Apple devices

Oneleet MDM helps your team manage company-owned Apple devices using Apple's Mobile Device Management framework. It allows admins to enroll Macs, confirm that devices are managed, and take important actions when a device is lost, stolen, or being offboarded.

This guide covers both supported enrollment methods: manual MDM enrollment and Automated Device Enrollment (ADE).

What Oneleet MDM can do today

For enrolled Macs, Oneleet gives admins a small set of high-impact actions for managing company-owned devices. These are useful when a device needs attention but the user is not available, the device is being returned, or there is a security concern.

Confirm MDM enrollment

Oneleet shows whether a Mac is enrolled in Apple MDM for your tenant. This helps admins quickly confirm that the device can receive MDM commands and is connected to the right organization.

This is useful when:

a new Mac has just been enrolled;
a device was reassigned to a different employee;
an admin wants to confirm that a device is managed before sending lock, wipe, restart, or shutdown commands.

Remote lock

Remote lock helps protect a Mac when it is lost, stolen, or temporarily out of the company's control. When an admin sends a lock command, the Mac locks and requires the recovery PIN to be unlocked.

Use this when:

an employee reports that a Mac is missing;
a device may be in an unsafe location;
you want to protect company data without erasing the device.

Remote lock requires a six-digit recovery PIN. Save this PIN before sending the command, because it may be needed to unlock the Mac later.

Remote wipe

Remote wipe erases the Mac. This is a destructive action and should be used only when the device should no longer keep company data.

Use this when:

a Mac is lost or stolen and should be treated as unrecoverable;
an employee has left the company and the device needs to be reset;
a device is being prepared for reassignment, return, or disposal.

Remote wipe also requires a six-digit recovery PIN. Make sure the PIN is stored securely before sending the command.

Restart

Restart lets an admin reboot an enrolled Mac remotely. This can help with basic troubleshooting when a device is online but needs a clean restart.

Use this when:

a user is having an issue and a restart is the next troubleshooting step;
a device needs to restart after updates or configuration changes;
the user cannot easily restart the device themselves.

Shut down

Shut down powers off an enrolled Mac remotely.

Use this when:

a device should be powered down after offboarding;
a Mac is online but should not remain active;
an admin wants to stop the device without erasing it.

Automatic agent installation

Once a Mac is enrolled in Oneleet MDM — whether manually or through Automated Device Enrollment — the Oneleet Agent is installed automatically. There's nothing for the admin or the employee to download or run separately.

After enrollment, Oneleet pushes the agent to the device in the background. This typically completes within a few minutes, depending on network conditions. Once installed, the agent begins reporting endpoint security checks and device posture alongside the device's MDM status, so both show up together in the device view.

If the agent doesn't appear as installed after some time, the device will automatically retry — no action is needed. If it's been an extended period, contact Oneleet support.

Activity log

Oneleet records MDM actions in the device activity log. This gives admins a history of who requested an action, what action was sent, and when it happened.

This is useful for:

confirming that a lock, wipe, restart, or shutdown was requested;
reviewing device offboarding activity;
keeping an audit trail for security and compliance reviews.

What Oneleet MDM does not do yet

Oneleet MDM does not prevent a user from removing a manually installed enrollment profile. Whether a user can remove management depends on how the device was enrolled and assigned through Apple — see Apple's 30-day provisional period below.

Admin setup

Before any Mac can be enrolled — whether through Automated Device Enrollment or manually — an administrator needs to connect Oneleet MDM to Apple Push Notification service. This is a one-time setup for your tenant and applies to both enrollment methods below.

To set this up:

Open the Oneleet Dashboard.
Go to Devices.
Open the Apple MDM Setup tab.
Review the prerequisites.
Go to the Apple MDM Certificate tab.
Enter your legal company name, country, and MDM administrative email.
Generate and download the Oneleet CSR file.
Open the Apple Push Certificates Portal.
Sign in with the company Apple Account that will be used to manage certificate renewals.
Create a certificate and upload the Oneleet CSR file.
Download the Apple MDM certificate.
Return to Oneleet and upload the certificate.

Use the same Apple Account when renewing this certificate in the future. If a different Apple Account is used to create the renewal certificate, already enrolled devices may need to be re-enrolled.

Automated Device Enrollment

Automated Device Enrollment (ADE), built on Apple Business Manager (ABM), lets you enroll company-owned Macs automatically the first time they're set up — no manual profile install required.

How it works:

Devices are registered in Apple Business Manager. Macs purchased directly from Apple or an authorized reseller are added to ABM automatically. Devices acquired another way can be added manually using Apple Configurator.
Your admin links Apple Business Manager to Oneleet. This is a separate one-time step from the certificate setup above — Oneleet exchanges credentials with ABM so it can manage enrollment on your organization's behalf. In the Oneleet Dashboard, go to Devices > ADE Devices and follow the setup steps to connect your Apple Business Manager account.
Oneleet syncs your device inventory from Apple Business Manager on an ongoing basis, so newly added or reassigned devices show up automatically.
Your admin assigns the Oneleet enrollment profile to some or all of your ABM-registered devices from the Oneleet dashboard.
When an assigned Mac is set up or wiped and reset, Apple automatically presents the Remote Management screen during Setup Assistant and enrolls the device into Oneleet MDM — the user doesn't need to download or install anything.

Devices enrolled through ADE are supervised — Apple's elevated management mode for organization-owned devices — which gives Oneleet the full range of management capabilities. Combined with automatic agent installation, this means a new Mac can go from unboxed to fully enrolled and agent-reporting without the end user installing anything.

Enroll a Mac manually

Use these steps after Oneleet MDM has been configured for your tenant.

Download the Oneleet MDM enrollment profile for your tenant. Employees can download it from the Devices tab in the Oneleet Portal using the Download MDM Profile button.
Send the profile to the user, or open it directly on the Mac.
On the Mac, double-click the .mobileconfig file.
Open System Settings.
Go to General > Device Management. On older macOS versions, profiles appear under Privacy & Security > Profiles.
Select the Oneleet MDM enrollment profile.
Click Install.
Review the management prompt and approve the installation.
Enter the Mac administrator password if prompted.
Return to Oneleet and confirm that the device appears as enrolled.

The Mac needs internet access during enrollment so it can contact Apple services and Oneleet MDM.

After enrollment

Once the Mac is enrolled:

The device can receive supported MDM commands from Oneleet.
The Oneleet Agent installs automatically in the background — see Automatic agent installation above.
Admins can use MDM lock or wipe for lost, stolen, or offboarded devices.
MDM actions are recorded in the device activity log.
Once the agent is installed, agent checks and MDM actions appear together in the device view.

Apple's 30-day provisional period

Apple documents a 30-day provisional period for devices that are manually added to Apple Business Manager using Apple Configurator. This is important because it affects whether a user can remove management shortly after the device is added.

In practice:

The device must be added to Apple Business Manager using Apple Configurator.
The device must then be assigned and enrolled in a device management service linked to Apple Business Manager.
For the first 30 days after successful assignment and enrollment, the user can release the device from Apple Business Manager, supervision, and device management.
After the 30-day period ends, the release option is no longer part of the provisional flow. The device then behaves like a standard Apple Business Manager device with mandatory supervision and MDM enrollment.

This 30-day rule also applies to devices enrolled through Oneleet's ADE support, since ADE enrollment goes through Apple Business Manager. It is different from manually installing a Oneleet MDM profile on a Mac — installing the Oneleet MDM profile manually does not add the device to Apple Business Manager and does not create this 30-day provisional period by itself.

Reference

Apple's official deployment documentation explains how Apple Configurator-added devices are added to Apple Business Manager and how the 30-day provisional period works. See Add Apple devices to Apple School Manager or Apple Business Manager.

Unenrollment and device ownership

Company-owned devices should only be removed from MDM as part of an approved offboarding, device replacement, or recovery process.

For devices added through Apple Business Manager and assigned to a device management service, admins should manage ownership and release decisions in Apple Business Manager.

For manually installed profiles, follow your organization's Oneleet MDM offboarding process.

If you are unsure whether a device should be removed from management, contact Oneleet support before taking action.