Another issue I'm facing is that several Macs are shared by multiple users. Currently, they all use one user account on each mac, but I'd like that policy to change so that each person requires a separate login. When onboarding, you can make the cert for the user or the system. It probably makes most sense to install the cert/profile for the user, rather than have a single cert tied to the system. That being the case, I may have several people logging into multiple macs, which means each user would need to "onboard" when they login to a mac they haven't previously used, right? If that's the case, is there a way to say for a certain group of people, they're allowed to onboard X number of times rather than use the global onboard limit?