Relution Signet Customer Hub

User Enrollment

With user enrollment, private Macs can be enrolled without the owner having to give up all control over the devices. Based on the Bring Your Own Device approach (BYOD), private devices of students or employees can be integrated and used in the school or company context while maintaining the protection of private data. User enrollment of iPhone and iPad is described in the article User enrollment for iOS →.

There are two variants of user enrollment: account-driven user enrollment, where sign-in on the Mac takes place with a Managed Apple Account (Managed Apple ID in the portal), and profile-based user enrollment via an enrollment link.

Benefits

  • Administrators cannot view privately installed apps.
  • Devices remain under control of users.

Disadvantages

  • Not all actions and policy configurations are possible.
  • Managed Apple Accounts are required.
  • The macOS Companion is not deployed on Macs with user enrollment. Apps of type DMG can therefore not be installed on these Macs.

Account-driven user enrollment

Relution supports account-driven user enrollment for Macs that are not in Supervised Mode →.

Sign-in takes place on the Mac in System Settings by signing in with a work or school account, i.e. with the Managed Apple Account. Using Service Discovery, the Mac determines the responsible MDM server and redirects to the Relution sign-in page, where sign-in takes place with the Relution user account. The sign-in with the Managed Apple Account is then confirmed on the Mac, the MDM profile is installed, and the Mac appears in the device inventory of the corresponding Relution organization.

Requirements

  • macOS 14 or later.
  • An APNs certificate stored in Relution (APNS Push Certificates →).
  • A Managed Apple Account and a Relution user account for each user. The Managed Apple ID is stored in the user details for this purpose; without a Managed Apple ID, Relution uses the user’s E-mail address. This value must match the Managed Apple Account used to sign in on the Mac.
  • Either the Account-driven Apple user enrollment setting enabled in the organization or a user enrollment → created for the user.
  • Service Discovery for the domain of the Managed Apple Accounts, either automatically via Apple School/Business Manager or via a well-known file.

Enable account-driven Apple user enrollment

The setting is located under Settings → Device Management in the Account-driven Apple user enrollment section. It applies per organization; the section is not shown in the global organization.

When a user signs in, Relution first uses a macOS user enrollment created for this user with the status Created that is still valid for at least five minutes. If no such enrollment exists and the Account-driven Apple user enrollment toggle is enabled, Relution automatically creates a user enrollment with the ownership Bring Your Own Device (BYOD) and a validity of five days. The toggle is disabled by default; without a matching user enrollment, enrollment of the Mac then fails.

Time limits for signing in

As of Relution 27.0.1, each sign-in to Relution during enrollment is valid for exactly one enrollment on exactly one device. Fixed time limits apply, which cannot be configured:

  • After signing in to Relution, the Mac must retrieve the enrollment profile within 15 minutes.
  • The sign-in with the Managed Apple Account on the Mac, including the second factor if applicable, must then be completed within one hour.

If a time limit is exceeded or the enrollment is interrupted after the profile has been retrieved, for example due to a lost connection or because no matching user enrollment exists and the Account-driven Apple user enrollment toggle is disabled, the enrollment cannot be resumed. In this case, the enrollment is restarted in the System Settings of the Mac and the sign-in to Relution takes place again. Several devices of the same user can be enrolled at the same time; a separate sign-in takes place for each device.

Set up Service Discovery

Service Discovery must be configured so that Apple can direct devices to the correct MDM server. There are two ways to do this.

Automatically via Apple School/Business Manager

As of macOS 15.2, no separate file is required if Apple School/Business Manager is connected to Relution for Automated Device Enrollment (ADE, DEP in the portal) via a DEP account. Relution automatically stores the Service Discovery URL in Apple School/Business Manager during every synchronization of ADE devices. This requires Relution to be set as the default MDM server for Mac under Preferences → Your MDM Servers → MDM Server Assignment → Default MDM Server Assignment.

Via a well-known file

For Macs running a macOS version earlier than 15.2, or without a connected Apple School/Business Manager, an HTTP well-known resource file must be published on the domain users sign in with. Relution already answers this request itself for its own hostname; a separate file is therefore only required if the domain of the Managed Apple Accounts differs from it. Apple must be able to retrieve this file via an HTTP GET request at the following URL:

https://yourdomain.com/.well-known/com.apple.remotemanagement

Under yourdomain.com, the domain also used for the Managed Apple Accounts must be entered. The file must be hosted on a domain that can handle HTTP GET requests.

The file is created in JSON format with the content type application/json. To enter the correct information in the file, the required information can be copied directly from the Relution portal:

  1. Settings → Device Management is opened.
  2. In the Account-driven Apple user enrollment section, the JSON text shown under Response is copied in full, including the outer curly braces (Copy to clipboard button), and pasted into the file. The JSON text is shown regardless of the toggle.

Example: maxmustermann@musterhausen.de

In this example, the domain would be musterhausen.de. The Service Discovery file would need to be published there.

Create a user enrollment in Relution

A user enrollment is created under Devices → Enrollments via Add. macOS is selected as Platform and the User Enrollment button as Type. The type can only be selected with permission to read users.

A user enrollment is always assigned to exactly one user; a separate enrollment is created for each user. Either a Managed Apple ID or an E-mail address must be stored in the user details. If no Managed Apple ID is stored, the email address is used as the Managed Apple Account. Users assigned to devices can no longer be changed or removed from devices enrolled via user enrollment.

A user enrollment created this way is used for account-driven user enrollment when the user signs in on the Mac. On Macs up to macOS 14, it can also be used for profile-based user enrollment.

Profile-based user enrollment (up to macOS 14)

The enrollment link of the created user enrollment is sent to the respective student or employee. Via the link, the enrollment is performed on the Mac using the user’s Managed Apple Account, and the device automatically appears in the device inventory of the corresponding Relution organization.