Contents

How to List MDMs Across All Macs

Using Kolide, you can easily view and query Mac MDMs across your fleet.

Introduction

Mobile Device Management (MDM) is a device management framework and protocol created by Apple for the purposes of remotely managing Macs, iPhones, iPads, and Apple TVs.

Employers who wish to manage their employees devices can use third-party products that are compatible with the MDM protocol. Once managed under MDM, and depending on the permissions granted, the organization can perform remote commands like installing software, or remotely erasing the device. You can read more about MDM on Apple's Support Site.

If a device is under MDM management, Kolide can return information about the third party product that is managing the device.

What Mac MDM Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Mac MDMs from Macs in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Mac MDMs Schema

Column	Type	Description
id	Primary Key	Unique identifier for the object
device_id	Foreign Key	Device associated with the entry
device_name	Text	Display name of the device associated with the entry
access_rights	Integer	The raw `AccessRights` bit mask the MDM profile grants. `8191` grants every right. See `access_rights_granted` for the decoded list. Bits: `1` profileinspection, `2` profileinstallation, `4` devicelock, `8` deviceerase, `16` deviceinformationquery, `32` networkinformationquery, `64` provisioningprofileinspection, `128` provisioningprofileinstallation, `256` appinspection, `512` restrictionquery, `1024` securityquery, `2048` settingsmanipulation, `4096` app_management.
access_rights_granted	Text[]	The management rights the MDM profile grants, decoded from `access_rights` (eg. `device_erase`, `app_management`). `NULL` when the Mac reported no access rights.
checkin_url	Text	The URL the Mac checks in with (`CheckInURL`)
enrolled	Boolean	`true` if the Mac is enrolled in an MDM server
has_scep_payload	Boolean	`true` if the MDM profile includes a SCEP payload to request its identity certificate
identity_certificate_uuid	Text	The UUID of the certificate payload the Mac uses to identify itself to the MDM server (`IdentityCertificateUUID`)
installed_at	Timestamp	When the MDM profile was installed
installed_from_dep	Boolean	`true` if the MDM profile was installed through Automated Device Enrollment (DEP)
payload_identifier	Text	The `PayloadIdentifier` of the MDM profile (eg. `com.kandji.profile.mdmprofile`)
server_url	Text	The URL the Mac fetches MDM commands from (`ServerURL`)
sign_message	Boolean	`true` if the Mac signs its messages to the MDM server (`SignMessage`)
topic	Text	The APNs topic the MDM server uses to wake the Mac (`Topic`)
user_approved	Boolean	`true` if the enrollment is user approved (or came from Automated Device Enrollment), which macOS requires before an MDM can manage kernel extensions and some privacy settings
collected_at	Timestamp	Time the row of data was first collected in the database
updated_at	Timestamp	Time the row of data was last changed in the database

Why Should I Collect Mac MDMs?

Collecting information about MDM servers can be useful in the following situations:

Confirm a device is correctly enrolled in an MDM
Locate devices that are incorrectly managed by another organization
Locate devices that are using a legacy MDM server

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

When you use Kolide to list Mac MDM data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.