Last updated: August 14, 2026
AD Asset binding
This page explains how to use MDM to remotely bind macOS devices to an on-premise Active Directory (AD) using an AD asset binding policy, eliminating the need for manual intervention or third-party plugins. It covers prerequisites, configuration settings including hostname, username, password, and Organizational Unit (OU) path, as well as device access settings such as network versus mobile access types and granting AD user groups local administrator privileges on Mac machines.
With Active Directory being the primary identity and authentication mechanism, Mac machines required a plugin/application for AD integration or manual intervention to bind Mac machines to Active Directory. MDM lets you achieve this remotely in devices using AD asset binding policy. In addition to basic AD account addition, you can also configure additional settings such as granting local admin privileges and account type. Supported only for On-Premise AD.
Pre-requisites
- Mac machines must be able to contact the Active Directory
- A valid OU path.
Profile Description
| Profile Specification | Description |
|---|---|
| Active Directory Settings | |
| Hostname | Specify the Hostname (Domain name) of your organization's Active Directory to which the Mac machines need to be added. |
| Username | Enter the Username of the AD admin account to authenticate and bind the device with AD domain. |
| Password | Enter the password of the AD admin account. |
| Organizational Unit (OU) path | You need to add the OU path to which the machines needs to be grouped under. You can obtain the OU path by executing the command dsquery user -name <admin-user-name>* on Command Prompt. This is a sample OU path: CN=Your IT Admin Name,OU=Your enterprise OU,OU=A branch,OU=Your Organization,DC=subdomain,DC=Your organization domain,DC=Your top level domain This command must be executed in the Command Prompt on a Windows Server where the Active Directory Domain Controller is running. Ensure you have the necessary administrative privileges to run this command. |
| Device Access Settings | |
| Access Type | Define the scope of access for the users. If you choose Network, users can access their Mac machines using AD credentials only if they can connect to their organization AD. This option can be ideally used in case of Mac machines present in the organization network. If you choose Mobile, users can access their Mac machines using AD credentials anywhere, irrespective of if the machine can connect to the organization AD or not. This option can be ideally used in case of field employees or employees working from remote locations. |
| AD user groups to be granted Admin privileges | Specify the AD user groups to be granted local administrator privileges on Mac machines. |
Frequently Asked Questions
What is the difference between Network and Mobile access type?
Network access requires the Mac to be connected to the organization's Active Directory to authenticate with AD credentials, while Mobile access allows AD credential-based login from anywhere, regardless of network connectivity.
Is Active Directory Binding supported for cloud-hosted AD?
No. This profile is supported only for On-Premise Active Directory.
Where do I find the OU path for my organization?
Run the command dsquery user -name <admin-user-name>* in Command Prompt on the Windows Server hosting the Active Directory Domain Controller.