Enroll Macs with Apple Business Manager

Automated Device Enrollment (ADE) enrolls company-owned Macs in Oneleet MDM while they’re being set up. When a Mac assigned to Oneleet in Apple Business Manager (ABM) runs Setup Assistant, after it’s unboxed or erased, it enrolls on its own and then installs the Oneleet Agent. The employee doesn’t download or install anything. ADE also works with Apple School Manager.

Workspace admins connect Apple Business Manager and assign Macs. Other members see the ADE Devices tab once it’s connected, but can’t sync or assign. Before you start, set up Apple MDM for your workspace. Oneleet can’t assign Macs until your push certificate is uploaded.

Connect Apple Business Manager

You connect Oneleet to Apple Business Manager once by adding Oneleet as an MDM server there. You’ll need an Apple Business Manager or Apple School Manager account with the Administrator or Device Enrollment Manager role.

In the Oneleet Dashboard, go to Devices and open the ADE Devices tab.
Click Download certificate to download the Oneleet ADE public key certificate. It’s unique to your workspace and identifies Oneleet to Apple.
Sign in to Apple Business, formerly Apple Business Manager, or Apple School Manager.
Add a device management service:
- In Apple Business, open Devices > Management Services. Select Get Started if this is your first service. Otherwise, select Connect external device management, then Continue.
- In Apple School Manager, select your name at the bottom of the sidebar, then Preferences > Device Management Service Assignment > Add.
Name the service and upload the Oneleet ADE public key certificate. Select Next in Apple Business or Save in Apple School Manager.
Download the service token, a .p7m file. In Apple Business, select Download Service Token, then Done. In Apple School Manager, select the download button, then Download Device Management Service Token.
Back on the ADE Devices tab, upload the .p7m file and click Upload token. Oneleet validates the token with Apple, which can take a few seconds.

For Apple’s full instructions, see Connect a service in Apple Business or Connect a service in Apple School Manager.

Once the token is accepted, the tab shows the ADE connection. Your Macs appear after the first sync of your Apple Business Manager inventory, so click Sync now to see them right away.

Assign Macs to Oneleet in Apple Business Manager

Apple Business Manager only sends a Mac to Oneleet once it’s assigned to the MDM server you created for Oneleet. Assign your Macs to that server in Apple Business Manager. To have new purchases go to Oneleet without assigning each one, make the server the default for Macs.

Macs your company buys from Apple or an authorized reseller with its Apple Business Manager account are added to Apple Business Manager automatically. To add a Mac you got another way, use Apple Configurator. Apple Configurator erases the Mac, so back it up first. A Mac added that way starts with a 30-day provisional period.

Oneleet syncs your Apple Business Manager inventory every hour. To see a change sooner, click Sync now. If the list still looks wrong after a sync, turn on Full sync before syncing to read the whole inventory again, which takes longer.

A Mac can be assigned to only one MDM server. If Apple Business Manager assigns a Mac to another MDM, reassign it to Oneleet’s server. If the Mac is still enrolled in that other MDM, remove it from there before you enroll it in Oneleet. Spot Macs managed by another MDM shows which Macs those are.

Assign the enrollment profile

Oneleet doesn’t assign its enrollment profile to Macs automatically. Assign it to every Mac you want to enroll before that Mac is set up, including Macs that show up in later syncs.

To assign it to every Mac in the inventory, click Assign profile to all.
To assign it to some Macs, select them in the table and click Assign profile in the selection bar.

A Mac that already has a profile gets the latest one. The Profile status column shows how far each Mac has got:

No profile: Oneleet hasn’t assigned the profile, or Apple Business Manager doesn’t have it yet.
Assigned: Apple Business Manager will give the Mac the profile the next time it runs Setup Assistant.
Pushed: the Mac has downloaded the profile during setup.
Removed: the profile was removed from the Mac’s assignment.

Assignment failed under a status means the last attempt didn’t go through. Hover over it for the reason, then assign the profile again.

An assigned profile works for up to 30 days. If a Mac isn’t set up by then, it can’t enroll during setup, so assign the profile to it again first. This includes a Mac you erase and set up again later.

What the enrollment profile does

Click Preview profile on the ADE Devices tab to see what Oneleet assigns. The profile is named after your workspace, and it has these effects on the Mac:

Enrollment is mandatory, so the employee can’t skip it in Setup Assistant.
Users can’t remove MDM enrollment, except during the 30-day provisional period for Macs added with Apple Configurator.
The Mac is supervised, which some device policy settings require, such as external drive controls and automatic update settings.
Setup Assistant keeps all of its screens, and the employee reaches the desktop while Oneleet configures the Mac in the background.

Set up a Mac

When an assigned Mac runs Setup Assistant, it shows a Remote Management screen and enrolls in Oneleet MDM. The employee continues setup as usual. The Mac needs internet access during setup to reach Apple and Oneleet.

A Mac that’s already set up and assigned to Oneleet in Apple Business Manager doesn’t need to be erased. Open Terminal on the Mac, run the following command, and approve the enrollment when macOS asks:

sudo profiles renew -type enrollment

To confirm the Mac enrolled, open it in Devices and look for MDM profile installed in its Activity tab. The Oneleet Agent then installs automatically, and Oneleet Agent connected in the same tab confirms it’s reporting.

On the ADE Devices tab, Connected only means a device with the Mac’s serial number is in Devices. A Mac that has the Oneleet Agent but isn’t enrolled yet also shows Connected, so don’t rely on it to confirm enrollment.

Renew the server token

Apple Business Manager server tokens are valid for a year. The ADE connection card marks the token Expiring soon in its last 30 days and Expired after that, and Oneleet sends renewal reminders before then. While the token is expired, Oneleet can’t sync your inventory or assign the enrollment profile, so you can’t prepare new Macs for automatic enrollment.

On the ADE Devices tab, open the ADE connection card and click Renew token.
In Apple Business Manager, open the MDM server you created for Oneleet and download a new server token.
Upload the new .p7m file on the ADE Devices tab and click Upload new token.

Validation issue on the card means Oneleet couldn’t validate the token with Apple. Renew the token the same way to reconnect.

Stop managing a Mac

To end Oneleet’s management of an enrolled Mac, use Remove from MDM. That doesn’t change Apple Business Manager. A Mac that’s still assigned to Oneleet there can enroll again the next time it runs Setup Assistant, for example after it’s erased. To keep a Mac out of Oneleet MDM for good, also unassign it from Oneleet’s server or release it in Apple Business Manager.

A Mac that’s no longer assigned to Oneleet’s server in Apple Business Manager shows Removed after the next sync. The inventory hides these Macs until you choose Removed in the Connection filter. Unassigning a Mac doesn’t unenroll it if it’s already managed.

Apple’s 30-day provisional period

A Mac added to Apple Business Manager with Apple Configurator, rather than bought through it, starts with a 30-day provisional period. For 30 days after it’s assigned and enrolled, the person using it can release it from Apple Business Manager, supervision, and device management. After that, it can’t be released from the Mac and behaves like any other Apple Business Manager device.

Macs your company bought through Apple Business Manager don’t have this period. Apple explains how it works in Add devices using Apple Configurator to Apple Business.

Troubleshooting

A Mac doesn’t appear in the inventory. Check that it’s assigned to Oneleet’s MDM server in Apple Business Manager, then click Sync now.
The last ADE sync failed. The callout shows the error from the last sync. An expired or invalid token is the usual cause, so renew the token.
A Mac finished setup without the Remote Management screen. The profile wasn’t assigned before setup started. Assign the profile, then run sudo profiles renew -type enrollment on the Mac.
A Mac shows Remote Management but can’t enroll. Its profile was assigned more than 30 days ago. Assign the profile again, then retry enrollment on the Mac.
A Mac belongs to another Oneleet workspace. It can’t enroll in yours until an admin of that workspace removes it. If you can’t reach them, contact Oneleet support.