Cross-platform UEMs: ManageEngine MDM Plus, SOTI MobiControl, Hexnode

These three manage every platform from one console, so this guide is organised by tool and then by platform. The payloads are the ones from the platform guides: the Windows script (guide 2 section 3) or registry values (guide 3), the macOS profile and root script (guide 4), the iOS app configuration keys and Safari declaration (guide 5). What each tool can do is summarised first.

1. ManageEngine Mobile Device Manager Plus#

Windows#

1. Device Mgmt → Profiles → Create Profile → Windows → Custom Script (or Scripts under Device Mgmt in newer builds). Upload the PowerShell script from guide 2 section 3 with your key. Execution: run as System, on device check-in and repeated daily.
2. Alternatively Profiles → Windows → Registry: add the values from guide 3 section 2c as Registry Settings; MDM Plus substitutes %username%, %email% and %devicename% in string values, which removes the need for a script.
3. Force-install: add ExtensionInstallForcelist value 1 = bbgoikmidjfiaaadlgkpdlppilhkjfke;https://edge.microsoft.com/extensionwebstorebase/v1/crx under HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist in the same Registry profile, and the Chrome equivalent.
4. Associate the profile with the Windows group.

macOS#

1. Profiles → Create Profile → macOS → Custom Profile → upload the force-install mobileconfig (guide 4 section 1).
2. Device Mgmt → Scripts (or Custom Script profile) → upload the root shell script from guide 4 section 2, run as root, daily.
3. App Mgmt → App Repository → Apple Business Manager apps → “SafeToOpen Online Security” → distribute silently.

iOS and iPadOS#

1. App Mgmt → App Repository → add “SafeToOpen” from Apps and Books (https://apps.apple.com/us/app/safetoopen/id1588042602) → App Configuration → add the four keys (enrol_key, user_name = %email%, asset_name = %devicename%, domain_name). Distribute silently to the group.
2. Profiles → iOS → Safari extension management, if present in your version, State AlwaysOn; otherwise the user enables the extension once.

Android#

App Mgmt → App Repository → Play Store → Microsoft Edge → distribute silently. The extension itself and the activation link remain the user’s step; see guide 7 for the reason and the email flow.

2. SOTI MobiControl#

Windows#

1. Profiles → New Profile → Windows Modern (or Windows Desktop Classic for agent-managed PCs) → Configurations → Script. Paste the PowerShell script from guide 2 section 3; run as System. Assign to the device group; add a schedule rule (daily) so new users on a device are picked up.
2. Classic agent: Actions → Run Script achieves the same on demand. SOTI macros %DEVICENAME% and %ENROLLEDUSER% can replace the lookups in the script.
3. Force-install can also be set as Windows Modern → Configurations → Custom Settings (OMA-URI / Registry CSP) as in guide 9 section 8.

macOS#

1. Profiles → New Profile → macOS → Configurations → Custom → upload the force-install mobileconfig.
2. Configurations → Script → the root shell script from guide 4 section 2, run as root, with a schedule.
3. Applications → Enterprise App Catalog → Apple VPP → “SafeToOpen Online Security” → mandatory install.

iOS and iPadOS#

1. Applications → App Catalog → Apple VPP → “SafeToOpen” → mandatory. Under the app, Application Configuration → add the four keys; use %ENROLLEDUSER% for user_name and %DEVICENAME% for asset_name.
2. Profiles → iOS → Custom (Declarations) → Safari extension settings, where available in your MobiControl version.

Android#

Applications → App Catalog → Managed Google Play → Microsoft Edge → mandatory. Extension install and activation link stay with the user (guide 7). SOTI’s Android Enterprise app configuration for Edge has no extension keys.

3. Hexnode#

Windows#

1. Manage → Devices → select devices → Actions → Execute Custom Script, or Policies → Windows → Scripts → upload SafeToOpen-Enrol.ps1 (the script from guide 2 section 3). Hexnode runs scripts as System. Add it to a policy with a schedule so it repeats daily.
2. Hexnode wildcards %devicename%, %email% and %username% work inside script files, so $upn = "%email%" and $asset = "%devicename%" can replace the lookups.

macOS#

1. Policies → macOS → Configurations → Deploy Custom Configuration → upload the force-install mobileconfig.
2. Policies → macOS → Scripts (or Actions → Execute Custom Script) → the root script from guide 4 section 2, scheduled.
3. Policies → App Management → Mandatory Apps → VPP → “SafeToOpen Online Security”.

iOS and iPadOS#

1. Policies → iOS → App Management → Mandatory Apps → VPP → “SafeToOpen”.
2. Policies → iOS → App Configurations → select the app → add the four keys with %email% and %devicename%.
3. Policies → iOS → Safari (extension management) if your Hexnode plan shows it; otherwise the user enables the extension once.

Android#

Policies → Android → App Management → Mandatory Apps → Managed Google Play → Microsoft Edge. Extension install and activation link remain with the user (guide 7).

4. Verify in any of the three#

1. Windows: edge://policy / chrome://policy show the force-list and the four values under the extension ID.
2. macOS: chrome://policy shows them; defaults read on the managed preference domain prints the values (guide 4 section 5).
3. iOS: Settings → Safari → Extensions shows SafeToOpen; the app shows the organisation name once registered.
4. Console → Settings → Unattended enrolment → Enrolled devices lists Windows, macOS and Linux devices as they start their browsers. Apple devices appear under People once their activation link is used.