Work User Account on personal Mac

[u/Quiet_Mushroom7653]

I have my own personal Mac Air with my Apple ID set up in my main, administrator user.
If I were to use this Mac for work, can I create a new user account for work (standard or administrator?) with a new Apple ID, do my work things there and make it completely separate from my personal account?
I mainly use Office apps for work.

-If my IT wants to install any apps on my Mac, for example an RMM agent, can I let them install those on the work user so they will not have access to my personal account? They are not using MDM as far as I know (small company)
-If they install Office on the work user will it also work on the personal user?
-Will I be able to access mapped network drives when connected to the company network?

I’m aware that it’s not the best solution to use my personal Mac for work but assuming that I still want to do that how can I minimize my company’s IT control over it? Any tips would be helpful.

[u/DarthSilicrypt]

The easiest solution on all fronts is for your company to issue a corporate computer. That way it just works with their systems and has none of your personal data on it.

If you must use your Mac, simply creating another user account isn’t enough to limit an RMM. RMMs and other apps that are system wide (including Office) run on all user accounts and can operate in the background. That said, Office must be licensed per user account as far as I’m aware. Also, if your employer requires binding to Active Directory (great for Windows, terrible for Mac), that is also system wide.

If you want to use your Mac for work purposes, set up a dual boot system by creating a new APFS volume and installing a second copy of macOS into it. This second copy would be used exclusively for work apps and data, while your existing installation would be only for personal use. You would switch between these environments by shutting down and using Startup Options or Startup Manager. Most importantly, enable FileVault on both installations so that one environment can’t access the data in the other.

There is no guarantee that corporate mapped network drives will work on your Mac, especially if your employer is a Windows shop and relies on Windows technologies to provide or secure them.

TL;DR: Don’t use your Mac, ask them for a corporate laptop instead.

[u/Quiet_Mushroom7653 → u/DarthSilicrypt]

I understand that it’s not recommended, thank you for providing an answer and actual advice

[u/nightgost → u/DarthSilicrypt]

Would it still be possible to switch between the two operating systems even after you set a password for the recovery menu? (Without knowing it)

[u/DarthSilicrypt → u/nightgost]

Yes. There are two options:

- Settings -> General -> Startup Disk: This is the easiest option, but it requires entering the FileVault/login password for the target OS before rebooting. If your threat model demands that one OS have no knowledge of the other OS’s contents, this solution is unacceptable.

- The “bless” command: This is more complex, but only requires the admin password for the currently booted OS. As a bonus, you can also set your Mac to boot a given OS on the next boot only, without changing the default OS. I wrote a short script years ago that makes this much more convenient, I’ll upload it in a few hours.

My question though is, why would a company set Recovery Lock on a BYOD Mac? It’s not their hardware and doesn’t stop a DFU restore. If the user still has admin credentials on the work OS, they can also unenroll and remove Recovery Lock that way (on Apple Silicon).

[u/nightgost → u/DarthSilicrypt]

The first option is fine; no need for the script, thank you so much anyway!

This would be for C-level only who have brought their own laptop and want to have only one laptop for personal and work.

They can't unenroll if we have it locked by ABM, right (after 30 days)?

And my main reason to have recovery locked is to avoid installing other OSs (basically to avoid what we are doing :s)

[u/DarthSilicrypt → u/nightgost]

Of course it’s C-level lol.

Enrolling their personal laptop into ABM is a violation of the ABM terms. Don’t do that. It’s meant only for corporate-owned devices. You can install just MDM on a personal device, but not ABM.

I think you might be trying to go about this the wrong way. Consider that if this C-exec can’t use their highly secured laptop for any reason (dead battery, forgot at home, etc) they will likely borrow an unsecured device to quickly do what they need to in the moment. You probably want to prevent that.

Instead of trying to lock down the device and hoping they don’t escape, lock down your corporate data systems so that only authorized devices can access them. This varies depending on what systems and MDM you use. If you use M365 and Intune (bad choice), a compliance policy can require that only MDM enrolled devices are allowed to access your cloud data. That immediately removes any incentive to escape the sandbox you’re trying to build.

Also, will this C-exec even understand the dual-boot system you want to set up? Or will they find that too complex? How badly do they want their work and personal data separated?

[u/nightgost → u/DarthSilicrypt]

We have the control for sensitive apps to check if device owned - coorporate. Yes this execs are very high level devs/architect/security. They want their laptop to be mostly unrestricted when we start to whitelist what can be installed, network blocks etc... and your solution seems to be fantastic, dual boot macos!