diff --git a/changes/38205-remove-incorrect-eua-warning-for-macos b/changes/38205-remove-incorrect-eua-warning-for-macos
new file mode 100644
index 0000000000..87c58e3033
--- /dev/null
+++ b/changes/38205-remove-incorrect-eua-warning-for-macos
@@ -0,0 +1 @@
+- Removed a debug-level warning asserting that macOS devices were unauthenticated when enrolling to Fleet.
diff --git a/server/service/orbit.go b/server/service/orbit.go
index b56bbb88ca..c262af72c8 100644
--- a/server/service/orbit.go
+++ b/server/service/orbit.go
@@ -196,17 +196,26 @@ func (svc *Service) EnrollOrbit(ctx context.Context, hostInfo fleet.OrbitHostInf
 			return "", fleet.OrbitError{Message: "failed to get IdP account: " + err.Error()}
 		}
 		if idpAccount == nil {
-			// If the Orbit client doesn't support end user auth, complain loudly and let the host enroll.
-			mp, ok := capabilities.FromContext(ctx)
-			//nolint:gocritic // ignore ifElseChain
-			if !ok {
-				level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
-			} else if !mp.Has(fleet.CapabilityEndUserAuth) {
-				// Quieting this error until https://github.com/fleetdm/fleet/issues/37134 has a proper fix.
-				level.Debug(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
-			} else {
-				// Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate).
-				return "", fleet.NewOrbitIDPAuthRequiredError()
+			// Get the host platform.
+			h := fleet.Host{
+				Platform:     hostInfo.Platform,
+				PlatformLike: hostInfo.PlatformLike,
+			}
+			platform := h.FleetPlatform()
+			// Orbit enrollment is only gated by end user auth for Linux and Windows hosts.
+			// For macOS hosts the MDM enrollment process handles end user auth.
+			if platform == "linux" || platform == "windows" {
+				// If the Orbit client doesn't support end user auth, complain loudly and let the host enroll.
+				mp, ok := capabilities.FromContext(ctx)
+				//nolint:gocritic // ignore ifElseChain
+				if !ok {
+					level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
+				} else if !mp.Has(fleet.CapabilityEndUserAuth) {
+					level.Warn(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
+				} else {
+					// Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate).
+					return "", fleet.NewOrbitIDPAuthRequiredError()
+				}
 			}
 		}
 	}