Oneleet MDM

Oneleet MDM lets your team manage company-owned devices from the same dashboard as the rest of your security and compliance program. Admins can confirm that devices are managed, see each device’s security posture, enforce security settings, and take remote action when a device is lost, stolen, or being offboarded.

How a device is managed depends on its platform:

• Apple devices — Macs enroll through Apple’s Mobile Device Management framework, either manually or zero-touch through Automated Device Enrollment, and the Oneleet Agent is installed automatically after enrollment.
• Windows devices — Windows devices are managed through the Oneleet Agent, which installs in minutes and delivers security checks, configuration policies, and remote actions with no enrollment infrastructure to set up first.
• Linux devices — Linux workstations are managed through the Oneleet Agent as well, with security checks and remote actions across major distributions.

Whichever path a device takes, it appears in the same Devices view in the Oneleet Dashboard, and the capabilities below apply across platforms.

The Managed badge and MDM enrollment filter use the same status across macOS, Windows, and Linux. Managed includes Macs enrolled in your organization’s Oneleet MDM and Windows or Linux devices included by enrollment rules or device exceptions. Not managed includes devices excluded from those rules and Macs that aren’t currently enrolled in your organization’s Oneleet MDM. The filter’s Unenrolled (Mac) option finds Macs that unenrolled from your organization’s Oneleet MDM.

Enable Oneleet MDM

Ask your Oneleet contact to enable the Oneleet MDM package for your workspace. It includes MDM, Oneleet Agent, People Management, Integrations, and Notifications. Compliance and Security Training are not required for MDM.

Enabling MDM preserves the other products already available in your workspace. If you also use Compliance, removing Compliance does not remove MDM or device monitoring. Your device records, assignments, monitoring settings, and history remain available while Oneleet Agent is enabled. Removing MDM alone also leaves device monitoring and the shared team tools enabled.

Set up your team

When your workspace uses Oneleet Agent without Compliance, its home page provides access to your available device and team tools. Admins can open Organization > Devices to manage devices and Organization > People to add employees and organize groups.

Employees use the Oneleet Portal to complete device setup. The portal shows the tasks available in your workspace: device setup with Oneleet Agent, policies with Compliance, and training with Security Training. Employees do not need workspace administrator access to set up their own devices. Apple MDM enrollment also requires your administrator to complete the Apple MDM setup.

The portal’s Devices tab lists the devices an employee has set up. Each device names its failing checks, such as “Screen lock is failing”, and shows whether its agent is connected, so an employee can tell which device to fix and what to change. Devices Oneleet has no current result for, such as archived ones, are listed separately and say why. Install the agent on another device from the same tab.

Device security monitoring

In a workspace without Compliance, Oneleet Agent sets up every device security monitor and runs them hourly. With Compliance, device monitors follow your frameworks’ controls, and removing a compliance framework keeps those device monitors, their settings, and their history while Oneleet Agent remains enabled. Existing snoozes and disabled monitors keep their settings.

Open a device and select Monitors to inspect its security findings. Select a monitor to review affected devices and past runs, rerun it, or manage snoozes and exceptions. These actions are available with Oneleet Agent enabled. Compliance controls appear on the monitor page when your workspace also has Compliance enabled.

In a workspace without Oneleet MDM, admins can have the agent fix failing monitors it can fix automatically. On a device’s Monitors tab, choose Start auto-fix. To fix several devices at once, select them in the Devices table and choose Run automatic fixes. The option appears when at least one selected device is non-compliant, and you can use it when at least one of them has a failing monitor its agent can fix. Devices that are compliant, have no failing monitor the agent can fix, are excluded from MDM, or run an agent older than 2.2.0 are skipped, and the dialog lists them before you confirm.

With Oneleet MDM, these options aren’t shown. Enforce those settings from Device Monitoring → Configuration Profiles instead.

Choose which Windows and Linux devices are managed

Open Device Monitoring → Configuration Profiles, choose Windows or Linux, and select MDM enrollment. Each platform has its own enrollment rule:

• All devices includes the platform’s devices in MDM. This is the default, preserving existing management until you change the rule.
• Specific people groups includes devices whose assigned Device owner belongs to any selected people group. Changes to group membership or device assignment affect enrollment automatically. Unassigned devices don’t match a group.
• Devices selected individually includes devices with an explicit device exception.

Review the affected devices before saving. Group rules apply to current and future devices.

You can’t delete a people group while a Windows or Linux enrollment rule uses it. Remove the group from the rule first. If it’s the rule’s last selected group, choose another group or a different enrollment rule.

To make a device exception, open the device and choose Manage device → MDM enrollment. Choose Include in MDM or Exclude from MDM, optionally record a reason, and save. Device exceptions take precedence over group rules. Choose Follow enrollment rules to return the device to the platform’s enrollment rule.

For an employee’s personal device, choose Exclude from MDM. The Oneleet Agent stays installed and security monitoring continues, including compliance results. Exclusion is separate from changing a device’s compliance scope.

Archived Windows and Linux devices aren’t managed, and you can’t change their enrollment or use management actions on them. To manage one, delete it and enroll it again.

Excluded devices can’t receive new remote management commands or automatic fixes. Queued commands are checked again before delivery. A command already delivered to the agent may still finish. On Windows, the agent stops enforcing your organization’s configuration policies after its next successful policy download from Oneleet, which happens within about 15 minutes while the device is online. Until then, the agent keeps re-applying the policies it already has, so a device that stays offline or can’t reach Oneleet may keep enforcing them indefinitely. If another organization that uses Oneleet also manages the device, that organization’s policies still apply. Excluding a device doesn’t undo settings that were already applied, decrypt its disk, or uninstall the agent. The enrollment label describes the current rule, not confirmation that an offline device has received it.

Linux supports the same enrollment controls for remote actions. Linux configuration policies remain in progress.

Secure defaults

When device configuration management is enabled for your workspace, Oneleet offers a recommended secure baseline for macOS and Windows that can be applied in one click. Applying the secure defaults pre-fills settings as your organization-wide device policy — nothing is locked in. Every value stays editable, admins can override individual settings per device, and teams that prefer to build their own policy from scratch can skip the baseline entirely.

Activity log

Oneleet records device management actions in the device activity log. This gives admins a history of who requested an action, what action was sent, and how it completed.

The log also records MDM profile installed and MDM profile removed when a Mac reports enrollment in or removal from Oneleet MDM. These informational events appear as completed activities. Open an event to view its device and enrollment details in the Result section, or use the activity type filters to find installation and removal events.

Re-enrolled in MDM records a new enrollment for a Mac with a previous enrollment history, including when no removal event was received. Its details include the previous enrollment or removal time when available. This event confirms another enrollment; it does not establish why the device re-enrolled or whether it was erased.

This is useful for:

• confirming that an action such as a wipe, restart, or application install was requested and completed;
• reviewing device offboarding activity;
• keeping an audit trail for security and compliance reviews.

Remote actions delivered through the Oneleet Agent are also cryptographically signed and expire if not picked up promptly, so devices only execute instructions that verifiably came from Oneleet.

Automatic agent updates

The Oneleet Agent keeps itself up to date with cryptographically signed update packages — there is nothing for admins or employees to maintain after installation.