{"id":46753,"date":"2020-06-26T17:46:01","date_gmt":"2020-06-26T23:46:01","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=46753"},"modified":"2022-10-07T13:09:19","modified_gmt":"2022-10-07T17:09:19","slug":"remote-macos-mdm-enrollment-policy","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/remote-macos-mdm-enrollment-policy","title":{"rendered":"Enroll Remote macOS Systems with the MDM Enrollment Policy"},"content":{"rendered":"\n
Reading the tea leaves from Apple\u00ae<\/sup>\u2019s WWDC2020, it\u2019s evident that their mobile device management<\/a> (MDM) framework is the future for macOS\u00ae<\/sup> lifecycle management.\u00a0<\/p>\n\n\n\n To that end, JumpCloud\u00ae<\/sup> is excited to offer admins a seamless way to remotely enroll macOS systems<\/a> into MDM via policy in the Directory-as-a-Service\u00ae<\/sup> platform.<\/p>\n\n\n\n Admins can implement the JumpCloud MDM Enrollment policy in just a few clicks \u2014 enrolling their entire fleet of macOS systems into MDM without any end user input, interaction, or disruption.<\/p>\n\n\n\n One of the most exciting aspects of this policy is its ability to be used to migrate from another MDM vendor to JumpCloud. JumpCloud provides robust system management capabilities across Mac\u00ae<\/sup>, Windows\u00ae<\/sup>, and Linux\u00ae<\/sup> systems, leading many admins to Directory-as-a-Service as a way to consolidate device management<\/a> into a single platform. <\/p>\n\n\n\n The MDM Enrollment Policy leverages the macOS system agent to apply the JumpCloud MDM enrollment profile. <\/p>\n\n\n\n JumpCloud policies execute on a device’s agent check-in. This means that targeted offline systems will receive the policy\u2019s payload the next time they come online. <\/p>\n\n\n\n With one click of the checkbox shown below, the policy will also migrate the bound system from another MDM vendor to JumpCloud MDM.<\/p>\n\n\n\n When selected, the JumpCloud system agent removes any existing non-JumpCloud MDM enrollment profiles before installing the JumpCloud MDM profile on the macOS device. Like the Highlander, there can only be one MDM enrollment profile, so admins using another MDM provider must use this policy to remove existing profiles before deploying the JumpCloud MDM enrollment profile. <\/p>\n\n\n\n Note: <\/strong>If a device has been enrolled into MDM via automated device enrollment (DEP) and the profile is set to be non-removable, the JumpCloud agent will not be able to remove this profile and migrate the system to JumpCloud MDM.<\/em><\/p>\n\n\n\n For admins looking to migrate systems in this state, the device must be reassigned to the JumpCloud MDM server through Apple Business or School Manager, and then re-registered to the profile via new device activation.<\/em><\/p>\n\n\n\n For admins working in the new remote \u201cwork from home\u201d world, macOS system management capabilities available via Apple MDM are more important than ever \u2014 and admins might find that Apple Business Manager<\/a> isn’t the solution they’re looking for.<\/p>\n\n\n\n Often, the trickiest part of managing remote systems is deploying management software to them securely. The JumpCloud MDM Enrollment policy allows JumpCloud admins to roll out JumpCloud MDM to existing systems in their org with just a few clicks.<\/p>\n\n\n\n For admins that may have no remote system management currently in place, this policy can be paired with a new feature that allows end users to enroll their own machines<\/a> into JumpCloud via a self-service workflow in the JumpCloud User Portal, creating a clear path to implement MDM. <\/p>\n\n\n\nHow it Works<\/h2>\n\n\n\n
Why It Matters<\/h2>\n\n\n\n
What\u2019s Next<\/h2>\n\n\n\n