Which plans include Mac management?

Every plan, through AutoDeploy. Each Mac counts as one AutoDeploy device: the first 5 devices are free, further devices are priced per device on the AppDeploy paid plan, and Enterprise includes AutoDeploy by agreement. Adding Distribution, your own app store, does not change the device count.

Which macOS versions are supported?

macOS 14 or later. The update settings need macOS 15 or later, and requiring a macOS version by a deadline needs a supervised Mac.

Can Macs enrol without IT touching them?

Yes, if your organisation bought them through Apple Business: assign them to AppDeploy there and to a Mac zero-touch profile in AppDeploy, and they enrol during setup with Automated Device Enrollment. Other Macs enrol with a Mac enrolment link.

What about FileVault?

AppDeploy shows whether FileVault is on for each Mac and can check it in compliance rules, but it does not collect or store FileVault recovery keys. Keep each Mac's recovery key in your own records.

Can AppDeploy lock or erase a Mac?

Yes, once your workspace's two-step verification policy covers administrators and AppDeploy support has switched lock and erase on for your workspace. A locked Mac cannot start macOS until someone types its six-digit PIN, which AppDeploy creates and keeps.

Product

Mac management with AppDeploy

Manage company Macs on macOS 14 or later with AppDeploy: enrolment by link or zero-touch, apps and signed packages, macOS updates and a security baseline.

Updated 12 October 2026

Macs alongside your iPhones and iPads

AppDeploy manages company Macs from the same workspace as your iPhones and iPads. Mac management is part of AutoDeploy, AppDeploy's device management. Each Mac counts as one AutoDeploy device, the same as an iPhone or iPad: the first 5 devices are free, and further devices are priced per device on the pricing page.

Macs need macOS 14 or later, and some features need a newer version or a supervised Mac, as set out below. Distribution, the plan for your own branded app store, does not change how devices are counted.

Enrol Macs by link or zero-touch

Create a Mac enrolment link and send it to the person who uses the Mac. They open it on the Mac and install the enrolment profile while signed in as the Mac's main user. Before you create a link, connect your Apple push certificate and add at least one app.

Macs your organisation buys through Apple Business can enrol automatically during setup with Automated Device Enrollment (zero-touch): assign them to AppDeploy in Apple Business, then to a Mac profile in AppDeploy's Enrolment → Zero-touch (ADE), and they arrive enrolled and supervised.

See what each Mac reports

Devices lists each Mac with its macOS version and serial number, and the security facts it reports, such as FileVault, firewall, System Integrity Protection and Secure Boot. The facts update each time the Mac reports in.

Install apps and signed packages

Mac app distribution through Apple Business: assign an Apps and Books app that has a Mac version to a device group, or pick it for a Mac enrolment link, and AppDeploy installs it on enrolled Macs with a device licence.

Deploy signed Mac packages: upload a .pkg signed with a Developer ID Installer certificate, or by your own certificate authority once you add its certificate, then assign it like any other app.

Each install shows as waiting for confirmation until the Mac confirms it.

Keep macOS up to date

Require a macOS version by a deadline on supervised Macs running macOS 14 or later, and set how updates behave (deferrals, automatic downloads and notifications) on Macs running macOS 15 or later.

Security baseline and compliance

Apply Mac profiles (firewall, Gatekeeper, screen lock and password, screen saver, restrictions and Wi-Fi) and a Mac security baseline: firewall with stealth mode, Gatekeeper and a 15-minute screen lock, which you review before applying.

Compliance adds Mac rules such as FileVault on, firewall on, System Integrity Protection on and macOS 14 or later, so you can see which Macs fall short.

Restart, shut down, lock and erase

Restart a supervised Mac, straight away or after asking the user, or shut it down. AppDeploy cannot turn a Mac back on once it has shut down: someone has to press its power button.

Lock and erase are switched on per workspace, once the workspace's two-step verification policy covers administrators: ask AppDeploy support to switch them on. A locked Mac cannot start macOS until someone types its six-digit PIN; AppDeploy creates and keeps the PIN, and every reveal is recorded.

What Mac management does not include

FileVault key escrow: AppDeploy shows whether FileVault is on, but it does not collect or store FileVault recovery keys. Keep each Mac's recovery key in your own records.
Macs running a macOS version older than macOS 14.
Lost Mode, clear passcode and Return to Service, which are iPhone and iPad features.

Frequently asked questions

Which plans include Mac management?: Every plan, through AutoDeploy. Each Mac counts as one AutoDeploy device: the first 5 devices are free, further devices are priced per device on the AppDeploy paid plan, and Enterprise includes AutoDeploy by agreement. Adding Distribution, your own app store, does not change the device count.
Which macOS versions are supported?: macOS 14 or later. The update settings need macOS 15 or later, and requiring a macOS version by a deadline needs a supervised Mac.
Can Macs enrol without IT touching them?: Yes, if your organisation bought them through Apple Business: assign them to AppDeploy there and to a Mac zero-touch profile in AppDeploy, and they enrol during setup with Automated Device Enrollment. Other Macs enrol with a Mac enrolment link.
What about FileVault?: AppDeploy shows whether FileVault is on for each Mac and can check it in compliance rules, but it does not collect or store FileVault recovery keys. Keep each Mac's recovery key in your own records.
Can AppDeploy lock or erase a Mac?: Yes, once your workspace's two-step verification policy covers administrators and AppDeploy support has switched lock and erase on for your workspace. A locked Mac cannot start macOS until someone types its six-digit PIN, which AppDeploy creates and keeps.