On macOS, you can deliver a Device Setting (payload) scoped to a single user rather than the whole device. This article covers what to consider when using the User Channel for settings management, and which payloads support it.
Overview
Device Settings can be delivered over the Device Channel (applies to the whole device) or the User Channel (applies to a specific user). User Channel deployment depends on a per-user token, which has some important limitations depending on how the device is managed.
Managed Users: What to Consider
The first user created on a device — or the user logged in during enrollment — generates a unique token that enables communication over the User Channel. Addigy receives and stores this token to deliver payloads to that specific user. This token must be generated and uploaded to Addigy for the account to work correctly during deployment.
- Devices bound to a directory service (e.g., Active Directory): all network and mobile users are enabled for User Channel payloads.
- Devices on macOS 10.12+ not bound to a directory service: only one managed user can hold the user-based token at a time. Switching which account has User Channel enabled disables the previously working account, and requires removing and reinstalling the payload on the device.
Device Settings That Support User-Based Deployment
Apple documents which payloads support User Channel deployment in its Profile-Specific Payload Keys reference. Search for the payload name (for example, "SCEP") and check the Profile Availability section to confirm User Channel support.
How to Deploy a User Channel Device Setting
For step-by-step instructions, see How to Deploy User Channel Device Settings on an Individual Device.