# Getting started with macOS device management macOS is a series of graphical operating systems developed for Apple’s Mac family of computers. To get started with macOS management in an enterprise environment, Hexnode UEM offers a comprehensive suite of tools ranging from zero-touch enrollment to advanced security configurations. This guide outlines the essential steps to configure, secure, and manage Mac devices effectively. Enrollment & Onboarding ---------------------------- The first step to get started with macOS management is bringing devices under corporate control. - **Prerequisite**: [**APNs Configuration**](https://www.hexnode.com/mobile-device-management/help/apns-settings/), before [enrollment](https://www.hexnode.com/mobile-device-management/help/enroll-mac-devices-hexnode-mdm/), you must configure the Apple Push Notification service (APNs) certificate. This certificate acts as the trust bridge between Hexnode MDM and Apple devices. - ***Action***: Ensure a valid APNs certificate is uploaded to the Hexnode portal. - **[Device Enrollment Program (DEP) ](https://www.hexnode.com/mobile-device-management/help/enrollment-of-apple-devices-through-dep/)/ Apple Business Manager (ABM)**: For the most streamlined experience, use Apple’s Automated Device Enrollment (ADE) (formerly DEP). This allows for over-the-air supervision and mandatory management. - ***Benefit***: Enables “zero-touch” configuration where settings are applied immediately upon device activation. Security & Restrictions ---------------------------- Once enrolled, securing the device ecosystem is critical. - **[Configure Restrictions](https://www.hexnode.com/mobile-device-management/help/macos-mdm-restrictions/)**: Hexnode UEM allows administrators to disable specific hardware or software features to ensure compliance. - ***Examples***: Disable camera, restrict iCloud sync, or block USB media. - **[Prevent MDM Profile Removal](https://www.hexnode.com/mobile-device-management/help/how-to-lock-mdm-profile-on-mac-devices/)** - ***Requirement***: Devices must be enrolled via Apple ADE. - ***Function***: Prevents users from manually removing the management profile, ensuring permanent supervision. - **[Bypass Activation Lock](https://www.hexnode.com/mobile-device-management/help/mdm-bypass-activation-lock/)**: If a device is lost or an employee leaves without unlocking their Mac, Activation Lock can render the device useless. - **Solution**: Hexnode allows admins to remotely bypass Activation Lock to reclaim the device for new users. Application Management ----------------------- Efficiently deploy and manage software without user intervention. - **[Silent App Installation (VPP)](https://www.hexnode.com/mobile-device-management/help/how-to-install-apps-silently-in-macos-devices-using-hexnode-mdm/)**: Integrate with Apple’s Volume Purchase Program (VPP) (now part of Apple Business Manager). - ***Capability***: Push apps silently to devices. Users do not need to interact with the App Store or enter an Apple ID. Network & Web Security --------------------------- Secure the communication channels used by your workforce. - **Network Configurations**: Push pre-configured settings so users connect automatically to secure networks. Supported configurations include: - **[Wi-Fi](https://www.hexnode.com/mobile-device-management/help/set-up-wifi-on-macos-using-hexnode-mdm/) & [VPN](https://www.hexnode.com/mobile-device-management/help/configure-vpn-on-macos-using-hexnode-mdm/)**: Auto-join corporate networks. - **[Email](https://www.hexnode.com/mobile-device-management/help/add-email-accounts-to-macos-using-hexnode-mdm/) & [Exchange ActiveSync](https://www.hexnode.com/mobile-device-management/help/configure-exchange-activesync-on-macos-with-hexnode-mdm/)**: Pre-populate corporate email settings. - **Directory Services**: [LDAP](https://www.hexnode.com/mobile-device-management/help/configure-ldap-for-macos-using-hexnode-mdm/), [CalDAV](https://www.hexnode.com/mobile-device-management/help/configure-caldav-on-macos-using-hexnode-mdm/), and [CardDAV](https://www.hexnode.com/mobile-device-management/help/how-to-configure-carddav-settings-on-macos-using-hexnode-mdm/) integration. - **[Web Content Filtering](https://www.hexnode.com/mobile-device-management/help/how-to-set-up-web-content-filtering-for-mac-using-hexnode-mdm/)**: Control internet access by allowing or blocking specific URLs. - ***Use Case***: Allowlist only business-critical sites to improve productivity and security. Data Protection (Encryption) ----------------------------- Protect sensitive corporate data at rest. - **[FileVault Management](https://www.hexnode.com/mobile-device-management/help/how-to-manage-filevault-with-hexnode-mdm/)**: Enforce full-disk encryption using FileVault. - ***Function***: Prevents unauthorized data access by encrypting the startup disk. Hexnode can escrow personal recovery keys to ensure data is recoverable by IT if a user forgets their password. Personalization & User Experience -------------------------------------- Customize the look and feel of the macOS environment to match company branding. - **[Login Window Preferences](https://www.hexnode.com/mobile-device-management/help/how-to-configure-login-window-settings-for-macos-devices-using-hexnode-mdm/)**: Customize banners, disclaimer text, and restart/shutdown options. - **[Dock Preferences](https://www.hexnode.com/mobile-device-management/help/how-to-customize-macs-dock-using-hexnode-mdm/)**: Set dock size, position, and animation settings remotely. - **[Setup Assistant](https://www.hexnode.com/mobile-device-management/help/how-to-configure-setup-assistant-for-macos-devices-using-hexnode-mdm/)**: Skip specific setup screens (e.g., Siri setup, Apple ID sign-in) during the initial boot to speed up user onboarding. - **[Screensaver Policies](https://www.hexnode.com/mobile-device-management/help/how-to-configure-screensaver-for-macos-devices-using-hexnode-mdm/)**: remotely deploy and enforce corporate screensavers. Troubleshooting Common macOS Management Issues ----------------------------------------------- When you get started with macOS management, you may encounter these common hurdles. ### 1: MDM Profile Fails to Install **Cause**: The APNs certificate may be expired or invalid. **Fix**: Navigate to the ***Admin*** tab and renew the APNs certificate. Do not create a new one; renew the existing one to maintain connections with currently enrolled devices. ### 2: Apps Are Not Installing Silently **Cause**: The device is not Supervised, or the VPP token has expired. **Fix**: Ensure the device was enrolled via ADE (making it Supervised) and check that your VPP token in Hexnode is active and synced with Apple Business Manager. ### 3: Cannot Prevent MDM Removal **Cause**: The device was enrolled manually via a web link/QR code rather than through Apple ADE. **Fix**: To make MDM removal non-removable, the device must be wiped and re-enrolled using the Automated Device Enrollment method.