Skip to main content
AgenShield installed. The Mac has the app, the service answers, agenshield status looks reasonable — and the device is nowhere in the Frontegg Portal. The campaign timeline shows Script fetched but never Registration. The software is installed. It just does not know which organization it belongs to.

​
Confirm it is this

On the affected Mac:
Under Cloud, an enrolled device names your backend URL and shows a device identity. An unenrolled one reports that setup is incomplete or that no cloud credentials exist. The install log names every place it looked for your enrollment details:
That block lists each source it checked and which user’s home it checked against. If it names a home that is not the one the person actually signs in with — most often /var/root — you have this problem.

​
The usual cause: the install ran as root, for a different account

AgenShield keeps per-user state in the signed-in user’s home. Before release 2026.9, the install command worked that directory out from the environment it happened to inherit. Run by a person in their own Terminal, that was right. Run by an MDM script runner — JumpCloud Commands, a Kandji custom script, a Mosyle custom command, a Jamf policy script, or over SSH — the environment belongs to root, so the enrollment details were staged into root’s home and the installer looked for them in the signed-in user’s. Nothing matched, and nothing said so: the install reported success. Two other causes produce the same symptom:

​
Fix it

1

Upgrade to 2026.9 or later

Releases from 2026.9 resolve the signed-in user themselves, so an install run as root with nobody at a terminal enrolls correctly with no wrapper. They also fail loudly — the command exits non-zero — when a device does not finish enrolling, so a green result in your MDM means the device is really on your fleet.
2

Or enroll the machine in place

The software is already installed and does not need reinstalling. Run this as the person who signs in to the Mac, with the token from your campaign:
3

Confirm

The device appears under Devices in the Frontegg Portal within a minute, and the campaign timeline gains a Registration entry.

​
If the Mac has several accounts

Name the one AgenShield should install for, rather than letting the installer choose:

​
A Mac with nobody signed in is a different case

On a freshly imaged Mac sitting at the login window there is no account to install for yet. That device still enrolls, and its extensions activate at the first login — the same as a package deployment. That is expected, not this problem. See MDM enrollment.

​
Escalate

If enrollment still does not complete, collect a diagnostics bundle and open a ticket:
See Collecting diagnostics. Never paste a raw enrollment token into a ticket — reference the campaign by name instead.

MDM enrollment

What the profile delivers and how to verify a device landed.

Other MDMs

Script-runner deployment, and the options for unattended installs.