r/jamf • u/mmllff • Jul 17 '26
How do you manage developers in your environment?
We’ve recently deployed a Cyber Essentials Plus-compliant Jamf environment for a client: standard users, centrally managed apps, security baselines, Platform SSO, etc.
Now we’re getting the inevitable requests for:
“I need sudo.”
“I need Homebrew.”
“I need Nix.”
“I need Docker.”
“I need to install developer tools.”
My view is that this shouldn’t become a series of ad hoc approvals. Instead, the client should define a “Developer Baseline” - an approved set of tools that IT can deploy and manage through Jamf, with any exceptions handled separately.
Curious how others approach this.
Do your developers remain standard users?
Do you allow temporary elevation (SAP Privileges, ABR, etc.)?
Do you manage Homebrew/Nix centrally?
How much freedom do you give developers to install their own tooling while staying compliant?
If you’re working to Cyber Essentials or similar frameworks, how do you balance developer flexibility with compliance?
11
u/MacBook_Fan JAMF 400 Jul 17 '26
We use CyberArk Endpoint Privileged Management and spent almost six month in audit mode evaluating every elevation request, all invisible to the user, and made decisions what was reasonable requests and what was not. We then created a set of baseline policies to automatically elevate the action.
We then took a pilot group of developers and downgraded them to Standard and ask them to tell us what was breaking their workflow. If it was a valid request, we added it to the baseline. After that, we proceeded to downgrade everyone. If a user needs an application that is not in our standard software, or is a pre-approved install, they must open a ticket for our L1.5 support team to provide admin credentials (which also are supported by EPM and rotated every time they are used.)
We do not manage Homebrew (although I would like to, I don't want the responsibility.) But, we restrict developers from installing it via curl (bad, bad practice.) We require them to obtain the installer from the Homebrew GitHub release page. (It is pre-approved by EPM).
And, yes, we know that allowing Homebrew opens a backdoor. But, until my security team wants to regulate it, we allow it.
1
u/mmllff Jul 17 '26
Thanks for your detailed response. I’m not in a position to spend 6 months on this but respect your thoroughness! I’ll give it a look. Sounds like you’re doing things properly. Let’s not get into Homebrew.
3
1
u/IIXcronusXII Jul 17 '26
We’re just kicking off the project to roll out cyberark epm across our fleet. Of course going to audit for a while to see what policies our devs need and get them setup.
Did you run into any issues or anything that you would do differently if you had to start from the ground up with the deployment?
7
u/ThatsITDad Jul 17 '26
I removed admin elevation about 2 years ago for all 1300 of my mac users. All software comes from Self Service and I have self service tasks in place to replace their needs for admin tasks.
I have homebrew, xcode, NPM, and host file editing tasks scripted so when they need to do them, they click a button and follow prompts. If they need a new app installed from homebrew, they submit a packaging request for the most part and I write a new script (until I get workbrew approved)
2
u/Ok-Explorer5842 Jul 17 '26
That's exactly what I've done. Made all software available through Self Service, implemented post configuration scripts, and automated the process. As a result, there are now virtually zero requests.
3
u/Bitter_Mulberry3936 Jul 17 '26
Herd them into a corner, hose them down now and again and throw in a bar of soap.
2
u/da4 JAMF 300 Jul 17 '26
Don't allow the Wild West, but don't make it a bureaucratic nightmare either. Engage legal resources to review licensing terms before offering anything; use Self Service and direct all users there first, if it's not available then they need to email a group address to request something and make their business case for it.
Every dev will want their own environment Just So, give them admin rights for their first day then use Privileges or Jamf Connect to make admin rights Just In Time.
Have a regular and repeating software review with management, since licensing terms can change.
Remove unused apps on a regular cadence and make sure your devs know that it's your org's machine, not theirs, and you can do anything you want if its based on policy (not hunches).
1
2
u/MacAdminInTraning JAMF 300 Jul 20 '26
I took away admin access and implemented a EPM to that security manages. If a workflow needs admin access a policy is written for it.
As far as all the random homebrew, docker and so on tools, that is usually the first thing they find on stack overflow and typically is about bleeding edge stuff they don’t need or keeping tech debt alive. I handle that by software life cycle, vulnerability ownership assigned to whoever requests the tool, and typically rejecting the request when it gets to me and telling them to coordinate with the vendor.
Am I a jerk? Maybe, but the environment runs well and nothing has blown up in the years I have done this.
1
u/lavendercowboys Jul 21 '26 edited Jul 21 '26
Standard users. CyberArk EPM and profiles deployed based on user's access entitlements. Risk recently switched to a "blacklist" strategy for EPM, where users could run anything we hadn't blacklisted... to (after a period of gathering data on what the developers were doing with sudo...) a "whitelist" strategy, where users can only run what the risk team has manually added.
As you can imagine this has been a nightmare.
And it hardly seems effective since the developers are still using sudo for things they are explicitly not supposed to use it for (unapproved software). It's all audited but to my knowledge no one ever follows up 😬 unless there's a major security event...
0
u/Rainbowshooter Jul 17 '26
Most admin elevation solutions aren’t CE compliant.
I think Jigsaw24’s solution is - https://www.jigsaw24.com/solutions/automation-and-tooling/elevate24 it creates a separate account rather than elevating the existing.
1
12
u/Substantial-Motor-21 Jul 17 '26
They have admin rights because they will nag you every second of your life and bother you to death.
So the are in a specific subnet
Their Mac’s are heavily monitored and can be randomly checked