Mosyle Setup

Mosyle Business is an Apple device management (MDM) platform. Once connected, Junto can look up enrolled Macs, iPhones, iPads, Apple TVs, and Vision Pro devices, manage device groups and user assignments, and run remote actions like lock, restart, and Managed Lost Mode.

Mosyle is a company-scoped integration: each client's Mosyle Business tenant is connected separately with its own credentials.

Prerequisites

• A Mosyle Business tenant for the client (Mosyle Manager and Fuse are not supported)
• API access enabled in the Mosyle console
• The email and password of a Mosyle admin user in that tenant

Step 1: Get the Access Token from Mosyle

1. Log in to the client's Mosyle Business console.
2. Navigate to Organization > API Integration and enable the API integration profile.
3. Copy the Access Token displayed in the console.

Older tenants

If the tenant was previously set up with Basic Auth (now deprecated by Mosyle), create a new API token in the console to switch it to token-based authentication.

Step 2: Connect in Junto

You can connect from either location:

• Settings > Integrations > Mosyle -- Lists all your companies with their connection status. Click Connect next to a company.
• Companies > (select company) > Integrations -- Click Connect on the Mosyle card.

Fill in the three fields:

Field	Description
Access token	The API token from Organization > API Integration in the Mosyle console
Admin email	Email of a Mosyle admin user in this tenant
Admin password	That admin user's password

Click Test connection to verify the credentials, then Save. All credentials are encrypted before storage.

Double-check the tenant

The Mosyle API cannot report which tenant a set of credentials belongs to, so Junto can't detect if you accidentally enter credentials for the wrong client. Verify you're using the right tenant's credentials before saving.

To change credentials later, disconnect and reconnect with the new values.

What the Agent Can Do

Device Lookup & Inventory

Tool	Description	Risk Level
List Devices	List enrolled devices for a platform (iOS, macOS, tvOS, or visionOS) with OS version, supervision status, last check-in, assigned user, and tags	Low
Get Device	Look up a single device by serial number or UDID, including Lost Mode and Activation Lock status	Low
List Users	View Mosyle account users	Low
List Device Groups	View device groups (Mosyle's policy unit — profiles, restrictions, and apps are assigned via groups)	Low
Get Device Group	View a group's detail, including its assigned configuration	Low

Device Organization

Tool	Description	Risk Level
Update Device Tags	Replace a device's tag set (metadata only — does not change policy)	Medium
Assign Device User	Assign devices to a user for ownership tracking	Medium
Move Devices to Group	Add or remove devices from a device group — the way to apply or change policy, delivered on next check-in	Medium

Remote Actions

Tool	Description	Risk Level
Restart Device	Queue a remote reboot	Medium
Lock Device	Remote-lock a device with an optional message and phone number	High
Shutdown Device	Queue a remote power-off	High
Set Activation Lock	Enable or disable MDM-managed Activation Lock	High
Lost Mode	Enable or disable Managed Lost Mode, play a sound, or request the device's GPS location (supervised devices only)	High

Approval Required

All write actions require technician approval before execution. Read-only tools do not require approval.

How Remote Commands Work

Mosyle queues device commands and delivers them the next time the device checks in. When the agent reports a command was sent successfully, that means it was queued — not that the device has completed it. Tag updates and user assignments apply immediately.

A few actions deserve extra care:

• Locking a Mac sets a new 6-digit unlock PIN on the device. The agent records the PIN when locking — it cannot be recovered afterward, so keep it. On iPhone and iPad, locking uses the device's existing passcode instead.
• Shutdown has no remote power-on. Someone needs physical access to turn the device back on.
• Activation Lock left enabled on a device you stop managing can permanently lock it. Disable Activation Lock before offboarding a device.
• Lost Mode requires a supervised device. Play Sound and Request Location only work after Lost Mode has been enabled and taken effect on the device.

Troubleshooting

• Connection test fails -- Verify the access token was copied from Organization > API Integration and that the admin email/password are valid for that tenant. If the tenant used Basic Auth previously, generate a new API token.
• Device not found -- Mosyle keeps separate device lists per platform. Make sure you're searching the right platform (iOS, macOS, tvOS, visionOS), and confirm the device is enrolled in this client's tenant.
• Command never completes -- Commands are delivered on the device's next check-in. Offline devices won't receive commands until they reconnect.
• Lost Mode action rejected -- The device must be supervised, and Lost Mode must already be active before playing a sound or requesting location.