Relution Signet Customer Hub

Manual enrollment

Enrollment is performed by manually downloading and installing an MDM profile on the Mac. This requires either scanning a QR code or manually opening the corresponding URL in the browser. The MDM profile is then installed in System Settings.

Advantages

  • Enrollment can be done without having to reset the devices to factory defaults.

Disadvantages

  • Enrollment can be removed at any time in the settings on the devices (MDM profile), unless Use profile removal password is enabled in the enrollment.
  • Only partially suitable for BYOD devices, as administrators can see which apps are installed. User enrollment → is intended for private devices.
  • Not all actions and policy configurations are possible.
  • Devices are often not supervised (Supervised Mode).

Create the enrollment in Relution

An APNs certificate stored in Relution is required (APNS Push Certificates →). Without it, the Apple platforms cannot be selected when creating an enrollment.

To perform a manual enrollment, it must first be created in Relution. To do this, Devices → Enrollments is opened in the menu and Add is clicked.

Enrollments depend on the operating system. Therefore, macOS is selected as Platform and device enrollment as Type (button macOS, not User Enrollment). The Ownership is selected accordingly.

If a User is to be associated with the device to be enrolled, the user is selected under User. Optionally, a Device name and a Device description can be specified for display in the device inventory; without a device name, Relution generates the name automatically.

The Configuration section offers the following options for macOS:

  • Use profile removal password: The MDM profile can then only be removed from the Mac with an automatically generated password. The password can be retrieved in the device details in the Security section under Profile removal password (see also Security optimizations for enrollments →).
  • Static device groups: The device is added to these groups directly; policies assigned to these groups are applied after enrollment.
  • Agreements: Selection of agreements created under Settings → General → Agreements. Relution provides their texts to the device during enrollment.

Each enrollment can be used only once unless the Multi-use enrollment switch is activated. If this is the case, new devices can be enrolled via the enrollment link until either the validity date has been exceeded or no more device licenses are available in Relution. The validity date is set under Valid until; the default is a date seven days after creation. Multi-use enrollment cannot be changed after saving.

If enrollment notifications by email or SMS are enabled in the organization settings, the enrollment link can be sent directly to the assigned user in the Notification section.

Once the enrollment is saved and thus created, the displayed URL can be opened in the browser on the Mac, or the created QR code can be scanned. The MDM profile is downloaded via the Enrollment button and then installed in System Settings (see steps below).

Step by step instructions

  1. The enrollment is started by pressing the Enrollment button
  2. Allow is then pressed
  3. The next window is closed via Close
  4. System Settings is opened
  5. There in the section Profiles
  6. The loaded MDM profile is selected
  7. The MDM profile is checked, Install is pressed and the dialog is confirmed again with Install
  8. A security message is displayed. Install is pressed here as well
  9. The remote administration is trusted
  10. Confirming with Done completes the installation of the MDM profile

This completes the enrollment.
A new entry should now appear in the device inventory of the Relution portal. If licenses from Apps and Books (VPP in the portal) are available for the Relution Agent, the Relution Agent is then installed on the device automatically.