macOS MDM: separate device and user management
Apple documents how macOS can manage the Mac and each signed-in user separately. Organizations operating shared workstations, labs, or multiple sessions on one Mac need to distinguish the device channel, user channel, push tokens, and compliance results.
1. What Apple documents
On macOS, an MDM service can enroll the device and users as separate entities. The mdmclient daemon handles device requests; an mdmclient agent handles requests for each signed-in user. Multiple user agents can communicate with the MDM service concurrently and in parallel with the device channel.
Each connection has its own push token. To advertise this support, the MDM enrollment profile includes the com.apple.mdm.per-user-connections string. This is a capability of the MDM service and its integration, not a switch to enable without confirming vendor support.
2. Assign each control to the correct channel
Settings that protect the Mac regardless of who uses it — encryption, updates, system certificates, or device posture — should remain system-scoped when the payload allows it. Settings tied to a session, identity, or user context belong on the user channel when Apple and the MDM support them.
A console that only reports “profile installed” can hide the key question: installed for which device or which user? Smart groups, API exports, and compliance dashboards should preserve channel identity rather than aggregating results too early.
3. Design the session lifecycle
After Setup Assistant creates an account and the user first signs in, macOS initializes exchanges for that new user. The runbook should cover arrival, first sign-in, user switching, concurrent sessions, local account deletion, and user departure.
On a shared Mac, successful policy delivery to one session does not prove that every other session is compliant. Conversely, a temporarily inactive user channel does not mean that the device channel has lost control. Alerts and support commitments need to preserve this distinction.
4. What changes for a Belgian or French organization?
For an SMB, this separation prevents teams from treating a shared Mac as if it belonged to one permanent user. For a mid-market company, large enterprise, or public institution in Belgium or France, it provides a better model for training rooms, reception desks, workshops, labs, and rotating teams.
IT leaders should require an explicit matrix of capabilities supported by their MDM. Security teams should request evidence by device and by user. Support teams need to identify the affected session before resending a command or concluding that the Mac is noncompliant.
5. Underside analysis: identity is not the management channel
Our view is that per-user MDM connections complement identity architecture rather than replace it. Platform SSO aligns the macOS account with an identity provider; the MDM user channel carries management commands and information in that session’s context.
A sound model connects Apple Business Manager, Automated Device Enrollment, MDM or Jamf, identity, and inventory while preserving boundaries between the Mac, the local session, and the enterprise identity. This separation makes incidents easier to diagnose and controls easier to audit.
6. Recommended action plan
- Confirm the MDM vendor’s support for macOS user connections.
- Inventory the payloads and commands expected on device and user channels.
- Test an ADE Mac with one account, then multiple accounts and active sessions.
- Verify tokens, statuses, errors, and latency for each connection in the console and API.
- Adapt compliance rules so they preserve device or user context.
- Document account deletion, Mac reassignment, and support diagnostics.
Goal: prove who is managed, through which channel, and at what time, without confusing Mac compliance with session compliance.
Audit your macOS MDM designOfficial source: Apple Developer — Managing devices and users in macOS.