> For the complete documentation index, see [llms.txt](https://docs.parallels.com/landing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.parallels.com/landing/pd-ag/parallels-desktop-for-mac-enterprise-edition-features/restricting-parallels-desktop-activation-to-managed-macs.md). # Restricting Parallels Desktop Activation to Managed Macs When deploying Parallels Desktop to end users in your organization, you might want to ensure that company license is only used on Mac's that are managed by your organization. This article describes best practices for administrators who wish to prevent end users from activating Parallels Desktop Enterprise Edition licenses on personal or unmanaged Mac computers. This way, you can also secure your corporate VMs by [encrypting them and binding to your Parallels subscription](/landing/pd-ag/parallels-desktop-for-mac-enterprise-edition-features/encrypting-a-virtual-machine-using-the-command-line.md). #### For activations using license key When deploying Parallels Desktop using a license key, standard deployment methods ensure that the actual license key is not exposed to the end user. This significantly minimizes the risk of the license being used on unauthorized machines. To ensure the key remains hidden, administrators should utilize one of the following deployment methods: * **License Management Portal Invitations**: Sending [activation emails](https://kb.parallels.com/124428) directly via the Parallels My Account portal, they contain temporary activation keys different from one registered. * **MDM Solutions**: Deploying via JAMF or similar endpoint management systems using configuration profiles as outlined in the [respective section](/landing/pd-ag/provisioning-and-activation-of-parallels-desktop/mass-deployment-using-mac-management-tools.md) of this guide. * Mass Deployment Packages: creating a deployment package that embeds the license key. In these scenarios, the activation process is automated, and there is no direct interaction with the license key on the part of the end user. #### For SSO based activations If your organization utilizes Single Sign-On (SSO) for activation, you can restrict usage to corporate devices by enforcing conditional access policies within your Identity Provider (IdP). Administrators should configure the IdP to allow login to the Parallels Desktop application only from devices that are compliant or exist within a managed environment. The specific configuration steps vary depending on your Identity Provider. To illustrate this concept, please refer to the documentation for your specific IdP regarding "Conditional Access" or "Device Trust" policies. For example, here are some references on the matter from Okta and Entra IdP's: **Okta**: [Okta Device Trust: Integration Setup](https://support.kandji.io/kb/okta-device-trust-integration-setup) ; [Managed devices | Okta Identity Engine](https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/managed-main.htm) **Entra**: [Microsoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview) ; [Filter for devices as a condition in Conditional Access policy - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices#supported-operators-and-device-properties-for-filters) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.parallels.com/landing/pd-ag/parallels-desktop-for-mac-enterprise-edition-features/restricting-parallels-desktop-activation-to-managed-macs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.