Management framework by Apple for the MacAdmins of today

The last few weeks were intense. I was away from my family, my day to day life, habits and work because I was doing the JAMF 200 and 300 courses and certification one after the other in a matter of two weeks.

We have been integrating JAMF for our Mac and iOS devices after working with open source programs for a while. I just got tired of the constant maintenance that deprived me of the ability to move forward on the many projects in the pipeline.

So what is JAMF?

JAMF is an Apple product management solution (not developed by Apple though). It will allow you as a Mac Admin to do what you want and asked for with your Mac fleet. While other proprietary solutions focus on integrating the MacOS and iOS in the windows environment, the main advantage of JAMF is that it’s solely focused on the Apple ecosystem and on all of its aspects. Working closely with Apple they are usually the first ones to implement new features. The fact that only one OS needs to be maintained probably simplifies the system overall complexity of their system and the possibility of bugs.

It’s a collection of tools that can simplify the day to day action There is a large community of professionals on the JAMF forums who are really helpful with any question and their support has been helpful so far, even without the 24/7 support plan. Of course, this comes at a price of about 60$ per computer per year, s no-brainer if you consider the number of technicians it can replace if implemented correctly, more on that later.

I will not go all into what JAMF does cause you can get all that info on Google but I would like to share with you how we are using it today.

Let us start with some background.

Apple is making a big step in helping Mac Admins manage their devices. And they do it the way Apple does everything, their own way. Apple is providing tools for installing software and settings remotely while maintaining security and its focus on user privacy.

This does come at a cost for the Mac Admin who got used to doing some things their own way and does not want to invest more time in tinkering with something that is already working (smart guy right 🙂

However, this will not work for long. Apple introduced some software and hardware changes over the years that will require us to adjust.

1. SIP (System integrity protection) that no longer gives you access to some of the system folders.

2. The latest Macs come with the T2 that completely blocks the option of full drive imaging.

3. User approved kernel extensions. This feature makes sure that the person who owns the computer is aware of the systems that have access to the system and hardware code.

Many were concerned with the way things were going, but Apple did listen to feedback (so far) and provided new methods to manage devices. Let’s welcome some abbreviations :

MDM – Mobile device management – A solution to manage devices. Apple does not provide one or plan to do so. They did, however, provide protocols, systems, and guidelines how an Apple MDM should work and set up the Apple-controlled backbone so that the controlling power would stay with Apple. This way they can guarantee the quality and security of their product and service

APNS – Apple Push Notification Services – This is the magic sauce that Apple is using to send commands between your Mac and the MDM to get things rolling and to perform some tasks.

DEP – Device enrollment program. This is an amazing feature. If only it was available here in Israel. What it does, is kickstarts enrollment of a Mac into your MDM of your choice. The moment you purchase any Apple device from an approved Apple reseller, its serial is automatically added to your account and with a few clicks in JAMF, you can assign it to a profile, install software and other useful things. You don’t even have to do it yourself. Ask the reseller to ship the laptop to the users home and the laptop will start “setting itself up” once it is connected to the internet for the first time. (With the latest MacOS, each computer must connect to the internet to perform activation). You (with Apple’s help) can control any aspect of the installation

VPP – Volume Purchase Program – Similar to volume license, but better. This way your company can purchase software and assign it to some users. The software is owned by you and the license is transferable. The user does not need to have an Apple ID to install any software

Apple Business Manager – This should unite the VPP and DEP into one. Supposedly it will launch in Israel and bring DEP too (fingers crossed)

GSX – Also not available in Israel yet. This allows you to see the insurance information of your device and simplify the ordering of spare parts.

JAMF – Is using all of the Apple services mentioned above to provide us, Mac admins, with an awesome experience managing Macs.

Now that we have that covered you know the Apple side lets move forwards. MacOS has several options to manage and control Macs:

1. Use the defaults command to add or modify settings, very versatile.

2. Use MacOS CLI commands that perform different actions with the OS.

3. Apple configuration profile, it’s a file that determines and enforces what your device can or cannot do. Awesome for things like making sure encryption is turned on or that the computer locks after a few mins of inactivity.

Apple really does not want us to tinker with the OS too much so that it will work as it intended. This can be clearly visible by the limiting the power of the MacAdmin and the root user of the Mac.

What they ended up doing is provide is a simpler way for us to get all that simply by toggling the features on and off in the MDM of our choice. Not all features are available but the most important ones are there.

In the next post, we will go into the workflow we use to provision MacOS devices from the moment we receive the equipment until the user of that new Mac is happily working with his new toy.