aaronpolley.com

Why Make This Post?

The reason user-level MDM has come up a lot in conversations for me as of late, is its USEFULNESS. Example: “I want to deploy a unique configuration [like a certificate] to EACH user, when they login” The Real Problem: user channel/scope management on a fully managed device is best suited for when multiple users can sign into a Mac.

How To Hold macOS User Identity in 2025?

Leverage Declarative Device Management (DDM)Start testing DDM assets and configurations. It is the next destination for Apple device management and will eventually replace traditional MDM workflows. Use the same system and all user applied workflows so you’re not caught with a user that can’t get the correct settings.

So what had changed?

I had added a computer naming step to the workflow. The script used to name the device resembled this: ScriptRepo/ComputerName-Set-Serial.sh at master · aarondavidpolley/ScriptRepo · GitHub Changing the computer name in System Settings/Preferences didn’t fix the issue. Resetting the device, not using the script to name the computer: WORKED!

So why bring this up in September 2025?

I recently visited that same school and helped them revise their macOS deployment workflow. They wanted to expand the pilot to a new set of users and add in any latest tooling/config changes that were appropriate. Printing came up again. The papercut environment was largely unchanged, but the queues had stopped working.