Enroll a Mac manually

Manual enrollment puts a Mac that’s already set up under Oneleet MDM by installing the Oneleet MDM enrollment profile on it. Anyone with an administrator account on the Mac can remove this profile in System Settings, which ends Oneleet’s management.

Use manual enrollment for Macs that aren’t in Apple Business Manager. For Macs that are, enroll them through Apple Business Manager instead.

Before you start:

• Set up Apple MDM for your workspace. The Oneleet Portal only offers the enrollment profile while your push certificate is valid.
• Make sure someone with an administrator account on the Mac is available. Installing the profile asks for an administrator’s password.
• Check that the Mac isn’t enrolled in another MDM. A Mac can be enrolled in only one, so remove the other MDM’s enrollment first. Spot Macs managed by another MDM shows which Macs those are.

Download the enrollment profile

1. On a Mac, open the Oneleet Portal and go to Devices.
2. Click Install Oneleet Agent, or Connect another device if a device is already set up.
3. Under Apple MDM profile, click Download MDM profile. The browser saves a file named enroll.mobileconfig.

The portal only shows the Apple MDM profile section when it detects that you’re on a Mac, so use a Mac to download it. Admins can open the same page from the Oneleet Dashboard by clicking Connect new device on the Devices page. If you’re enrolling a Mac for an employee, you can download the profile on your own Mac and copy it to theirs.

The portal marks the profile Optional, because the Oneleet Agent works without MDM. Tell employees when you want their Macs enrolled, so they don’t skip it.

Install the profile

1. On the Mac, double-click enroll.mobileconfig. macOS adds it to System Settings for review.
2. Open System Settings and go to General > Device Management. On older macOS versions, go to Privacy & Security > Profiles.
3. Select Oneleet MDM Enrollment and click Install.
4. Approve the remote management prompt, and enter an administrator’s password when asked.

The Mac needs internet access while it enrolls, so it can reach Apple and Oneleet.

Check that the Mac enrolled

In the Oneleet Dashboard, open Devices. The Mac shows the Managed badge, and its Activity tab records MDM profile installed, followed by MDM ready to receive commands once Oneleet can send it commands.

You don’t need to install the agent separately. The Oneleet Agent installs automatically within a few minutes and connects itself to your workspace. Look for Oneleet Agent connected in the Mac’s Activity tab.

Limits of manual enrollment

• Anyone with an administrator account on the Mac can remove the enrollment profile in System Settings, which ends Oneleet’s management. The activity log records MDM profile removed, and the MDM enrollment filter’s Unenrolled (Mac) option finds these Macs.
• Erasing the Mac removes the enrollment. Enroll it again after it’s set up.
• A Mac that belongs to another Oneleet workspace can’t enroll in yours until an admin of that workspace removes it. If you can’t reach them, contact Oneleet support.

To end management on purpose, use Remove from MDM rather than removing the profile on the Mac, so the request is recorded in the Mac’s activity log.