.
4. From the Actions menu, click Delete Screen Time Passcode.
5. On the confirmation, click Delete.