Onboarding Options for macOS: Workspace ONE Operational Tutorial

Overview

Omnissa Workspace ONE® UEM provides a comprehensive management solution for macOS devices, supporting macOS 10.15 and later. With the ability to manage Corporate-Dedicated, Corporate Owned, or Employee Owned (BYOD) devices, Workspace ONE UEM offers enterprises the flexibility to meet their employees’ needs at any level.

For organizations to take full advantage of the management options offered by Workspace ONE UEM, macOS devices need to be onboarded and enrolled. Enrollment is required before a device can receive profiles, applications, and access internal content and resources. There are several enrollment workflows available to IT admins, such as Hub-based enrollment, staging enrollment, automated enrollment, and web-based enrollment. IT admins will need to select the right workflow for their specific enrollment requirements. An organization will likely require multiple workflows to cover varying device scenarios, such as single user corporate-owned devices, BYO devices, and shared corporate devices.

Purpose of This Tutorial

This tutorial discusses the different enrollment workflows available in Workspace ONE UEM, and provides IT admins with the knowledge required to make informed decisions about macOS device onboarding. The following topics are presented:

  • Enrollment user types
  • Overview of enrollment workflows
  • Hub-based enrollment
  • Web-based enrollment
  • Staging enrollment
  • Automated enrollment

For more information about Workspace ONE UEM and macOS management, see Omnissa’s product documentation. You can also find additional operational tutorials and videos on techzone.omnissa.com.

Audience

This operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments. 

Both current and new administrators can benefit from using this tutorial. Familiarity with macOS is assumed.

Knowledge of additional technologies such as Omnissa Intelligence and Omnissa Workspace ONE® UEM is also helpful.

Understanding macOS Enrollment

  This section will provide a fundamental overview of the macOS enrollment processes available in Workspace ONE UEM. It will discuss the four methods of enrollment available, as well as the macOS user types.

Understanding macOS User Types

Prior to discussing the various enrollment methods, it is important to understand the different user types involved in the enrollment process. All macOS devices support a number of discrete user accounts (each with their own data and settings). Although macOS is an inherently multi-user system, the mdmclient process built-in to macOS (leveraged by Workspace ONE UEM) is not multi-user capable unless the device is bound to a directory service (such as Active Directory). When discussing enrollment methods, there are three distinct user types that must be defined.

Workspace ONE UEM Enrollment User - This is the user account that Workspace ONE uses to determine membership within assignment groups, and to whom the device is assigned.

  • If a device is not being staged, this is a user account (either basic or directory-based) within Workspace ONE UEM (under Accounts > Users > List View) whose credentials were entered at the time the device was enrolled.
  • If staging a device, this is the user account to which the device is assigned within Workspace ONE UEM (under Devices > Details View > User).

macOS Logged-On User - This is a user account (either local to macOS or based on a directory service such as Active Directory) that is currently logged-on and active on the device.

Workspace ONE Managed User - This is the user account (either local to macOS or from a network account server) that was logged-on and active on the device when enrollment occurred. This account must be logged-on within macOS in order for Workspace ONE to deliver items assigned to the Workspace ONE UEM enrollment user. Workspace ONE UEM can also target this account using Apple Push Notifications when it is also the logged-on user.

Workspace ONE Enrollment Methods

Before a device can be managed, it must be enrolled in your organization’s Workspace ONE UEM instance. Enrollment allows IT admins to push user and device profiles that configure macOS to meet corporate standards, provide and secure access to internal content and resources, deliver applications to devices, monitor security and device compliance, as well as many other tasks.

Workspace ONE UEM offers four methods for device enrollment.

  • Hub-based Enrollment
  • Staging Enrollment
  • Automated Enrollment
  • Web-based Enrollment

Which method is the most appropriate can be dependent on the type of device you are enrolling: corporate-dedicated, corporate-shared, or employee-owned (BYOD).

Corporate-Dedicated – This is a corporate-owned device provided to and intended to be used by a single user.

Corporate-Shared – This is a corporate-owned device that is configured to be shared among multiple users. For instance, a device used by frontline workers in a retail location.

Employee Owned (BYOD) – A personal device owned by the employee, not the corporation. This device might contain personal user data, apps, and photographs that the corporation should not have access to.

Hub-based Enrollment

Hub-based enrollment utilizes the Workspace ONE Intelligent Hub to initiate the enrollment process. This type of enrollment is often called user-initiated device enrollment because the end user must initiate and approve the enrollment process. Hub-based enrollment is most often associated with employee-owned (BYOD) devices.

With Hub-based enrollment, the macOS device is enrolled with the Workspace ONE UEM user’s credentials (enrollment user). The currently logged in macOS user (logged-on user) becomes the Workspace ONE managed user. Profiles and applications assigned to the user only apply when that specific macOS user is logged in. If the managed user logs out of the device and another macOS user logs in, Workspace ONE will not apply any user-specific items to that new logged-in user. User profiles will not be applied to the device until the managed user logs in again.

Note: The single local user limitation is defined within the Apple MDM protocol. The local user that installed the MDM profile will be managed, but no other local user will be managed.

Staging Enrollment

Staging enrollment allows IT admins to prepare corporate-owned macOS devices and assign them to the appropriate users in Workspace ONE UEM prior to end users receiving the device. This process is ideal for admins who must deploy a fleet of macOS devices.

There are two types of staging enrollments available to IT admins: single-user staging and multi-user staging.

Single-User Staging

With single-user staging, IT admins can provision a device that will be used by a single user. Single-user staging requires either the macOS device to be LDAP-bound or pre-registered in Workspace ONE UEM.

In an LDAP-bound scenario, Workspace ONE UEM receives a message at a network user’s login event. This notification allows Workspace ONE to correlate the newly logged-in user (a network user in macOS) to the enrollment user. Because the network account in macOS and Workspace ONE UEM are known to be the same (as they are both originating from the same source; LDAP), Workspace ONE UEM can change the managed user to be the new logged-on user.

In single-user staging scenarios, Workspace ONE UEM associates the device to the enrollment user only for the first network user login (for example, the managed user). Subsequent network user login events are ignored, and the assigned user for the device is not modified. This means that any user-based assignments (user-level profiles and apps) are only sent to macOS when the managed user (matching the enrollment user) is logged in to the device.

Note: If a domain-bound macOS device is enrolled but not receiving user profiles/configurations, the logged-in user in macOS may not be the Workspace ONE UEM managed user.

In a device pre-registration scenario where LDAP binding is not being used, the only user account that can be managed by Workspace ONE UEM is the local user that installs the enrollment profile. Any staging scenario without LDAP binding must ensure the local macOS user account that installs the enrollment profile is the local macOS user account the end-user will be using. IT admins can enroll devices and assign them to users without needing to know the end user’s domain credentials by pre-registering a user to a device manually or through bulk import. The device can be delivered to the end user with only a known set of local macOS login credentials.

Multi-User Staging

With multi-user staging, IT admins can provision devices that will be shared by multiple users, such as point-of-sale devices in retail or devices used by shift-based healthcare workers. Workspace ONE UEM dynamically changes the assigned user of the device each time a different network user logs in.

In multi-user staging scenarios, Workspace ONE UEM associates the device to a new enrollment user each time a network-based user account logs in (for example, the managed user). With each network user login, Workspace ONE UEM modifies the enrollment user to match the newly logged-in user account. As such, Workspace ONE UEM sends any apps and configurations assigned to the newly logged-in user.

Note: Multi-user staging is dependent on both the staging user configuration and the domain bind.

Automated Enrollment

Automated Device Enrollment makes large-scale deployments of Apple devices easier with over-the-air setup and configuration, eliminating the need for staging services or physically accessing each device. IT admins can stage devices through Apple Business Manager using Automated Device Enrollment (previously known as Device Enrollment Program). Automated Device Enrollment offers IT admins the ability to customize the Apple Setup Assistant, enforce enrollment of devices, and streamline the enrollment process for end users. A non-removable MDM profile can be installed on devices, and macOS devices enrolled through Apple Business Manager can be provisioned in supervised mode, providing additional security and configuration options.

For devices to be eligible for Automated Device Enrollment, they must be purchased from one of the following channels:

  • Directly from Apple
  • Participating Apple Authorized Resellers
  • Cellular carriers

Alternatively, you can add a device to Apple Business Manager using Apple Configurator. For instructions on how to manually add devices to Apple Business Manager with Apple Configurator, see the Apple Business Manager User Guide.

For more information on configuring Automated Device Enrollment in your Workspace ONE UEM environment, see Using Apple Automated Device Enrollment with Workspace ONE UEM on Omnissa Tech Zone.

 Web-based Enrollment

The web-based enrollment workflow is similar to that of the hub-based enrollment. The exception being that instead of initiating the enrollment process through Intelligent Hub, the user begins by navigating to https://<mdmenrollment.url.com>/enrollment in a web browser (where mdmenrollment.url.com is the fully qualified domain name for your Workspace ONE UEM MDM enrollment URL).

Like hub-based enrollment, web-based enrollment requires the end user to acknowledge and approve the device management.

Enrollment Workflows

This section discusses the workflows associated with the previously mentioned enrollment methods. It outlines the prerequisites for each method, as well as provide a high-level overview of the workflow itself. This is not meant to be step-by-step instructional material and is more focused on providing you with an understanding of how the workflows work and the distinctive differences between them. This section breaks down the workflows into three categories: user-initiated enrollment, single-user staging enrollment, and multi-user staging enrollment.

Prerequisites

You must meet the following prerequisites, before configuring any type of macOS enrollment workflow:

  1. To manage an Apple device with Workspace ONE UEM, you must  generate an APNS certificate for your Workspace ONE UEM environment.
  2.  Create a basic user account or directory user account to Workspace ONE UEM as enrollment ties a device to an enrollment user account.
  3. To enable  Device Enrollment integration, you must sign up for an Apple Business Manager (or Apple School Manager) account.
  4. To enroll devices using Apple Business Manager or Apple School Manager, you must perform the following:

User-Initiated Enrollment

As explained earlier, hub-based enrollment and web-based enrollment are both considered user-initiated enrollment types because the end user initiates the enrollment process either by downloading the Intelligent Hub app or visiting your Workspace ONE UEM MDM enrollment URL. User-initiated enrollments are most often associated with employee-owned devices (BYOD). Although it is possible to allow this type of enrollment for corporate-owned devices, it creates more risk in that this method relies on the end user not only performing the initial enrollment but also keeping the device enrolled. With user-initiated enrollment, the user has the option to unenroll the device at their leisure, placing corporate-owned devices at risk.

 Enrollment with macOS Intelligent Hub

The hub-based enrollment process establishes a secure connection between the macOS device and your Workspace ONE UEM instance.

  1. To begin enrollment using the macOS Intelligent Hub, the end user must first download the Workspace ONE Intelligent Hub installer from https://getwsone.com.

    Note: The macOS logged-on user must be an admin account on the macOS device.
  2. Once installed on the macOS device, Intelligent Hub will launch automatically and prompt for enrollment.
  3. The end user will be asked for either the enrollment URL and Group ID or their email address.

    Note: What the user needs to enter during enrollment will depend on how you have configured your Workspace ONE UEM instance. If you have enabled email autodiscovery, the end user can simply enter their email address. Otherwise, IT admins will need to supply the user with the enrollment URL and Group ID. For more information, see Autodiscovery Enrollment.
  4. The user will follow the system prompts. Because this is a user-initiated enrollment, the end user will need to approve the installation of the MDM profile on the device by entering their username and password.
  5. The Intelligent Hub will notify the user when the enrollment is complete, and launch the Onboarding Experience UI, which displays the status of ongoing active tasks, such as profile and app installations.

    Note: The Post-Enrollment Onboarding Experience must be enabled in Workspace ONE for the Onboarding Experience UI to be displayed. For more information, see Enable Post Enrollment Onboarding Settings.

Web-based Enrollment

The web-based enrollment flow is similar to the hub-based enrollment previously discussed. The difference is that the end user begins the enrollment process, not in Intelligent Hub, but from a web browser.

  1. To begin enrollment, the end user opens a web browser (i.e. Google Chrome or Safari) and navigates to https://<mdmenrollment.url.com>/enrollment in a web browser (where mdmenrollment.url.com is the fully qualified domain name for your Workspace ONE UEM MDM enrollment URL).

    Note: The macOS logged-on user must be an admin account on the macOS device.
  2. The end user will be asked for either the enrollment URL and Group ID or their email address.

    Note: What the user needs to enter during enrollment will depend on how you have configured your Workspace ONE UEM instance. If you have enabled email autodiscovery, the end user can simply enter their email address. Otherwise, IT admins will need to supply the user with the enrollment URL and Group ID. For more information about email autodiscovery, see Autodiscovery Enrollment.
  3. The user will follow the system prompts. Because this is a user-initiated enrollment, the end user will need to approve the installation of the MDM profile on the device by entering their username and password.
  4. The web UI will notify the user when the enrollment process is complete.

    Note: You can configure Workspace ONE Intelligent Hub to be automatically installed after web-based enrollment is complete. This can be configured under Groups & Settings > Settings > Devices & Users > Apple > Apple macOS > Intelligent Hub Settings.

Single User Staging Enrollment

IT admins can prepare corporate-owned devices for a single user with device staging. This allows admins to load a staging profile on a macOS device prior to user assignment. Single User Staging supports both domain-bound and non-domain bound macOS devices, as well as user pre-registration in Workspace ONE UEM.

Pre-registration allows IT admins to pre-assign the user to a device either manually or through a batch import process. The admin is not required to know the end user’s directory credentials to pre-register a macOS device. When the user receives the device, they can log in using a known local macOS account.

This section covers the three most common scenarios in which single user staging enrollment can be used.

Prerequisites

The following steps need to be performed in Workspace ONE UEM for single user staging enrollment to work.

  1. Create a  basic Workspace ONE UEM user account configured for Single-User Staging.
  2. Create a  Device Enrollment Profile with the following options:
    • Set Authentication setting to ON.
    • Set Await Configuration to ENABLED.
    • Set Account Setup to SKIP (as you are forcing the end-user to log in with network credentials).
    • Set Create New Admin Account to YES and configure Admin Account details.

Domain-Bound Web and Hub-Based macOS Enrollment

The following steps describe how to configure single-user staging for devices enrolling through the web or Intelligent Hub:

  1. Configure a macOS device profile with the Directory Payload assigned to your devices that must be staged.
  2. On your macOS device, create a local administrative macOS account.
  3. Log in to macOS using the local macOS account and follow one of the following two processes. When asked for credentials, use the staging account you created in the prerequisites.
    1. For Hub-based enrollment - Enrollment with macOS Intelligent Hub.
    2. For Web-based enrollment – Web-Based Enrollment.
  4. To check if the device is domain bound, perform the following steps:
    1. Navigate to Terminal.app.
    2. Enter id '<intended user's AD username>'.

      The command returns information about the user.
  5. Log out of the local administrative macOS account.
  6. At the macOS Login Window, the end-user must log in with their domain-based username and password.

Workspace ONE UEM assigns the device to the end user and begins sending profiles and apps that are assigned to the user.

Domain-Bound macOS Enrollment with Apple Business Manager

The following high-level process helps you to successfully configure single-user staging for devices enrolling with Apple Business Manager:

  1. Configure a macOS Device Profile with the Directory Payload assigned to your devices that should be staged.
  2. Unbox the macOS device and power it on, then proceed through the Setup Assistant and select to have the device managed by Workspace ONE UEM.
    • Authenticate to Workspace ONE UEM using the user account configured for Single User Staging (created in the prerequisites).
    • When the device enrolls during the Setup Assistant, the profile containing the directory payload will be installed during the AwaitConfiguration phase. This binds macOS to your network-based directory service (such as Microsoft Active Directory).
    • Any other profiles and apps assigned to the device using the assignment group are sent to the device.
  3. At the login window, ensure network accounts are available.  
  4. Let the intended end-user log in with their domain-based username and password.
  5. Workspace ONE UEM assigns the device to the end user and begins sending profiles and apps that are assigned to the user.

Note: As a reminder, at the point where the device is enrolled to the Single User Staging user, the logged-in user is not yet associated to the enrollment user. After the first network directory-based account logs in to the macOS device, Workspace ONE UEM associates the logged-in user to a user account in Workspace ONE UEM. The new directory account becomes both the enrollment user and managed user.

Important: Although it is possible to set the Authentication setting to OFF in your DEP profile, this is not recommended. This setting creates a potential security hole that would allow malicious actors to configure a virtual machine with a serial number of a device from your organization to obtain applications, certificates, and so on.  For more information, see Best Practices using Apple Device Enrollment Program (DEP).

Non-Domain macOS Enrollment

When staging without domain binding, the only user account that can be managed by Workspace ONE UEM is the local user that installs the enrollment profile. Per Apple's MDM Protocol Reference, the server will never get requests from a local user other than the one that installed the enrollment profile. Any staging scenario without domain binding must ensure the local macOS user account that installs the enrollment profile is the local macOS user account the end user will be using.

IT admins can pre-register devices either manually or through a bulk import process. This allows for the enrollment and assignment of the device without the need to know the end user’s directory credentials. The device can be provided to the user, who logs in with a local macOS credential provided by the IT admin. Devices can also be pre-registered in Workspace ONE using Apple Business Manager enrollment. A Workspace ONE UEM REST API is available to manage device-to-user assignments.

There are four options available to IT admins for single user staging for non-domain bound macOS device enrollment. These options are:

  • Hub/Web for Local Users with Pre-Registration
  • Hub/Web for Local Users with API
  • Apple Business Manager for Local Users with Pre-Registration
  • Apple Business Manager for Local Users with API

The following sections discuss the four previously mentioned options for single user staging non-domain macOS enrollment.

Hub/Web for Local Users with Pre-Registration

  1. Bulk Import the Device-to-User registration record within the Devices > Lifecycle > Enrollment Status page:
    • Click Add > Batch Import and use the Simple template and example for users and/or devices listed on the Batch Import page.
    • Modify the sample CSV (starting in row 2 of the CSV template) by entering only the Username, FirstName, LastName, GroupID, Security Type (Directory or Basic), and DeviceSerial.
  2. Unbox the Mac and power it on. Proceed through the Setup Assistant as normal.  
    • Create a local, administrative macOS account as part of the Setup Assistant.  
    • ENSURE the local macOS account created is the username you want to give the end-user of the machine.
  3. Log in to macOS as the local macOS account created during Setup Assistant.  
  4. Enroll with macOS Hub using the Staging User credentials you created in step 1 of this section.
    • When the device enrolls, Workspace ONE UEM assigns the device from the staging user to the user you specified in step 2 using bulk import.
    • Any profiles and apps assigned to the enrollment user specified by bulk import are sent to the device when the local macOS user account you used in step 5 is logged in.

Hub/Web for Local Users with API Check-Out

The process to check-out a device to an enrollment user can be used when the device-to-user assignments are not known ahead of time (for example, devices stored in a depot and subsequently assigned out to users). Generally speaking, this is an advanced use case where the code mentioned in step 4 is included in a larger onboarding workflow and/or native application.

  1. Unbox the Mac and power it on. Proceed through the Setup Assistant as normal.  
    • Create a local, administrative macOS account as part of the Setup Assistant.  
    • Ensure the local macOS account created is the username you want to give the end-user of the machine.
  2. Log in to macOS as the local macOS account created during Setup Assistant.  
  3. Enroll with macOS Intelligent Hub using the Staging User credentials you created in the prerequisites of this section.
  4. While logged in as the user that enrolled in step 3, call the Workspace ONE UEM Rest API to check-out the device to the correct enrollment user.

    REST API Details:  https://<API_Server>/api/help/#!/DevicesV2/DevicesV2_CheckOutDeviceToUser 
PATCH /api/mdm/devices/{id}/enrollmentuser/{enrollmentuserid}
* {id} - AirWatch Device ID
* {enrollmentuserid} - AirWatch User ID
* Accept - application/json:version=2
  • The API call is typically embedded in a workflow control application or script.
  • Every time the end-user logs in with the username created during the Setup Assistant, Workspace ONE UEM considers that local macOS user the managed user and sends apps/profiles targeted to the enrollment user.

Note: The web-based enrollment flow is similar to agent-based, except that the admin would initiate their enrollment by navigating to https://<mdmenrollment.url.com>/enrollment in a web browser (where mdmenrollment.url.com is the fully qualified domain name for your Workspace ONE UEM MDM enrollment URL).

Apple Business Manager for Local Users with Pre-Registration

Configure single-user staging for local users with pre-registration using Apple Business Manager enrollment.

  1. In your Device Enrollment profile, set the following options: 
    • Authentication setting: OFF
    • Staging Mode: Single User Device
    • Default Staging User: Basic User
    • Await Configuration: ENABLED
    • Account Setup: DON'T SKIP
    • Optionally, set Create New Admin Account to YES and configure Admin Account details for a hidden IT administrator account.
  2. Validate the device record has synced from Apple Business Manager: 
    • Navigate to Devices > Lifecycle > Enrollment Status in the Workspace ONE UEM console and change the layout to Custom.
    • Ensure the device to be staged has synced from Apple Business Manager.
    • Ensure that Token Type is Apple Enrollment.
    • If the device has no Token Type, navigate to Devices > Devices Settings > Apple > Device Enrollment Program and click Sync Devices.
  3. Validate the device record has the correct Device Enrollment profile: 
    • Navigate to Devices > Lifecycle > Enrollment Status in the Workspace ONE UEM console and change the layout to Custom.
    • Ensure that the Profile Name matches the profile you created in Step 1.
    • If Profile Name is incorrect, select the check box next to the devices to be enrolled and navigate to More Actions > Assign Profile > select the profile you created in Step 1 > Save.
  4. Bulk import the Device-to-User registration record within the Devices > Lifecycle> Enrollment Status
    • Click Add > Batch Import and use the simple template and example for users and devices listed on the Batch Import page.
    • Modify the sample CSV by entering only the Username, FirstName, LastName, GroupID, Security Type (Directory or Basic), and DeviceSerial.
      • Note: Devices can be manually added individually from the Enrollment Status page by clicking Add > Register Device and entering the same required information described above.
      • Reload the Enrollment Status page and ensure that the device to be staged has a User name assigned and still has a Token Type of Apple Enrollment.
  5. On your Mac device, proceed with the enrollment process in Setup Assistant and when the device enrolls, Workspace ONE UEM automatically assigns the device from the staging user to the user you specified using bulk import (enrollment user).

Apple Business Manager for Local Users with API

Configure single-user staging for local users with pre-registration using Apple Business Manager enrollment.

  1. In your Device Enrollment profile, set the following options: 
    • Authentication setting: OFF
    • Staging Mode: Single User Device
    • Default Staging User: Basic User
    • Await Configuration: ENABLED
    • Account Setup: DON'T SKIP
    • Optionally, set Create New Admin Account to YES and configure Admin Account details for a hidden IT administrator account.
  2. Validate the device record has synced from Apple Business Manager: 
    • Navigate to Devices > Lifecycle > Enrollment Status in the Workspace ONE UEM console and change the layout to Custom.
    • Ensure the device to be staged has synced from Apple Business Manager.
    • Ensure that Token Type is Apple Enrollment.
    • If the device has no Token Type, navigate to Devices > Devices Settings > Apple > Device Enrollment Program and click Sync Devices.
  3. Validate the device record has the correct Device Enrollment profile: 
    • Navigate to Devices > Lifecycle > Enrollment Status in the Workspace ONE UEM console and change the layout to Custom.
    • Ensure that the Profile Name matches the profile you created in Step 1.
    • If Profile Name is incorrect, select the check box next to the devices to be enrolled and navigate to More Actions > Assign Profile > select the profile you created in Step 1 > Save.
  4. Use the Workspace ONE UEM REST API to check out the device from the staging user to the correct enrollment user.

    REST API details: https://%3CAPI\_Server%3E/api/help/\#!/DevicesV2/DevicesV2\_CheckOutDeviceToUser 
PATCH /api/mdm/devices/{id}/enrollmentuser/{enrollmentuserid}
* {id} - Workspace ONE UEM
* {enrollmentuserid} - Workspace ONE UEM Enrollment User ID
* Accept - application/json:version=2

Multi-User Staging Enrollment

With multi-user staging, a macOS device is configured for use by more than one user. These devices are typically corporate owned and shared with multiple users, such as frontline shift workers in retail or healthcare. Device assignment in Workspace ONE UEM is dynamically changed as different network users log into the device.

Prerequisites

The following steps need to be performed in Workspace ONE UEM for multi-user staging enrollment to work.

  1. Create a basic Workspace ONE UEM user account configured for Multi-User Staging.

Multi-User Staging Using Hub-Based Enrollment

The following high-level process helps you to successfully configure multi-user staging for devices enrolling without Apple Business Manager:

  1. Configure a  macOS Device Profile with the Directory Payload assigned to your devices that should be staged.
    1. Note the Client ID field can be populated with a lookup value by clicking the [+] (plus sign). Ensure you choose a field that contains data allowable for a computer name (for example, conforms to NetBios Naming Restrictions for Microsoft Active Directory), such as {DeviceSerialNumber}.
  2. Unbox the macOS device and power it on, then proceed through the Setup Assistant as normal.  
  3. Create a local, administrative macOS account as part of the Setup Assistant.
  4. Log in to macOS as the local macOS account created during Setup Assistant.
  5. Enroll with macOS Hub using the Staging User credentials you created in the prerequisites.
    1. When the device enrolls, the profile containing the directory payload is installed. This binds macOS to your network-based directory service (such as Microsoft Active Directory).
    2. Any other profiles and apps assigned to the device using assignment group are sent to the device.
  6. Validate the device is domain bound:
    1. Open Terminal.app.
    2. Enter the command id <intended user's AD username> and ensure the command returns information about the user.
  7. Log out of the local, administrative macOS account.
  8. At the login window, let the intended end-user log in with their domain-based username and password.
  9. Workspace ONE UEM assigns the device to the end user and begins sending profiles and apps which are assigned to the user.
  10. Log out of the domain-based user, and log-in with another domain-based user.
  11. Workspace ONE UEM assigns the device to the new end user and begins sending profiles and apps which are assigned to the new user (if different from the previously logged-in user).

Multi-User Staging Using Apple Business Manager

The following high-level process helps you to successfully configure multi-user staging for devices enrolling with Apple Business Manager:

  1. In your  Device Enrollment Profile, set the following options:
    1. Set Authentication setting to ON.
    2. Set Await Configuration to ENABLED.
    3. Set Account Setup to SKIP (as you are forcing the end-user to log in with network credentials).
    4. Set Create New Admin Account to YES and configure Admin Account details.
  2. Configure a  macOS Device Profile with the Directory Payload assigned to your devices that should be staged.
    1. Note the Client ID field can be populated with a lookup value by clicking the [+] (plus sign). Ensure you choose a field that contains data allowable for a computer name (for example, conforms to  NetBios Naming Restrictions for Microsoft Active Directory), such as {DeviceSerialNumber}.
  3. Unbox the macOS device and power it on, then proceed through the Setup Assistant as normal.  
    1. Authenticate to Workspace ONE UEM using the user account configured for Multi-User Staging (from prerequisites).
    2. When the device enrolls during the Setup Assistant, the profile containing the directory payload is installed during the AwaitConfiguration phase. This binds macOS to your network-based directory service (such as Microsoft Active Directory).
    3. Any other profiles and apps assigned to the device using the assignment group are sent to the device.
  4. At the login window, let the intended end-user log in with their domain-based username and password.
  5. Workspace ONE UEM assigns the device to the end user and begins sending profiles and apps that are assigned to the user.
  6. Log out of the domain-based user, and log in with another domain-based user.
  7. Workspace ONE UEM assigns the device to the new end user and begins sending profiles and apps which are assigned to the new user (if different from the previous logged-on user).

Note: As a reminder, at the point where the device is enrolled to the multi-user staging user, the device is currently checked-out to the multi-user staging user. After the first network directory-based account logs in to the Mac, Workspace ONE UEM associates the logged-in user to a user account in Workspace ONE UEM.  This is reflected in the Workspace ONE UEM console whereby the device is assigned to the network-based user. The new directory account becomes both the enrollment user (in Workspace ONE UEM) and managed user (in macOS). A subsequent network logout and login event re-assigns the device to the new enrollment user (in Workspace ONE UEM) and begins management of the newly logged-in macOS user (the managed user).

Summary and Additional Resources

 This tutorial discusses the different enrollment workflows available in Workspace ONE UEM, and provides IT admins with the knowledge required to make informed decisions about macOS device onboarding. The following topics are presented:

  • Enrollment user types
  • Overview of enrollment workflows
  • Hub-based enrollment
  • Web-based enrollment
  • Staging enrollment
  • Automated enrollment

For more operational tutorials on using macOS with Workspace ONE UEM, check out the Omnissa Tech Zone.

Additional Resources

You may also wish to read these additional operational tutorials from macOS on Omnissa Tech Zone.

Changelog

The following updates were made to this guide:

Date

Description of Changes

06/18/2024

  • Updated for Omnissa docs, KB, and Tech Zone links.

11/13/2023

  • Added new details about enrollment methods.
  • Updated existing content to align with latest release of Workspace ONE UEM.
  • Updated all links to the latest product documentation.

03/30/2019

  • Guide was published.

About the Author and Contributors

The latest version of this tutorial was written by:

This tutorial was originally written by:

  • Robert Terakedis, Omnissa alumni.

Feedback

Your feedback is valuable. To comment on this paper, either use the feedback button or contact us at tech_content_feedback@omnissa.com.


Filter Tags

Workspace ONE Workspace ONE UEM Document Operational Tutorial Intermediate macOS