Set up Apple MDM

Before any Mac can enroll in Oneleet MDM, connect your workspace to Apple Push Notification service with an Apple MDM push certificate. Oneleet uses the certificate to reach your Macs whenever it has a command for them. You set it up once for your workspace, and it covers both Apple Business Manager enrollment and manual enrollment.

Workspace admins can set up Apple MDM once Oneleet MDM is enabled for the workspace. You’ll also need a company Apple Account to sign in to Apple’s push certificate portal. Use an account your company controls rather than someone’s personal one, because renewing the certificate later requires the same account.

Create the push certificate

1. In the Oneleet Dashboard, go to Devices and open the Apple MDM Setup tab.
2. Enter your company’s legal name, its country of operation, and an administrative email address, then click Generate CSR. Your browser downloads the Oneleet certificate signing request (CSR) file.
3. Sign in to the Apple Push Certificates Portal with your company Apple Account.
4. Click Create a Certificate. If Apple asks you to accept its Terms of Use, click Accept.
5. Click Choose File, select the Oneleet CSR file, and click Upload.
6. Click Download to download the new certificate.
7. Back on the Apple MDM Setup tab, upload the certificate and click Upload certificate.

Upload the certificate created from this workspace’s CSR. A push certificate that’s already registered to another workspace can’t be reused here, but renewing it for the same workspace still works.

Once the certificate is uploaded, the tab shows when it expires instead of the setup steps. You can now enroll your Macs.

Oneleet puts your legal company name and the administrative email on the enrollment profile it assigns through Apple Business Manager, as the profile’s department and support email.

Renew the push certificate

Apple push certificates are valid for a year. The Apple MDM Setup tab marks yours Expiring soon in its last 30 days, and Oneleet sends renewal reminders before then. If it expires, Oneleet MDM can’t reach any of your Macs. Apple only allows renewing for a limited time after expiry, and after that every Mac has to enroll again.

Caution

Renew the existing certificate in Apple’s portal. Don’t create a new one. A new certificate has a different push topic, so every enrolled Mac would have to enroll again.

1. On the Apple MDM Setup tab, click Renew certificate.
2. In the first step, click Generate CSR to download a new CSR file.
3. Sign in to the Apple Push Certificates Portal with the same Apple Account that created your current certificate.
4. Find your current Oneleet MDM certificate in the list and click Renew.
5. Upload the new CSR file, then download the renewed certificate.
6. Upload the renewed certificate in the last step on the Apple MDM Setup tab.

Renewal reminders

Oneleet relies on two Apple credentials that expire and have to be renewed by hand:

Credential	Where you renew it
Apple MDM push certificate	Apple Push Certificates Portal
Apple Business Manager server token	Apple Business Manager

You only have a server token if you connected Apple Business Manager.

Oneleet emails your workspace admins 60, 30, and 7 days before either one expires, and also sends a Slack direct message to admins who have Slack notifications enabled. Each reminder links to the Apple portal where that credential is renewed and states the number of days actually left, so a reminder that’s sent late still arrives. After you renew a credential at Apple, upload the new one in Devices to finish the rotation. See Renew the server token for the Apple Business Manager steps.

Admins can turn these reminders off for themselves under Devices in their notification preferences.