I know this is already solved, but just wanted to add. I accidentally renewed the certificate with the wrong apple ID account, and all our devices had this error 'x out of x devices are missing the certificate and need to be re-enrolled.'. Thankfully, I was able to regenerate and upload into Meraki a certificate using the correct Apple account, and they all righted themselves. They were all fine in our circumstance because the original certificate was still valid.. so if you discover your mistake before the certificates expire, you might have luck if you regenerate it using the proper account... thought it was worth a mention. ... View more

Hi Phil~ I definitely feel your pain on this one!  The KEXT issues that have come with the added security of 10.13.4 do have a viable workaround (albeit a manual one): create .mobileconfig payloads that are delivered as profiles to the macbooks.  You could have individual ones or keep a master list.     Short Version: 1. Create a apple profile / .mobileconfig file that allows the application 2. In Meraki Go to  System Manager > MDM Settings > Add Profile  > Upload custom Apple profile   For details on step 1 and some excellent info from user sshort, go to this thread: https://community.meraki.com/t5/Endpoint-Management-Systems/whitelisting-kernel-extensions-via-team-id-s/m-p/21446#M2437  edit:  I see that you ran into that thread. I do agree that this shouldn't have to be a "thing".  It's taking a bit of time for developers to catch up to these added securities at the kernel level.  I will kudos your post for sure.   ... View more