MDM enrollment

Activating Macs one at a time, with a code, doesn’t scale. With MDM enrollment, you create an enrollment key in the portal and push it to your Macs as a setting. Each Mac licenses itself the next time ProRDP launches, with no prompt and no one signing in.

This works with any MDM that can deploy a managed preference to a Mac, including Jamf Pro, Kandji, Mosyle, Microsoft Intune and Workspace ONE.

How it works

1. An owner creates an enrollment key in the workspace and copies it.
2. You deploy the key to your Macs as the managed preference LicenseEnrollmentToken.
3. When ProRDP next launches on a Mac with the key, the Mac enrolls itself with the licensing service and receives a license. The Mac is added to the workspace, and the portal records which key it joined with.

A Mac enrolls only when the workspace has a license for it: one is free, or the workspace buys one automatically as Macs join. For a large rollout, see Plan your licenses first.

Create an enrollment key

Only owners can create enrollment keys. Activators and Readers can see the keys, but never the keys themselves.

1. Sign in to the portal and open your workspace.

2. Scroll to Enrollment keys and fill in the form:

   Field	What to enter
   Name	A label so you can tell keys apart later, such as Design team laptops.
   Expires	Optional. The last day Macs can join with this key, in UTC, as MM/DD/YYYY. Leave it empty for no expiration.
   Max Enrollments	Optional. The most Macs that can join with this key. Leave it empty for no limit. A Mac that rejoins doesn’t count again.

3. Choose Create key.

4. Copy the key now. It starts with prordp_enr_ and is shown only this once. ProRDP keeps just a fingerprint of it, so it can’t show it again. If you lose it, make another.

Deploy the key with your MDM

ProRDP reads the key from the managed preferences of its own app domain, com.prordp.prordp.

Jamf Pro, Kandji, Mosyle and other MDMs

Use your MDM’s custom-settings feature (in Jamf Pro, Application & Custom Settings under Computers › Configuration Profiles, with the domain com.prordp.prordp) and upload this property list:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>LicenseEnrollmentToken</key>
    <string>prordp_enr_REPLACE_WITH_YOUR_KEY</string>
</dict>
</plist>

Microsoft Intune

Create a macOS profile from the Preference file template: enter com.prordp.prordp as the preference domain name and add a string property named LicenseEnrollmentToken with your key as its value. Or create a Custom profile and upload the configuration profile below.

A complete configuration profile

Any MDM that accepts a .mobileconfig can deploy this profile. Replace both identifiers with your own, generate a fresh UUID for each PayloadUUID (run uuidgen), and put your key in place:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadType</key>        <string>Configuration</string>
    <key>PayloadVersion</key>     <integer>1</integer>
    <key>PayloadIdentifier</key>  <string>com.example.prordp.license</string>
    <key>PayloadUUID</key>        <string>REPLACE-WITH-A-UUID</string>
    <key>PayloadDisplayName</key> <string>ProRDP license</string>
    <key>PayloadScope</key>       <string>System</string>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>        <string>com.apple.ManagedClient.preferences</string>
            <key>PayloadVersion</key>     <integer>1</integer>
            <key>PayloadIdentifier</key>  <string>com.example.prordp.license.preferences</string>
            <key>PayloadUUID</key>        <string>REPLACE-WITH-ANOTHER-UUID</string>
            <key>PayloadContent</key>
            <dict>
                <key>com.prordp.prordp</key>
                <dict>
                    <key>Forced</key>
                    <array>
                        <dict>
                            <key>mcx_preference_settings</key>
                            <dict>
                                <key>LicenseEnrollmentToken</key>
                                <string>prordp_enr_REPLACE_WITH_YOUR_KEY</string>
                            </dict>
                        </dict>
                    </array>
                </dict>
            </dict>
        </dict>
    </array>
</dict>
</plist>

Without an MDM, or from a script

To enroll a Mac once from a terminal or a setup script, pass the key on the command line instead:

/Applications/ProRDP.app/Contents/MacOS/ProRDP --license-enroll prordp_enr_REPLACE_WITH_YOUR_KEY

This suits a one-time provisioning step. For a fleet, prefer an MDM profile: it’s applied to every Mac you scope it to, and you can rotate the key in one place.

Make sure ProRDP is installed too

The key only licenses ProRDP. It doesn’t install it. Deploy the app with your MDM’s usual package or app flow, and deploy the profile to the same Macs. The order doesn’t matter: ProRDP looks for the key every time it launches, so a Mac enrolls whether the profile or the app arrives first.

Plan your licenses

A Mac enrolling with a key needs a license. Before a rollout, decide how the workspace gets them:

• Buy the licenses first. In the workspace, choose the number of licenses you need (see Changing your licenses). When all are used, further Macs are refused until you add more.
• Or let the workspace buy as Macs join. Turn on Buy a new license when a Mac joins and you don’t have any remaining licenses, and every Mac that enrolls past your licenses is licensed straight away, with a license added for it. This is the smoothest setting for a rollout whose size you can’t predict. Combine it with the key’s Max Enrollments to keep the bill bounded.

If the workspace has neither a free license nor automatic buying, a Mac that tries to enroll is told there’s no license for it and stays Personal. Once you’ve added licenses, a Mac enrolls the next time ProRDP launches with the key still in place.

Check that it worked

In the portal, open the workspace. The Enrollment keys table shows each key’s name, the last four characters of the key, how many Macs have joined with it, when it expires, when it was last used, and its status. The Macs table lists each enrolled Mac, with Joined with showing the key’s name.

On a Mac, open Settings › License in ProRDP. It shows the Mac as Commercial once enrollment has finished, usually within a few seconds of launch.

You can check that the profile landed with:

defaults read com.prordp.prordp LicenseEnrollmentToken

Limits, expiry and revoking

To revoke a key, choose Revoke beside it in Enrollment keys, and confirm.

A key’s status is Active, Full (it has let in its maximum number of Macs), Expired or Revoked.

Revoking, expiry and limits only stop new Macs from joining. To take a license off a Mac that’s already enrolled, deactivate it.

Rotating a key

To replace a key, for example when someone who knew it leaves, or on a schedule:

1. Create a new key with the same limits.
2. Update the profile in your MDM with the new key and let it deploy.
3. Revoke the old key once the new profile is on your Macs.

Macs already licensed aren’t affected. They keep refreshing their own license, and don’t use the key again.

Troubleshooting

The Mac stays Personal. Check, in order:

1. Is the key on the Mac? Run the defaults read command above. If it prints nothing, the profile hasn’t arrived, or its domain or key name is misspelled. Both are case-sensitive.
2. Is the key still usable? In the portal, the key must be Active. A revoked, expired or unknown key is refused as unauthorized.
3. Is it full? A key that has let in its maximum number of Macs is refused. Raise its limit by making a new key.
4. Does the workspace have a license? If every license is in use and automatic buying is off, the Mac can’t join. Add licenses, or turn automatic buying on.
5. Is the subscription active? A cancelled or unpaid workspace can’t take new Macs. See When a payment fails or a subscription ends.
6. Can the Mac reach portal.prordp.app over HTTPS? Check your firewall, proxy or content filter. ProRDP needs that connection to enroll and to refresh its license.

The same Mac was wiped and enrolled again. It takes back its own license and counts once, even against the key’s limit.

I need to see what the key was used for. The Macs table in the workspace records how every Mac joined, and which key, by name, it used.

Automating with the workspace API

An owner can also create and revoke enrollment keys from a script, with a service principal that has a role in the workspace. See Roles and members.