This article describes the methods used to make a local user account MDM-enabled (formerly MDM-capable). A user is considered MDM-enabled if they have a value of "Yes" for the MDM Capable Users criteria in the computer inventory record.
You must have MDM-enabled users to do the following:
For computers with macOS 10.12 or later, only one local user account can be MDM-enabled on a computer at a time. If a second local user account becomes MDM-enabled on the computer, the first local user account will no longer be MDM-enabled.
The following table explains several methods you can use to enable a user for MDM in Jamf Pro:
|Method||Jamf Pro Version||Description|
|Computer PreStage enrollment||9.96 or later||When enrolling a computer via a PreStage enrollment using automated device enrollment (formerly DEP), users created during the Setup Assistant will be MDM-enabled.
|User-initiated enrollment||10.3.0 or later||By default, the logged-in user on the computer will be MDM-enabled after enrollment.|
|Agent-based enrollment with a QuickAdd.pkg or the Jamf management framework||10.4.0 or later||The logged-in user will be MDM-enabled.|
|User-level configuration profile installation through Self Service for macOS||9.64 or later||Self Service will attempt to enable the logged-in user for MDM if they are not already MDM-enabled.|
If you want to enable a different local user account for MDM, you can execute the following command on the computer to enable MDM for the currently logged-in user:
sudo jamf mdm -userLevelMdm
If you make the MDM profile non-removable by deselecting the Allow MDM Profile Removal checkbox in a computer PreStage enrollment, you cannot change the MDM-enabled user after the initial enrollment.
For additional information, see Computer Configuration Profiles in the Jamf Pro Administrator's Guide.