# How to Enroll Mac Devices in Hexnode UEM Hexnode UEM is a Unified Endpoint Management platform that lets administrators enroll, secure, restrict, and manage macOS devices from the Hexnode portal. macOS enrollment installs an MDM profile on the Mac and establishes communication between the device, the Hexnode UEM server, and Apple Push Notification service (APNs). This guide explains the supported macOS enrollment methods in Hexnode UEM, including Open Enrollment, Authenticated Enrollment through Email or SMS, Self Enrollment, and links to zero-touch or automated enrollment options. Use these workflows for corporate-owned Macs, BYOD deployments, directory-authenticated users, or migration scenarios where the device must be brought under management without removing existing user data. After enrollment, the Mac is associated with the specified user and the chsownership type, allowing administrators to apply policies, restrictions, and remote management actions based on the organization’s requirements. Prerequisites for macOS Enrollment in Hexnode UEM ------------------------------------------------- Complete the following requirements before enrolling macOS devices in Hexnode UEM: - **APNs configuration:** Ensure that you have successfully [configured the APNs certificate](https://www.hexnode.com/mobile-device-management/help/apns-settings/) in your Hexnode UEM server. APNs is mandatory for communicating with macOS devices. - **macOS version support:** Hexnode UEM supports devices running macOS 10.7 and later. Available macOS Enrollment Methods in Hexnode UEM ------------------------------------------------- Hexnode UEM supports multiple macOS enrollment workflows. Select the method based on deployment scale, security requirements, ownership model, and the level of user involvement required during enrollment. - [Authenticated Enrollment](#method-2-authenticated-enrollment-credential-required) with user or admin-provided credentials. - [Email or SMS Enrollment](#sub-method-a-email-or-sms-enrollment-enrollment-request) using an enrollment request. - [Self Enrollment](#sub-method-b-self-enrollment) using directory credentials or configured Hexnode credentials. - Zero-touch or automated enrollment options for macOS: - [ADE enrollment](https://www.hexnode.com/mobile-device-management/help/enrollment-of-apple-devices-through-dep/) - [ADE enrollment via Apple Configurator](https://www.hexnode.com/mobile-device-management/help/add-macos-devices-to-abm-using-apple-configurator/) - [Google Workspace Enrollment for Mac](https://www.hexnode.com/mobile-device-management/help/g-suite-enrollment-for-macos-devices-a-workaround/) **Note:** While enrolling the device, configure Parental Controls on the Mac if required by your policy. This must be done manually on the device from **System Preferences > Users & Groups > Enable parental controls**. Method 2: Enroll macOS Devices Using Authenticated Enrollment ------------------------------------------------------------- Authenticated Enrollment requires the user to provide credentials before the MDM profile is downloaded and installed. In Hexnode UEM, authenticated enrollment for macOS includes Email or SMS Enrollment using generated enrollment credentials and Self Enrollment using directory or configured user credentials. ### Sub-Method A: Email or SMS Enrollment Using an Enrollment Request Email or SMS Enrollment authenticates the user with credentials either generated by Hexnode UEM and delivered through an enrollment request, or using the directory-based user’s credentials. Use this method when administrators need to invite specific users to enroll their Mac and control how the enrollment credentials are distributed. ### Configure Email or SMS Enrollment in the Hexnode UEM Portal 1. Navigate to **Enroll > Platform Specific > macOS > Email or SMS**. 2. Click **Switch to Authenticated Enrollment > Authenticated Enrollment**. 3. Select **Enrollment Request** as the enrollment type. 4. Set the **Ownership** option. 5. Click **Next**. A success message will be displayed. 6. Select the checkbox for **Email** or **SMS** based on the required delivery method. 7. Change the **Domain** and select the specific **User** to enroll. 8. Click **Send**. ### Complete Email or SMS Enrollment on the Mac 1. Open the **Safari** browser and enter the enrollment URL. 2. Click **Enroll**. 3. Enter the unique **username** and **password** received in the enrollment request email or SMS. 4. Click **Authenticate**. The MDM profile will be downloaded. 5. Click **Continue**, and then click **Install** to install the profile. 6. Enter the Mac administrator’s **username** and **password**. ### Sub-Method B: Self Enrollment for macOS Devices Self Enrollment allows users to enroll their Mac using existing credentials, such as Active Directory, Microsoft Entra ID, Google, or Okta credentials, or by using a common default password configured for enrollment. This method is useful when users are expected to initiate enrollment independently while still authenticating before the MDM profile is installed. ### Configure Self Enrollment in the Hexnode UEM Portal 1. Go to **Enroll > Platform Specific > macOS > Email or SMS**. 2. Click **Switch to Authenticated Enrollment > Authenticated Enrollment**. 3. Select **Self Enrollment** as the enrollment type. 4. Set the **Ownership** option. 5. Click **Next**. A success message will be displayed. ### Complete Self Enrollment on the Mac 1. Open the **Safari** browser and enter the enrollment URL. 2. Click **Enroll**. 3. Select the **domain**. 4. Enter your directory-specific **username** and **password**. 5. Click **Authenticate**. 6. Click **Continue**, and then click **Install** to install the profile. 7. Enter the Mac administrator’s **username** and **password**. Troubleshooting macOS Enrollment Errors --------------------------------------- ### Enrollment URL is inaccessible **Symptom:** The user is unable to access the enrollment URL provided through email or SMS. **Cause:** The Hexnode UEM server may be blocked from reaching the device. This is most commonly caused by strict local firewall settings on the Mac that prevent incoming connections required during enrollment. **Solution:** Temporarily adjust the device’s firewall settings to allow the required connections: 1. Go to **System Preferences** or **System Settings** > **Security & Privacy > Firewall**. 2. Click **Firewall Options**. 3. Uncheck **Block all incoming connections**. 4. Click **OK** and try enrolling the device again. ### Network connection error during profile installation **Symptom:** During MDM profile installation, the following error appears: *Profile installation failed. Network connection was lost.* **Cause:** The device cannot validate the MDM server’s SSL certificate, which is required for secure profile installation. This failure is usually caused by inaccurate **date and time settings** on the Mac. **Solution:** - **Time sync:** Ensure that the **date and time settings** on the Mac are accurate and synchronized with a reliable network time server. - **Persistent error:** If the error continues after correcting the time, the operating system integrity may be affected. In this rare case, activate the device’s **Recovery Mode** and perform an **OS restore** to resolve core system issues.