macOS MDM – What You Need to Know

What is macOS MDM?

macOS MDM is a framework provided by Apple that allows IT administrators to remotely manage and configure macOS devices – Mac Desktops, laptops and servers. Compared to traditional RMM solutions, macOS MDM provides deeper control over macOS system settings, security policies, and app management.

macOS MDM allows different enrollment methods for employee-owned and company-owned devices.

Employee-owned devices are enrolled manually by installing an enrollment profile. End users can remove the profile, which will also remove all managed settings and apps.

Company-owned devices are generally enrolled using Zero-Touch Enrollment (ZTE) through Automated Device Enrollment (ADE) via Apple Business Manager or Apple School Manager. In most cases, end users cannot remove the device from management

Unlike iOS on mobile phones, where some settings apply only to supervised devices and others to unsupervised devices, macOS applies all configured settings to the device regardless of the enrollment method used. Whether a Mac is enrolled manually with an enrollment profile or through ADE with ZTE, all assigned macOS MDM settings will take effect uniformly.

How does macOS MDM work in NinjaOne?

Using macOS MDM in NinjaOne is very simple. macOS agent policies include an additional ‘MDM’ tab, which contains multiple categories of configuration settings.

Within each category, administrators can enable or disable specific options, allowing for granular control over macOS devices. These settings help enforce security policies, manage system preferences, and configure restrictions as needed. See below for a brief explanation of these categories.

Passcode. This category controls passcode settings, like complexity, number of failed attempts, passcode length, history, etc.

Restrictions. This category controls a series of restrictions that can be applied to the device, these restrictions are divided into 6 subcategories:

• Functionality
• Application
• Security & Privacy
• Media
• iCloud
• Classroom

Applications. This category allows you to integrate with a content token from Apple Business Manager or Apple School Manager and deploy managed applications to devices.

Network. Here, IT administrators can set up Wi-Fi network and proxy settings without end user intervention.

OS updates. This category defines how end users can install software updates and defines enforced OS versions.

Privacy preferences. This category controls how applications can access system resources, such as the microphone, camera, screen recording, files, etc., without end user intervention.

System extensions. System extensions allow macOS apps to use advanced OS feature sets, such as creating device drivers, network extensions (DNS proxies, VPNs, or content filters), and endpoint security extensions to monitor and block system events.

Custom payload. This allows IT administrators to apply settings not natively available in NinjaOne. This is useful for advanced configurations or when Apple introduces new settings that NinjaOne hasn’t yet integrated.

What is the detailed list of settings that can be controlled with macOS MDM in NinjaOne?

In NinjaOne, macOS MDM policy is divided into multiple categories, which are explained in the following lines:

Passcode

When enabled, a passcode is enforced on the device, regardless of whether other unlock methods are set up. For example, if the end user configures fingerprint authentication, they can unlock the device using their fingerprint. However, once the grace period (defined by ‘Maximum grace period for device lock’) expires, the passcode will be required to unlock the device. This category also defines passcode settings like complexity, history, etc. See the table below to see the different settings controlled by this category.

Restrictions

Through this category, there is a series of restrictions that can be applied, they are divided into Functionality, Application, Network, Security & Privacy, Media, iCloud and Classroom. Some restrictions apply to supervised, others to unsupervised. All restrictions are displayed under their appropriate category and can be filtered using the Category dropdown at the top of the page; they can be enabled or disabled by checking/unchecking the box next to the restriction name. The policy configuration will be sent to all devices managed by the policy. Refer to the sections below for an explanation of each restriction.

Functionality restrictions

The table below explains the functionality restrictions

Application restrictions

The table below explains the application restrictions.

Security & privacy restrictions

The table below explains the Security & Privacy restrictions.

Media restrictions

The table below explains the Media restrictions.

iCloud restrictions

The table below explains the iCloud restrictions for macOS policies.

Classroom restrictions

The table below explains the classroom restrictions.

Applications

This category controls which applications will be force-installed on Mac devices. Note that only apps distributed through Apple Apps and Books and synced from ABM via a content token will be available. As such, this category does not replace other software installation methods that use installation packages or the software option in the policy; rather, it complements them.

Follow the steps below to add apps.

1. Click + Add apps.

2. Click the desired application from the list. A dialog box will appear.

3. Select whether “Remove app from the device when it’s removed from the policy.”

Note: If you opt to remove the app when a device is removed from a policy, this function also applies when you switch a device’s policy under the Settings tab on the device dashboard if the new policy does not also have the app included.

4. Select whether “Remove app when device is unenrolled in MDM.”

5. Click Add. You can continue adding applications, once you´re done,

6. Click Save on the upper right side of the screen. Enter your MFA response method and close.

The app(s) will now appear under Managed Applications, displaying its details, assignment type and distribution type, which will always be “Apps and Books”.

Network

In this category, device´s network settings can be configured, like Proxy and Wi-Fi networks. Multiple Wi-Fi networks can be added, but only one proxy.

Proxy

Use the Manual proxy setup button to configure proxy settings. This action will open the Manual Proxy Setup dialog box.

Turn on the Direct Proxy switch to manually enter the proxy configuration information – Host name and port.

Turn on the Proxy auto-configuration (PAC) switch to enter the URL for the PAC file.

Host names can be excluded from the proxy by writing the name under the Excluded host field and pressing enter.

After entering the information, click the blue Save button. This will add the proxy settings used by the mobile device. Once added, the information can be edited or removed.

 Wi-Fi Networks

Use the Add new Wi-Fi Network button to configure a new Wi-Fi network. This action will open the Wi-Fi Network Dialog Box, then follow the next steps to configure a new Wi-Fi network.

1. Enter a configuration name (a friendly name of your choice to distinguish this Wi-Fi network).
2. Enter the SSID.
3. Under Security, select the encryption method, options are: ‘WEP-PSK‘, ‘WPA-PSK‘, ‘WPA2-PSK‘, ‘WPA3-PSK‘, Any or None.
4. Enter the password.
5. Select the additional options if required (Auto Join, Enable IPv6, Hidden Network, Hotspot or Random MAC Address).
6. Select the proxy method (Auto, Manual or None).
7. Click Save.
8. The new Wi-Fi network configuration will appear on the list. This network can be edited or removed by selecting it using the check mark to the left of the name.

OS updates

This category defines how users can install software updates and defines enforced OS versions.

User behavior

Control when and how users can self-install macOS updates on their own devices. Requires a supervised device.

• Delay when new major macOS upgrades can be self-installed. Period to defer the availability of major macOS updates.
• Delay when new minor macOS updates can be self-installed. Period to defer the availability of minor macOS updates.
• Delay when new non-OS software updates can be self-installed.
• Allow user to install beta OS versions (macOS 15+). This option controls the installation of beta OS versions. The available settings are: Allowed, Always On, and Always Off.
• Allow the user to install Rapid Security Responses. If enabled, critical security updates released by Apple will be installed. RSRs are released more quickly than traditional OS updates.
• Allow the user to remove Rapid Security Responses. If checked, critical security updates released by Apple can be removed.
• Allow standard user accounts to self-install OS updates (macOS 15+). If checked, users with standard user accounts can approve OS updates.
• Show additional notifications for scheduled updates (macOS 15+). If enabled, users will receive daily notifications for updates scheduled in the future. If disabled, users will only receive notifications beginning one hour before the scheduled deadline.

Device behavior

Controls device behavior defined under Settings > Software Update > Automatic Updates. Settings that are enabled or disabled cannot be overridden by the user.

• Automatically download new macOS updates when available (macOS 15+). Options are: Allowed, Always on and Always off.
• Automatically install macOS updates (macOS 15+). Options are: Allowed, Always on and Always off.
• Automatically install Security Responses and system files (macOS 15+). Options are: Allowed, Always on and Always off.

Enforced updates

Control when and how updates are enforced on devices. When a deadline is reached, device may be forced to restart.

• Manually scheduled updates. Here, specific updates can be manually entered, they can be approved, rejected or enforced.

If they are approved, devices will be periodically notified to update until the deadline is reached, at which point, they will be enforced.

If they are rejected, the updates will not be enforced.

If they are enforced, devices will be forced to update to the highest specified version once the deadline has passed.

Privacy preferences

This category allows IT admins to pre-approve or deny access for managed apps to system resources without user interaction, enabling a smoother and more secure end-user experience.

Follow the steps below to add an app preference.

1. In the policy editor, under the MDM section, click Privacy preferences, on the left side panel.
2. Click + Add preference. The Define app privacy preferences dialog box appears.
3. Under the General tab, fill out the App privacy name, which is a name to identify this preference.
4. Select the Identifier type – Bundle ID or path, this is how the managed app will be identified.
5. Type the app identifier for which this preference will apply (Bundle ID or path).
6. Type the Code requirement.
7. Select whether to Statically validate the code requirement.
8. Go to the Preferences tab (on the left side).
9. Click +Add. The New preference dialog box appears.
10. From the drop-down, select the preference type (The type of permission that you will enforce).
11. From the drop-down, select the Authorization (Allow or Deny).
12. Click Add. You can add multiple preferences.
13. After adding all required preferences, click Submit.

System extensions

With NinjaOne’s MDM solution, you can automatically manage and approve system extensions for managed apps. This allows for a more seamless application installation, a better user experience, and eliminating potential user errors.

Follow the instructions below to add system extensions.

1. In the policy editor, under the MDM section, click System extensions, on the left side panel.

2. Click + Add extension. The Add system extension dialog box appears.

3. Fill out The Display name and Team ID.

4. From the dop-down, select the System extension types (“Allow all system extensions”, “Allow specified system extensions” or “Allow by type”).

If “Allow specified system extensions” is selected, an additional dialog box will appear where you can add each desired extension by extension bundle identifier and command to view all loaded extensions (you may need to consult the app documentation).

• If “Allow by type” is selected, you must select which extension type you want to allow: “Driver extension”, “Network extension” and/or “Endpoint security extension”.

5. Click Add.

Custom payload

Follow the instructions below to enter custom payloads to include in the policy.

1. Click + Add payload. The Add payload dialog box appears.
2. Enter a name for the payload.
3. Enter the XML content, pasting is allowed.
4. Click Add.