Category Filter

G Suite Enrollment for macOS Devices

Hexnode MDM allows you to assign macOS devices to G Suite users. You need to initially configure G Suite with the MDM console, followed by enrolling the devices.The enrolled macOS devices will get assigned to the respective G Suite users. Policies and actions can be associated to the devices, users or whole domain from the Hexnode MDM console to manage and monitor the utilization of these devices.

To Assign the devices to G Suite Users

  1. Configure G Suite.
  2. Enroll macOS devices via G Suite Authentication.

To Configure G Suite

Note:

Your Organization should have a G Suite Account.


Create Service Account

Creating Service Account
  1. Using the G Suite admin credential, login to Google Developers Console.
  2. Click on Create Project.
  3. Create a New Project by providing the following details.
    • Project Name: Provide a suitable project name and a corresponding project ID will be generated.
  4. From the Navigation Menu on the left pane, select APIs & Services > Credentials.
  5. Click on Create Credentials and from the drop-down list that appears select Service account key.
  6. Select New service account and provide the following details.
    • Service account name: Provide a suitable name for the service account.
    • Service account ID: Provide a suitable ID for the service account.
    • Role: From the drop-down list select Service Accounts > Service Account Admin.
  7. Select the Key type as JSON and click on Create.
  8. A JSON key will be downloaded. This key is later uploaded on to Hexnode MDM Console.
  9. From Navigation menu > IAM & admin > Service accounts. Select your service account and click on Edit.
  10. Select the checkbox Enable G Suite Domain-wide Delegation and provide the Product name for the consent screen and click on Save.
  11. Click on View Client ID.
  12. Copy the Client ID.
  13. From the Navigation menu select Dashboard and click on Enable APIs and Services.
  14. In the search box that appears, type admin sdk and select the same from the search results.
  15. Click on Enable to enable Admin SDK API.

Manage API Client Access for MDM

This process provides the MDM with a specific API access to apply the configurations to the managed devices. Ensure to Enable API access in the Admin console.

Manage API Client Access for MDM
  1. Using your G Suite Admin credentials, login to Google Admin Console and click on Security.
  2. From Advanced Settings > select Manage API client access.
  3. Authorize the API clients by providing the following details.
    • Client Name: Paste the Client ID copied previously.
    • One or More API Scopes: Copy and paste the link
      • https://www.googleapis.com/auth/admin.directory.user – To sync individual users.
      • https://www.googleapis.com/auth/admin.directory.group – To sync user groups.
    • Click on Authorize.

Integration of G Suite with Hexnode MDM Server

  1. Login to your Hexnode MDM portal.
  2. Navigate to Admin > G Suite.
  3. You will have the following options to be configured.

    G Suite macOS Management - Hexnode MDM Portal
    • G Suite Admin Email: Provide the Administrator email address of the G Suite account.
    • Domain Name: Provide the domain name to be managed by the Administrator.
    • G Suite key: Upload the JSON key previously downloaded.
  4. Click on Save to configure G Suite.

Enroll macOS devices via G Suite Authentication.

Once the G Suite account is configured, you can start enrolling your macOS devices with Hexnode MDM.

  1. Go to Enroll > Platform-Specific > macOS > Email or SMS.
  2. Switch the authentication mode to Authenticated Enrollment.
  3. Select Google User under Enrollment Request or Self Enrollment.
    • If you select Google User under Enrollment Request, users will receive an email or SMS with the Hexnode server address and other enrollment instructions.
    • If Google User under Self Enrollment is selected no such request will be sent. Users have to enroll devices with their dedicated credentials.
  4. Change the device Ownership if required.
  5. Click on Next.

If you have chosen Self Enrollment, your enrollment set up is complete.
But if you have chosen to send Enrollment Request to your G Suite users follow these steps,

  1. Select a medium to send the request (Email/SMS).
  2. Change the Domain from Local to your G Suite domain.
  3. Select the user to whom you want to send the enrollment request and click Save.


On the device,

  1. Open the Safari Browser and enter the enrollment URL, it will be of the form: https://portalname.hexnodemdm.com/enroll/.
  2. This would take you to the enrollment screen. Enable the checkbox to agree with the terms and conditions and click Enroll.
  3. Enter the user’s G Suite username and password.
  4. Click Authenticate. The MDM profile gets downloaded.
  5. To install the MDM profiles click Continue and click Install.
  6. Enter the Mac administrator’s username and password.

The profiles will install and the device will get enrolled in Hexnode MDM.