On macOS, you can deliver a Device Setting (payload) scoped to a single user rather than the whole device. This article covers what to consider when using the User Channel for settings management, and which payloads support it.
Overview
Device Settings can be delivered over the Device Channel (applies to the whole device) or the User Channel (applies to a specific user). User Channel deployment depends on a per-user token, which has some important limitations depending on how the device is managed.
Managed Users: What to Consider
The first user created on a Mac — or the user logged in during enrollment — generates a unique token that enables communication over the User Channel. Addigy receives and stores this token to deliver payloads to that specific user. This token must be generated and uploaded to Addigy for the account to work correctly during deployment.
- Macs bound to a directory service (e.g., Active Directory): all network and mobile users are enabled for User Channel payloads.
- Macs on macOS 10.12+ not bound to a directory service: only one managed user can hold the user-based token at a time. Switching which account has User Channel enabled disables the previously working account and requires removing and reinstalling the payload on the device.
How to Change the Current Managed User
For Macs already enrolled in Addigy, they will have the managed user set, which can only be changed by performing some type of re-enrollment. To help increase the chance of this workflow changing, we highly suggest submitting feedback to Apple expressing interest in an improvement to how Managed Users work on Macs. Check out our guide on submitting Apple Feedbacks for more information.
ADE Enrolled Macs
If your Macs are enrolled via ADE, you can leverage Apple's MDM Migration tool via Apple Business. This workflow does not require the intended managed user to be an admin, and when the enrollment is completed, the user will become the managed user after the device completes its MDM audits.
- In Addigy, create a new policy to house the new ADE token. This can be a child policy of a client, or a completely independent policy. Note: When devices re-enroll through this workflow, they will keep their current policy assignments.
- In the new policy, navigate to Integrations & Settings > Automated Device Enrollment, and follow the on-screen instructions to configure ADE. More details on configuring ADE can be found here.
- Once you have the second policy and ADE token set up, follow the instructions in this article to begin the migration process.
Non-ADE Macs
For devices that are enrolled via manual MDM enrollment, the MDM profile will need to be completely removed and re-enrolled. This does not mean the device needs to be completely removed from Addigy, as you can remove only the MDM profile via the Devices page.
- Navigate to the Devices page and locate the Mac.
- Expand the device actions arrow and select Remove Device.
- In the next window, choose Remove MDM Profile
- If the end-user is a standard user, you will need to elevate them to admin. You can use our TempAdmin feature to do this.
- Use the Install MDM tool to send the enrollment profile, and have the user complete the enrollment on the Mac.
Device Settings That Support User-Based Deployment
Apple documents which payloads support User Channel deployment in its Profile-Specific Payload Keys reference. Search for the payload name (for example, "SCEP") and check the Profile Availability section to confirm User Channel support.
How to Deploy a User Channel Device Setting
For step-by-step instructions, see How to Deploy User Channel Device Settings on an Individual Device.