Apple Device Management
Posted by Beneficial_Can_1082@reddit | sysadmin | View on Reddit | 21 comments
Happy Monday!
Our firm is starting to hire in-house creative professionals, which is a first for us. Currently using a Windows environment (Server/Endpoint) for our entire org. These new creative professionals are adamant on using Mac devices, but we want to make sure we can fully manage them, keep them tied to a corporate account or something similar. We also want to have more control/management over some employee Apple devices (iPhones, iPads).
I've never managed Apple devices in a professional setting before, so unsure what service to use. In my last job, outsourced IT, I remember trying to help several clients with Apple devices rogue employees had signed into with their personal iCloud accounts and it was a nightmare. I want to make sure these devices are tied to our organization to prevent anything like that from happening.
Any recommendations are welcome. Thank you!
Upper-Bath-86@reddit
Avoid Intune. Jamf is probably one of the best. We are in a mixed environment so we use the MDM in Kaseya VSA. It works great most of the time and it can work with ABM.
BossSAa@reddit
Kaseya VSA MDM, is great for this. It centralizes control over both Windows and Mac devices.
BWMerlin@reddit
First thing is to sign up for Apple Business Manager (ABM). This is used for the Apple Device Enrolment Programme (DEP) which allows you to purchase devices from Apple authorised sellers and have the seller load those devices into your ABM which points to your MDM so when a user gets a new device straight out of the box it will dial home to Apple, see your MDM and start the process of configuring the device.
While you are setting up your ABM you should setup Managed Apple ID's.
Beneficial_Can_1082@reddit (OP)
Thank you! I will look into ABM.
MrYiff@reddit
Also once you have ABM setup speak to who you normally buy hardware from and find out if they have an apple reseller number (I think thats the term), once you get this you can add it to your ABM account and this is the magic that allows purchases to automatically register to your account (and then into your MDM of choice).
This is handy aswell if any devices get lost or stolen as until you remove them from your ABM account they will always register to your set MDM (I've only done this with phones but I assume it works similarly for macs too).
jmnugent@reddit
Parent comment is correct. ABM (Apple Business Manager) is basically the corporate version of "iCloud Activation Lock". If a company-owned MacBook gets factory-wiped,.. when it reboots it's going to come right back up asking for the @Company.com Email address and Password to re-enroll it. It remains yours (locked to your company) until you go into Apple Business Manager and "Release" the Serial Number.
Your MDM is what pushes down all the Configuration Profiles or Restrictions of how the device is configured. So if you want to hide the App Store or require Full Disk Encryption or force the screensaver to lock at 5min or whatever you want to do with the machine,. all of those Configuration Profiles come from your MDM.
Worth-Definition-133@reddit
Jamf
This is the way to go. Talk to your VAR about getting your a meeting. Don’t have a VAR? Talk to me !
StarOk5423@reddit
You can try ABM with Scalefusion MDM it's a cross-platform solution where you can manage multiple OS
stesha83@reddit
ABM + Jamf or Intune
National_Display_874@reddit
As some of them mentioned here, we recommend using Apple Business Manager (ABM) with an MDM solution like SureMDM to fully control Apple devices, from activation to applying necessary policies and restrictions.
By linking devices to ABM and MDM, they can be set up automatically with predefined configurations, eliminating manual setup. This also allows supervision for more detailed control.
Most importantly, enabling Locked Enrollment prevents users from removing MDM management, which is essential for securing corporate data and devices. Yes, you can also manage your Windows devices similarly, bringing everything under one umbrella.
basikly@reddit
Having some experience with Jamf, I found that for a simple environment, Kandji was extremely easy to set up and manage. We had a good account executive and a person assigned to us to help get everything off the ground. I’m a very hands on type of person and took about a week to get things working, and 2-3 weeks to have everything I wanted set up. You mentioned you use Windows Server for authentication, so I’m going to assume you mean AD? I’m guessing you might have some sort of MFA/IdMP as well, which can be easily integrated with Kandji
I’ve left that environment, but was using Kandji to manager about 20 MacBooks and 50 iPads (most iPads were used to run our zoom rooms).
Kandji requires a minimum purchase of 100 total device licenses if I recall correctly. But you can separate it into 50 MacBooks and 50 iOS licenses to make the cost a little cheaper. I’m probably not allowed to share pricing, so I won’t disclose that.
Having said that, Jamf would allow more granular customizations, but if you’re trying to keep it simple, Kandji is way easier to manage and set up. When support is needed, you’re put in touch with a live person pretty quickly (within minutes).
…wow didn’t mean to come off as a salesperson for them.
I’m in a much larger environment now that uses Jamf, and while it works, I do miss my simpler environment.
mexicans_gotonboots@reddit
ABM plus Kandji
pesos711@reddit
ABM plus Addigy
Dizzy_Bridge_794@reddit
MDM with Intune and ADM.
IDontWantToArgueOK@reddit
Mosyle is free for up to 30 devices and really nice with the exception of some UI stuff. But yeah you need ABM first no matter what you decide.
Fickle_Bit1481@reddit
We use Apple Business Essentials for our 25is Apple Devices. It’s simple, but meets our needs.
nccon1@reddit
We use manage engine cloud MDM and it’s done exactly what we have needed. We have about 150 devices from one customer through ABM
gaybatman75-6@reddit
You want jamf + abm + dep + jamf connect and it should be straight forward.
That_Description4759@reddit
Jamf
Coldwarjarhead@reddit
What do you use to manage your Windows devices?
intone can manage iOS and macOS devices...
Beneficial_Can_1082@reddit (OP)
We currently use a Windows Server to manage employee user accounts, and Datto RMM for device management. Datto RMM can also manage macOS devices just fine, but we are most worried about the user managment.