MDM testing with snapshots

Testing MDM enrollment and configuration on physical Macs usually means wiping, re-enrolling, and repeating — a slow and painful loop. With CiderStack, you keep a clean pre-enrollment snapshot and restore it in seconds after each test run.

This guide walks through a snapshot-based MDM testing workflow that works with Jamf, Kandji, Mosyle, and other MDMs.

Why use CiderStack for MDM testing?

Clean state every time — Restore a snapshot taken before enrollment; no reimaging, no manual reset.
Repeatable — Same base macOS version and state for every test, so results are comparable.
Fast — APFS snapshots restore in under a second; you can run many enrollment cycles in a session.
Safe — Your host Mac is untouched; test beta OS versions or risky profiles without risk.

The workflow

Create a VM and install macOS (or use an existing image).
Before enrolling, create a snapshot (e.g. pre-enrollment).
Enroll the VM in your MDM and test (profiles, FileVault, Setup Assistant, etc.).
When done (or if something breaks), restore the snapshot to return to the pre-enrollment state.
Repeat from step 3 as needed.

Step 1: Create a VM and get to a clean state

Create a VM and install macOS if you haven’t already:

cider vm create mdm-test --cpu 4 --memory 8
cider install mdm-test --latest

Wait for installation to finish, then start the VM and complete initial Setup Assistant (language, region, account if needed) until you reach the desktop. Optionally install any base software you always want in your test image. Do not enroll in MDM yet.

Step 2: Create a pre-enrollment snapshot

Once the VM is at the desired “clean” state (e.g. fresh desktop, no MDM), create a snapshot:

cider vm stop mdm-test
cider snapshot create mdm-test "pre-enrollment"

You can add a short description:

cider snapshot create mdm-test "pre-enrollment" -d "Clean state before any MDM enrollment"

List snapshots to confirm:

cider snapshot list mdm-test

From now on, you can always return to this state by restoring this snapshot.

Step 3: Enroll and test

Start the VM and open it in the CiderStack window (or use SSH once networking is up):

cider vm start mdm-test
cider vm ip mdm-test --wait 60
cider ssh mdm-test

Enroll the VM in your MDM using your normal process (e.g. install a profile, run an enrollment script, or use Automated Device Enrollment / ABM).
Test what you need:
- Configuration profiles
- FileVault policies
- Setup Assistant / DEP behavior
- App deployment
- Compliance and restrictions
Note any failures or unexpected behavior. When you’re done with this round, you’ll restore the snapshot and try again (or try a different config).

Step 4: Restore and repeat

To wipe the VM back to the pre-enrollment state:

cider vm stop mdm-test
cider snapshot restore mdm-test <snapshot-id> -f

Get the snapshot ID from cider snapshot list mdm-test (use the ID for the pre-enrollment snapshot). Then start the VM again and you’re back at step 3 — same clean state, ready for another enrollment test.

Example loop:

# Restore clean state
cider vm stop mdm-test
cider snapshot restore mdm-test abc-123-snapshot-id -f
 
# Start and get IP for SSH or manual testing
cider vm start mdm-test
cider vm ip mdm-test --wait 60
 
# Enroll and test in the VM; when done, repeat from restore

Tips

Name snapshots clearly — e.g. pre-enrollment, post-enrollment-baseline, before-filevault-test, so you can pick the right restore point.
One VM, many snapshots — You can keep several snapshots (e.g. pre-enrollment, post-enrollment, after-profile-X) and restore to whichever state you need.
Script the loop — For automated checks, script: restore snapshot → start VM → wait for IP → run enrollment + tests → stop VM. Use cider snapshot list mdm-test --json and cider vm ip mdm-test --wait N for scripting.
Beta macOS — Use a VM with a beta IPSW to test MDM on upcoming macOS versions; snapshot before and after enrollment to compare behavior.