macOS Automated Device Enrollment
Answer: macOS ADE is for organization-owned Macs assigned through Apple Business Manager or Apple School Manager and requires an active enrollment token, assigned profile, Apple MDM push certificate, supported macOS version, and network access during Setup Assistant.
Administrator playbook
Decide, verify, and document
Use the curated answer as a starting point, then prove the outcome against the target tenant or device.
What it means
- ADE can provide supervised-like organizational control on Macs
- Profile assignment and token sync must occur before Setup Assistant enrollment
- Company Portal and modern authentication choices affect the user experience
What to check next
- Confirm serial assignment to the Intune MDM server
- Sync the token and verify profile assignment
- Validate Setup Assistant, account, and bootstrap-token design
Verify success
- Confirm a new device record appears in the intended tenant and ownership state.
- Verify the device checks in, receives policy, and reports compliant or the expected transitional state.
- Capture a fresh successful enrollment timestamp and remove obsolete duplicate records.
Escalate when
- Multiple known-good users or devices fail at the same enrollment stage.
- The failure persists after scope, restriction, licensing, and stale-object checks.
- You can provide sanitized enrollment logs, UTC time, tenant, and correlation identifiers.
Copyable admin briefAnswer, next checks, source, and review date
Inspect join and registration state
dsregcmd /statusRead-only. Review Device State, Tenant Details, and SSO State; redact tenant and user identifiers before sharing.
Collect enrollment diagnostics
mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zip "C:\Users\Public\Documents\MDMDiagReport.zip"Creates a local ZIP. Review and redact identifiers before sharing it.
Evidence to preserve
- Platform
- macOS
- Ownership
- Corporate
- Channel
- Apple ADE
- Reset
- Required for Setup Assistant
- Platform, ownership, and OS version
- User license and MDM scope
- Enrollment restriction and device limit
- UTC failure time and enrollment error