Category Filter

How to lock MDM profile on Mac devices?

Automatic device enrollment through Apple DEP allows organizations to enroll Apple devices in an MDM solution automatically. The configuration profile associated with the devices during DEP enrollment allows configurations to be deployed right out-of-the-box. Thus, ongoing device management is possible only as long as the MDM profile remains on the device. If a user removes the MDM profile from the device manually, administrators will not be able to manage it. You can lock the MDM profile on to the device by making it non-removable from the Hexnode console.


MDM profile removal can be prevented only on macOS devices enrolled via Apple DEP.

Prevent MDM profile removal

To prevent users from removing the MDM profile, enroll the devices via Apple DEP. On the DEP policy (Admin > Apple Business/School Manager > Apple DEP > DEP Configuration Profiles), uncheck the option “Allow MDM profile removal”. Disabling this option locks the MDM profile on to the device and the users will not be able to manually remove the MDM profile from the device. Associating this DEP policy with the enrolling devices installs a non-removable MDM profile on the device.
prevent MDM profile removal

  1. On your Hexnode MDM portal, navigate to Admin > Apple Business/School Manager > Apple DEP.
  2. Select DEP Configuration Profiles > Configure DEP Profile.
  3. Disable the option Allow MDM Profile Removal.
  4. Click Save.

lock mdm profile

Selecting this profile as the Default Policy while configuring the DEP account associated with your devices will prevent MDM profile removal.