# How MDM Leverages macOS Bootstrap Token Feature to Ease Device Management?

Last updated: July 24, 2026

This guide explains how Mobile Device Manager Plus uses the macOS Bootstrap Token feature (macOS 10.15+) to simplify software updates, new local user account creation, and device wipes without requiring user interaction. The token is generated on the Mac and escrowed to MDM automatically at the first SecureToken-enabled login, with escrow behavior differing between Automated Device Enrollment and User-Initiated Enrollment. The `profiles` command-line tool can be used to install, remove, check the status of, and validate Bootstrap Tokens.

Bootstrap Token is an Apple-introduced feature (macOS 10.15+) that simplifies device management workflows for IT admins. ME MDM supports Bootstrap Token escrow, enabling seamless management of macOS devices.

## Key Benefits of Bootstrap Token

1. **Software Updates:** Bootstrap Token allows MDM to bypass admin authorization during issuing Software Update Command by MDM. As a result, all software and patch updates deployed through [EndpointCentral UEM](https://www.manageengine.com/products/desktop-central/help/mac-patching-user-intervention.html) on managed macOS devices install seamlessly without requiring user interaction.
2. **New Local User Account Creation:** Device uses a Bootstrap Token escrowed to MDM to automatically generates a SecureToken for any user account created during first login—whether through:
   - Users & Groups
   - EndpointCentral UEM User Management
   - Platform SSO account creation in the login window
   - Mobile account login in the login window
3. **Erase All Content and Settings:** The Bootstrap Token enables MDM to perform a silent erase of macOS device when executing a Complete Wipe command. It ensures that the operating system remains intact while only removing user data, eliminating the need for manual user intervention.

## Bootstrap Token Creation and Escrow Steps

The Bootstrap Token is generated on the macOS device and escrowed to MDM when the first SecureToken-enabled user logs in for the first time.

1. **Automated Device Enrollment (ABM/ASM Workflow):** The Bootstrap Token is created and escrowed to MDM when the first user logs in, either:
   - During Setup Assistant (as a Primary Account)
   - Or as a Managed Administrator
2. **User-Initiated Enrollment (Self/Invite Enrollment):** The Bootstrap Token is generated and issued to MDM when the first SecureToken-enabled user logs in via the Login Window.

## Bootstrap Token Management Through `profiles` Command

**Note:** Bootstrap token is created by the Operating Sysyem (OS) and will be Set / Removed / Retrieved from the MDM by OS, There is no manual intervention needed from IT Admins to enable this feature. Incase when there is a need to work on it (or) need for troubleshooting the below commands can be used.

The `profiles` command-line tool provides several operations for managing Bootstrap Tokens on macOS:

1. **Install a Bootstrap Token:**

   ```bash
   sudo profiles install -type bootstraptoken
   ```

   **Function:** This command creates a new Bootstrap Token and automatically escrows it to the MDM server. To execute this operation successfully, the system requires authentication from an existing Secure Token administrator for initial token generation. ManageEngine MDM by default supports escrowing Bootstrap Token.

2. **Remove a Bootstrap Token:**

   ```bash
   sudo profiles remove -type bootstraptoken
   ```

   **Function:** Deletes the existing Bootstrap Token from the Mac and revokes it from MDM.

3. **Check Bootstrap Token Status:**

   ```bash
   sudo profiles status -type bootstraptoken
   ```

   **Function:** This command verifies whether **Bootstrap token is support by MDM** and **Bootstrap token is escrowed to MDM or not.**

4. **Validate Bootstrap Token Support:**

   ```bash
   sudo profiles validate -type bootstraptoken
   ```

   **Function:** The command retrieves the bootstrap token from MDM and validates.

## Frequently Asked Questions

### What does the macOS Bootstrap Token actually do for device management?

It lets MDM bypass admin authorization for software updates, automatically generate a SecureToken for new local user accounts, and perform a silent Complete Wipe without requiring user interaction.

### Do I need to manually set up the Bootstrap Token on each Mac?

No. The token is generated by macOS and escrowed to MDM automatically at the first SecureToken-enabled login; manual `profiles` commands are only needed for troubleshooting.

### How does token escrow differ between Automated Device Enrollment and User-Initiated Enrollment?

With Automated Device Enrollment (ABM/ASM), the token escrows when the first user logs in as a Primary Account or Managed Administrator during Setup Assistant. With User-Initiated Enrollment, it escrows when the first SecureToken-enabled user logs in through the Login Window.

### How can I check whether a Mac's Bootstrap Token is escrowed to MDM?

Run `sudo profiles status -type bootstraptoken` on the Mac to verify whether the Bootstrap Token is supported by MDM and whether it has been escrowed.