Managing several Macs
Sign on one machine, deploy to many, and keep the key off them.
On this page 4 sections
Local admin mode keeps the signing key on the Mac it manages, which is fine for one person and wrong for an organisation. For several Macs, keep the private key on a machine you control and give each Mac only the public half.
On the machine that holds the key#
msl admin keygen
msl admin sign policy.jsonkeygen prints the public key. Keep the private half here and nowhere else.
On each managed Mac#
msl admin pin <base64-public-key>
sudo msl admin enrol policy.jsonpin says "trust policies signed by this key". enrol puts the policy in the root-owned location. Those two together are what the Enforceable rung means.
The key never arrives
A Mac that has only the public half can verify a policy and cannot create one. That is the difference between a fleet deployment and a local one, and it is the whole reason to do it this way.
Updating a policy#
Sign a new one and enrol it. Macs pick it up on the next check — nothing needs reinstalling, and an instance that is running keeps running.
What this does not need#
No server, no agent, no account. A policy is one signed JSON file; getting it onto the Macs is whatever you already use for files — your MDM's file deployment, a script, a shared drive.