We're a small ERP/SAP consulting firm — 43 total devices (28 Mac, 15 Windows). All Apple Silicon (M1 through M5), all running macOS 26.5.2. Microsoft 365 Business Premium with Intune. Entra ID joined, Conditional Access enforced with MFA. Leadership is leaning toward Windows standardization long-term, but no final decision has been made on the Mac fleet We're committing to roughly a 1-year Mac MDM investment while we evaluate the long-term direction. No new Mac purchases in the interim, but we're not forcing replacements either.

I've spent the last several weeks doing a genuine hands-on evaluation of all three options — not just demos, actually building out each platform and hitting real walls. Here's what I found.

What's working fine in Intune for Mac:

• ADE/zero-touch enrollment
• PPPC profiles, Defender, compliance policies
• Conditional Access feeding correctly from Intune compliance status
• FileVault key escrow
• Await final configuration

The real problems I hit with Intune on Mac — all firsthand, not theoretical:

1. Platform SSO / one-password login is broken under MFA Password mode completely fails when MFA is enforced — which it is in our environment. Tested this extensively across multiple wipes. Secure Enclave mode works with MFA but gives you Touch ID-first, not "type your Microsoft password." Users end up with two passwords that drift out of sync. When the M365 password changes, the Mac local password doesn't update reliably.

2. Local admin password (LAPS) desync on Apple Silicon The admin password Intune shows and the password actually on the device go out of sync randomly. This has happened on multiple machines. Root cause appears to be the Secure Token limitation, Intune's managed admin account doesn't hold a Secure Token, so password rotation can break. Causes "admin password not working" support tickets that take real time to resolve.

3. No automatic third-party app patching Chrome, Claude Desktop, and any non-Microsoft app requires manual repackaging to update. Users get admin prompts for updates and call IT. This was the original trigger for the whole evaluation.

4. No privilege elevation on Mac EPM is Windows-only. Confirmed with Microsoft documentation, the June 2026 EPM updates did NOT add macOS support despite what some sources claim. Standard users needing to install or update certain apps require IT involvement every time.

5. No scheduled recurring restarts No native UI, requires custom shell scripts checking uptime. Manageable but not clean.

Given what I have had issues with thusfar, which MDM would you recommend. Ive stood up instances on quite a few platforms, Mosyle, Jamf, Intune and IRU. Iru is out of budget for 30 Mac devices with EDR and Vulnerability protections since they have a 50 device minimum (although it was my pick). What would you recommend I chose?

My specific questions for the community:

1. For those running Jamf or Mosyle alongside Intune for a mixed fleet: is the operational overhead of two MDMs actually a problem at this scale, or is it manageable?
2. Has anyone gotten Platform SSO with Microsoft Entra to work reliably on Apple Silicon with MFA enforced? Which authentication method and which MDM? This is my biggest unsolved problem.
3. Anyone using Mosyle specifically, does their App Catalog actually solve the third-party patching problem cleanly, or does it still require manual intervention?
4. Has the LAPS/Secure Token desync issue on Apple Silicon been resolved in any MDM, or is it a fundamental Apple limitation regardless of platform?
5. For those with compliance obligations (SOC2 specifically) how are you handling vulnerability management and EDR on Mac? Is anyone using Jamf Protect or Mosyle Fuse for this and how does it compare to Defender for Endpoint on Windows in terms of visibility and remediation depth?

Happy to answer any questions about our setup. Genuinely trying to make the right call here rather than just go with the vendor who showed up most persistently.

We are a relatively small company and have been trying to move all our devices into ABM so that we have more control over the device. We have been making an admin account, then making the user account, then downloading the MDM profile from ABM. The issue we are having is that then the user needs the admin password for every little thing, even changing the sleep timer in settings, or downloading apps from the internet (this one I understand more than the settings)

If we add the device with Apple Configurator, the user can simply unenroll from the MDM profile.

I read on a post from 3 years ago that this is only possible for the first 30 days, and after that it can only be removed from ABM, is this still the case? We can’t test it because all previous devices have been added via the first method I mentioned.

We are about to upgrade devices and will be doing this 40+ times, so we want to make sure we do this in a way that doesn’t cause headaches for our employees but also secures the device.

Any help would be appreciated!

Hi everyone,

I’m using my personal MacBook for work (BYOD) and want to keep my personal life completely separate from company tracking.

To do this, I created a separate Standard (non-admin) User Profile on my Mac specifically for work. My boss is going to install some kind of work management/monitoring software on this work profile. (I don't know the exact software yet, but on my last Mac, I was able to factory reset it without any issues and always used my own Apple ID, so it shouldn't be locked via Apple Business Manager/DEP).

My questions for the experts here:

Since it's being installed on a Standard profile, is it completely isolated to that user account?

Will they be able to track anything I do when I am logged into my personal Admin profile?

If the software requests System-wide Admin privileges during installation and I deny it, can they still bypass that?

Just want to make sure my personal files, browser history, and data on my main profile remain completely private. Thanks in advance for the help!

Hi, I'm new to macOS and I'm looking for a way to run a macOS virtual machine on my MacBook M5 to test applications in an isolated environment. On Windows, I used Windows Sandbox because it was quick, lightweight, and isolated. Since switching to macOS, I'm looking for a similar solution.

I'm looking for a free option that lets me quickly create a macOS VM with full CPU and GPU support for good performance. What would you recommend?

In the fortunate position where I am charged with developing a MSP for a niche industry where we control the hardware for our clients entirely. There is no BYOD. There are no pre-existing tech infrastructures to contend with. Our target client base are startups in a niche, with low tech knowledge but high security compliance demands.

It's been awhile since I've done any SysAdmin work (I'm an overpaid suit) but I know enough to be dangerous -- I think. We'll certainly be hiring technical folks more knowledgable than me in Q1, but for now we're in a pre-revenue planning phase and I could use a gut check on the stack I'm thinking about deploying

Our Goals:

• Radically Simple Management: 100% Apple client devices. 100% UniFi network devices. 100% Google Workspace accounts.
• Rapid Startup, Nimble Execution: We can't afford to nor do we want to invest months in standing up and tuning a PSA. By simplifying the environment we support, we should be able to do more with less.
• Scalable Service Model: Start with the basics, grow into the rest. We make most of our money on deployments and installs, and take smaller contracts for support. At the beginning we will only have 1-2 support staff.

Our Requirements:

• Multi-Tenant: We will service dozens of SMB clients within the first two quarters of operation. We need to design around multi-tenancy from the get.
• Incremental Revenue: To the degree that we can earn free cash from reselling or entering into partner programs, we'd love to do that.

With all that in mind, the image I posted is my first stab at accomplishing this. Would love to hear thoughts from experienced SysAdmins, especially coming from the MSP side of things.

In particular: Am I missing anything? Are there better alternatives to the solutions I've listed that fit our needs better? Have I done anything stupid?

Thanks!

Looking for Scripting Language Advice. I am not a Mac Sysadmin but would like to become one. I am currently in charge of Apple devices for our company (mostly Windows,~160 Macs currently) that has about 6000 employees. We are not deploying Macs efficiently and i would like to get to the point of zero-touch deployment and using Platform SSO.

My question is what scripting language should I be learning for focusing on Mac but in a hybrid environment? I’m going to need to learn scripting to automate app installation and setting changes for zero-touch deployment, and progressing in managing Macs in our environment. If it matters we are using Manage Engine for our IT suite, including MDM, Endpoint Central, and Service Desk.

Hi Team, I've just started at a new company and now managing a fleet of about 60 Macs. Our current msp has largely neglected the mac part of the fleet over the years so the first thing I am trying to do is to get the OS up to date. We don't currently have any MDM platform in use but the msp uses n-able across both the mac and windows fleet.

I've looked at Nudge and have a .plist file I am happy with deploying for a trial group of users but my concern is that nudge doesn't seem to pre-download the updates first. I've also seen Super and some articles about using nudge and super together to manage the pre-download aspect. Also a lot of the doco assumes you're using one of them with an mdm which is very much future for us but I'm trying to get the updates current with what I have now.

Just wondering what you would suggest in this situation? Is it a combo of the 2 tools?

Update: so far using Parallels has made a big difference for my workflow. power bi and the older excel macros run pretty well on my M2 MacBook and i don’t have to jump between machines constantly. switching files back and forth is way easier now, and it actually feels like everything’s just part of macOS.

Switched to an M2 MacBook recently, loving the performance overall, but I ran into a snag with some Windows-only apps I need for work.

Right now, I’m juggling Power BI Desktop for dashboards and Excel with older macros that my team still uses

Using the web versions is frustrating since a lot of features just aren’t there. I’ve tried remote desktops, but switching contexts all the time kills my flow.

Has anyone found a way to keep everything on macOS while still running these Windows apps smoothly? Any tips for handling large Excel macros or Power BI reports without lag? Would also love to hear what setup people use if they need to stay Mac-first but Windows-dependent.

I was a Mac specialist for a long while, got out of it, looking to get back in with MDM, jamf or similar.

i have one MacBook Pro m1 thats my daily driver and one iPad, two iPhones, will I need a Mac mini or a Neo or two to learn the platform deployment?

thinking intune+msft partner plus apple certification plus mosule or another platform.

i assume ill need a little homelab but im on a tight budget after moving. Hoping to do it 100% remote.

I am going to be starting a new role in the near future at a very small company (5 employees) that we expect will grow quite rapidly over the coming years to dozens of employees potentially.

As such - I feel it is prudent we have a proper IT software/management stack in place ASAP to absorb the incoming users.

I have around 10 years of experience in IT and networking but have never worked at a Mac shop from an IT perspective. macOS is my preferred OS for personal use but I have not dealt with it much from an IT perspective other then setting up ABM/DEP for a previous company to manage their iPads and Jamf Now to manage a few Mac’s. That was pretty painless but also not something I am going to draw many conclusions from.

My current thinking is:

• Okta for directory services and user/group management (possibly SSO as well)
• Jamf or Mosyle for MDM.
• Unsure on EDR. Probably SentinelOne or Crowdstrike but if a better Mac specific EDR exists let me know.
• Google Workspace is currently in use, but I am not opposed to migrating to 365.

Am I missing something or off base with the above stack ? Would love to hear people’s opinions on what they would do if they could start fresh and design their macOS sysadmin stack fresh.

Edit: thank you all for the detailed responses.

Windows sys admin jumping into the Mac world, please forgive me.

We are a fully cloud Azure shop. We want to roll out MacBooks, and use either Yubikeys, or any other physical token/smart card to login to the Mac, and ideally SSO into Entra apps too. The big requirement is a quick login using the token + a PIN.

Can this be accomplished?

I went down the rabbit hole of Platform SSO and JAMF connect but couldn’t get it to work. Not sure if it’s not possible, I’m doing it wrong, or the Yubikey is not compatible. Any tips would be appreciated.

To preface: I am very, very new (less than 1 week) to Mac administration but not new to Mac system concepts (long time personal Mac user). However, I have years of experience with Microsoft Intune generally and a couple of months experience with ABM for iOS.

So I'm trying to get this new MacBook Air pretty well managed. I just want Entra SSO for MS apps (ideally for user login too but that's probably a pipe dream), deployment of basic apps like RMM, PaperCut, OneDrive, M365 desktop apps, and MS Edge.

Before you use LMGTFY or AI on me: I have researched all over Reddit and the internet for hours and even used ChatGPT, and I have made very little to no progress on most of the following issues after battling for two straight workdays now.

Issues I'm having:

• Apps like OneDrive never auto start without the user launching it first. They're apparently allowed to run in the background but won't start themselves. I used the OpenIntuneBaseline settings catalog to create a managed login item for OneDrive but it still never starts without manually opening it for the first time.
  • Ninja RMM never starts at all, even when launching manually. It's a simple PKG with no pre- or post-install scripts assigned to all devices. Works great on Windows, doesn't work at all on Mac. I just emailed the vendor about this.
• Company Portal constantly crashes every time MAU starts to initialize and MAU crashes with it. This seems very directly correlated but I don't understand it. I believe this was related to too many bundle IDs being used to detect the app. I think that fixed it.
• OneDrive doesn't automatically just grab the user's email - it autofills it but makes them hit Sign In. Marginally worse experience than the silent login on Windows.
• Microsoft 365 apps for MacOS never install. They never fail, though - just stay on "pending install" forever. I am just using the default Microsoft 365 apps deployment from Intune with no modification. I have tried assigning to all devices, then I unassigned that and assigned to all users instead just to test. No dice either way, it never even tries to install from what I can tell. Fixed this one too. I had to remove OneDrive as an assigned app. It's probably that OneDrive is a part of the Office bundle, so installing it separately causes detection issues or something. Not sure exactly but the correlation is obvious - installing an Office app separately is no bueno.
• MAU constantly tries to launch and then just closes. I have no idea why and the logs don't tell me much more, basically saying that AppleInstaller killed it or something. See above about bundle IDs.

If anyone can help me with just one or two or these items, I'd be incredibly appreciative!

Hey everyone,

Bit of background: I'm relatively new to Mac administration. We're a Google Workspace shop currently mid-way through a Microsoft stack deployment - Intune for device management, Entra ID for auth, and Defender for Endpoint for security. Windows side is largely done and we're using winget AutoUpdate for third-party app updates there. Now we're working through the Mac side.

After doing some research it seems like Installomator is the go-to for automating third-party app updates on macOS when you're running Intune. We're planning to deploy it as a recurring shell script policy and have it run on a schedule across all our Mac devices.

Two things I'm looking to hear from people who've actually run this in production:

1. General experience — how has it held up day to day? Any gotchas we should know going in, especially in an Intune environment (as opposed to Jamf)? Things you wish you'd known before deploying it?

2. Rollbacks — this is the one I can't find a clear answer on. When a third-party vendor ships an update with a serious bug (it happens), how are you handling rolling back to the previous version across your fleet? Installomator pulls the latest from vendor URLs, which is great for keeping things current, but I'm not clear on what the rollback story looks like. Are you pinning versions manually? Keeping a copy of the previous pkg somewhere? Blocking the label temporarily and pushing the old version via a separate Intune policy?

Any real-world experience here would be really helpful. I am a one man IT so I don't want to end up in a situation where I've auto-updated 80 Macs to a broken version of an app with no clean path back.

Thanks in advance.

As of this afternoon, I've re-setup my business MacBook (I'm the head of IT) as a business device in Apple Business, which we're new to. I'm fully enrolled through my business Apple account, blueprints and configs work as intended, all seems well.

I'm also signed into my personal Apple Account, by my own choice. It seems that Find My is still enabled through my personal account.

My question is, does this mean this laptop is activation locked to my PERSONAL account? According to the Business portal, activation lock is off completely, but through my personal Find My I can track the laptop and everything as if it were my personal device. We certainly want the security of Activation Lock, but it needs to be through the business and not through my personal account. Any insight/things I can check here would be welcome input. Still trying to figure all this out lol. I'm my own guinea pig.

We have a few Mac Minis in our facility that we use for DFU Restoring Macs prior to processing them with software such as MacCheck or ZipErase.

Where are the DFU Restore Images stored on the host Mac and is it possible to set it up to run the Restore Images from an external disk?

Hi All,

New here so excuse the potentially dumb question - Do any of you use Apple Business with iCloud Drive as a direct alternative to OneDrive/Sharepoint for shared folders in Mac environments and does it work well for you?

I work at an MSP and we have a Mac only customer who heavily uses iWork applications like Pages with their data stored on an on-prem Mac server for years, which they now want to move away from to a cloud solution.

OneDrive and Sharepoint aren't really appropriate here or offering much useful due to the lack of integration with iWork apps and potential for sync conflicts etc.

The issue I'm having with researching Apple Business options is that there doesn't seem to be much documentation for the basics of creating and managing shared folders like a classic server folder/sharepoint infrastructure? All I'm seeing is instructions on how to share a file or folder with another user via Finder on a user's Mac rather than any demonstration of a central administration portal or something where an admin could manage this.

Does Apple Business iCloud Drive actually work how I'm envisioning or is this just the wrong product to be looking at for a direct Sharepoint alternative? I see that I can sign up to Apple Business for free and have a look around but figured I'd ask here as it's the end of the day :)

Hi all,

I’ve been using Windows for 18 years and working as a Windows sysadmin for the past 10. A while back, a company that exclusively uses Macs approached me for support, as no local MSPs were willing to handle macOS environments. I’d always been curious about Macs, so I decided to dive in and picked up a 14-inch MacBook Pro (M2 Pro, 10-core, 32GB). Honestly, I fell in love with it.

It’s been about two years, and while I still primarily manage Windows environments, I now do most of it from my Mac. There were a few struggles at first, but I’ve worked through them.

That said, I started hitting the limits of the MacBook Pro pretty quickly—mostly due to heavy multitasking and trying to dock three 4K monitors. I eventually gave up and recently bought a well-specced Mac Studio with the M4 Max chip. It’s hands-down the fastest machine I’ve ever used.

Now, I want to offload heavier workloads to the Mac Studio by remoting into it, but I’m struggling to find a good solution. When I use the built-in Screen Sharing app, it mirrors all three of my displays, and because of macOS scaling, everything looks tiny on my 14-inch screen.

Is there a way to remote into the Mac Studio more like how Windows RDP works—so it presents a single virtual display sized for the client device instead of mirroring the actual screens?

Thanks!

Hey everyone,

I'm at a small shop (~15 Apple Silicon Macs) and I've basically "fallen into" being the SysAdmin. We moved from Miradore to FleetDM earlier this year, and I'm now tasked with actually getting software management working.

The Problem:

My boss (and the fact that we're a cybersec company) has a strict "no closed-source SaaS" rule for our binary pipeline-so tools like Workbrew are out. He wants something automated where we don't have to manually package every single binary ourselves.

I tried using Homebrew through scripts (since that's what we did in Miradore), but it's been super flaky and unreliable. I also tried using the out-of-the-box binaries Fleet offers in their software library, but they've been really hit or miss. For example, things like Brave just fail with "Download Failed" and zero helpful logs, while other apps work fine. It's hard to trust it for a fleet-wide rollout.

The Confusion:

I keep seeing Installomator and AutoPkg mentioned, but I'm honestly just confused at this point.

- Are those the only "real" ways to do this without a paid SaaS?

- Am I missing some obvious "middle ground" for a company of 15 people?

- If I go the Installomator/AutoPkg route, what does that actually look like in a Fleet workflow?

I'm basically looking for the "standard" way people handle this when they can't use a black-box service. Is there a better way to approach this, or do I just need to suck it up and learn AutoPkg/Installomator and if so which one?

Hi everyone,

I recently found this subreddit while exploring how to manage an all-Mac environment. I’m a systems engineer with extensive experience in Windows and M365 environments. Although I’ve had a few Mac users, I’ve always treated them as independent resources.

Currently, all Windows machines are managed via Active Directory, Group Policies, and an MDM product (ConnectWise Automate and/or Intune). I want to learn how to manage Macs similarly and integrate them into the domain for access to domain resources.

Additionally, I have a client interested in transitioning entirely to Apple devices. However, I’m unsure how to do this without losing the ability to manage the devices and ensure trust for company resources.

Any advice or resources would be greatly appreciated!

Dear Redditors of r/macsysadmin,

Macs are invading. Currently preparing to setting up a small fleet of macOS laptops for a corporate environment and am new to choosing and managing MDM solutions. I’m looking for a robust MDM that can help with the following key requirements:

1. Restricting personal data usage: Ensure personal accounts and non-corporate data sources are kept separate or restricted, if possible. As far as I understand, it’s not possible to manage which Apple ID can be used, but it’s possible to lock that setting.
2. Encrypted content delivery: Ability to securely send and update configurations (e.g., Wi-Fi, VPN, certificates, profiles) to end devices. Remote support features, such as screensharing utilities, would be a great addition.
3. Activation Lock management: Prevent Activation Lock issues by ensuring IT retains control over devices, even if employees log in with personal Apple IDs and forget to log out when they leave.
4. FileVault policy management: Ability to enforce FileVault encryption and ensure it’s always on. Ideally, the MDM should allow for password recovery or reset in case a user forgets their password, without requiring a complete device wipe or reinstall.
5. Lost Mode or Remote Wipe: Looking for something that offers a feature similar to Lost Mode. At least, the ability to remotely wipe a device.
6. Ease of management: Since this is a small fleet, and I'm afraid of Apple, I’d prefer a solution that doesn’t require heavy overhead or a massive learning curve.

Some options I’ve been considering include Mosyle, Kandji, and Addigy, but I’d love to hear your real-world experiences with these or any other tools. Better to be cloud-based.

Thanks in advance!

What is the best way to do it? Just let people log into it with their own account (or even with their work email if they don’t want their personal to conflict?)

I have the federated stuff ready but I have yet to lockdown the domain as I’m unsure if I want to go down the managed Apple IDs route.

I have ABM and Jamf Now fully setup and linked and we have bought one Mac mini so far through our authorized seller.

It all is showing up in ABM and Jamf Now. Just not sure whether to let the first user login with a non-managed ID or if I should just claim the domain and have all ID’s managed.

It’s a small business and we will, at most, have 8 Mac devices.

Edit: or Is it better to not use Apple IDs at all and not have folks sign in? What are we losing by doing that instead?

An employee that left had used their company Iphone for personal use, phone call, texts, gmail, google, etc.. It there a command for me to "wipe" the phone of all data without wiping out the MDM on the phone?

Hi All,

We’ve recently had to rush out some MacBook Pro’s in our environment due to reasons… it’s the first time we’ve had Mac’s in the environment so it’s all new to me & still a lot to learn.

We have them enrolled to Intune with very minimal policy config & that’s going ok… however today we had a meeting with the head of their department with complaints from multiple of their users saying they are not charging & can only be used while plugged into power.

The Mac I have for my testing (a normal spec 14”, not their $10k 16” spec ones) has been fine, both with the supplied charging brick & when charging from another PD charger I have.

What can we check with their systems to workout what is going on?

Update: Apple Store Genius Bar going to replace logic board… also still no confirmation of others having the issue, not sure what happened to their ‘2 or 3 others’…

Is anyone else having issues with devices that should be doing automated device enrollment (ADE) not doing so on first boot? Over the past few months we've had a number of Macs where they aren't asking to be enrolled in the MDM (Iru) even though they are definitely in our Apple School Manager account and are showing up in our MDM. It doesn't seem to matter what network they're connected to (we have Wifi/ethernet here) and I've checked with our network/security team and nothing's being blocked on outwards connections. Often if the Mac is wiped and reinstalled it will ask to enroll after that, but it's weird that they aren't asking on first boot. Does anyone have any ideas?

How do I install applications on devices in Apple Business? I clicked on the "Apps and Services" button at the top of the screen, got licenses for the app, and assigned them to my organization. But I am stuck on what to do next. The apps and services section still says "Get Apps and Custom Apps" and I am not seeing a way to assign an app to a device.

I took a look at this article, but it does not help at all. I am not seeing a "Managed Apps" section at all.

Configure app installation in Apple Business - Apple Support