Best practices for enrolling MacBooks in Hexnode MDMSolved

Hi @everlycole ,

For macOS, the required post-enrollment steps depend on the enrollment method and the management capabilities you plan to use.

For manual enrollment, the general flow is:

1. Open the Hexnode UEM enrollment page in Safari and download the MDM profile.
2. Go to System Settings > Privacy & Security, open the downloaded profile, and install it.
3. Complete the macOS profile installation prompts.
4. If prompted, approve Hexnode UEM-related system extensions or background services from Privacy & Security.
5. Grant Full Disk Access to the Hexnode UEM agent if prompted. This is required for the agent to perform functions that need broader access to local system data.

Secure Token is not required just to complete basic MDM enrollment. However, it is recommended in corporate deployments because Secure Token is tied to important macOS security workflows, especially FileVault and certain local account authorization scenarios. If the Mac is expected to use FileVault or managed local account workflows, make sure the relevant local account has a Secure Token.

For company-owned MacBooks, Automated Device Enrollment through Apple Business is usually the best practice. With ADE, devices can enroll automatically during Setup Assistant, and the MDM profile can be made non-removable by the user. This provides a more reliable zero-touch deployment experience than manual enrollment.

Regards,
Isabel Lora
Hexnode UEM