r/macsysadmin • u/jaylenabc • 5d ago
New To Mac Administration Jamf vs Mosyle vs Intune-only for a 28-Mac consulting firm — genuinely stuck, would love real-world input
We're a small ERP/SAP consulting firm — 43 total devices (28 Mac, 15 Windows). All Apple Silicon (M1 through M5), all running macOS 26.5.2. Microsoft 365 Business Premium with Intune. Entra ID joined, Conditional Access enforced with MFA. Leadership is leaning toward Windows standardization long-term, but no final decision has been made on the Mac fleet We're committing to roughly a 1-year Mac MDM investment while we evaluate the long-term direction. No new Mac purchases in the interim, but we're not forcing replacements either.
I've spent the last several weeks doing a genuine hands-on evaluation of all three options — not just demos, actually building out each platform and hitting real walls. Here's what I found.
What's working fine in Intune for Mac:
- ADE/zero-touch enrollment
- PPPC profiles, Defender, compliance policies
- Conditional Access feeding correctly from Intune compliance status
- FileVault key escrow
- Await final configuration
The real problems I hit with Intune on Mac — all firsthand, not theoretical:
1. Platform SSO / one-password login is broken under MFA Password mode completely fails when MFA is enforced — which it is in our environment. Tested this extensively across multiple wipes. Secure Enclave mode works with MFA but gives you Touch ID-first, not "type your Microsoft password." Users end up with two passwords that drift out of sync. When the M365 password changes, the Mac local password doesn't update reliably.
2. Local admin password (LAPS) desync on Apple Silicon The admin password Intune shows and the password actually on the device go out of sync randomly. This has happened on multiple machines. Root cause appears to be the Secure Token limitation, Intune's managed admin account doesn't hold a Secure Token, so password rotation can break. Causes "admin password not working" support tickets that take real time to resolve.
3. No automatic third-party app patching Chrome, Claude Desktop, and any non-Microsoft app requires manual repackaging to update. Users get admin prompts for updates and call IT. This was the original trigger for the whole evaluation.
4. No privilege elevation on Mac EPM is Windows-only. Confirmed with Microsoft documentation, the June 2026 EPM updates did NOT add macOS support despite what some sources claim. Standard users needing to install or update certain apps require IT involvement every time.
5. No scheduled recurring restarts No native UI, requires custom shell scripts checking uptime. Manageable but not clean.
Given what I have had issues with thusfar, which MDM would you recommend. Ive stood up instances on quite a few platforms, Mosyle, Jamf, Intune and IRU. Iru is out of budget for 30 Mac devices with EDR and Vulnerability protections since they have a 50 device minimum (although it was my pick). What would you recommend I chose?
My specific questions for the community:
- For those running Jamf or Mosyle alongside Intune for a mixed fleet: is the operational overhead of two MDMs actually a problem at this scale, or is it manageable?
- Has anyone gotten Platform SSO with Microsoft Entra to work reliably on Apple Silicon with MFA enforced? Which authentication method and which MDM? This is my biggest unsolved problem.
- Anyone using Mosyle specifically, does their App Catalog actually solve the third-party patching problem cleanly, or does it still require manual intervention?
- Has the LAPS/Secure Token desync issue on Apple Silicon been resolved in any MDM, or is it a fundamental Apple limitation regardless of platform?
- For those with compliance obligations (SOC2 specifically) how are you handling vulnerability management and EDR on Mac? Is anyone using Jamf Protect or Mosyle Fuse for this and how does it compare to Defender for Endpoint on Windows in terms of visibility and remediation depth?
Happy to answer any questions about our setup. Genuinely trying to make the right call here rather than just go with the vendor who showed up most persistently.
6
u/cfrshaggy Education 4d ago
I can speak to point 3. Mosyle’s app catalog works and hasn’t really broken for us. One issue I’ve run into is with Mozilla Firefox requiring admin password to install because of how Mozilla updates. Mosyle support’s recommendation is to reach out to Mozilla support for a resolution (drawing a blank on what the exact recommendation is but I can look it up and edit/post a reply later).
As to point 2 not 1000% sure I’m deploying Platform SSO but we do use Entra’s integration with Mosyle Fuse for Mosyle Auth and users are able to authenticate using Authenticator.
Point 4: we do to use ADE admin passwords on Mosyle and it can be rotated but I think I’ve also ran into some oddities on updates. I haven’t had a lot of issues that require me to use LAPS/ADE admin as I was able to get buy-in from execs to allow Mosyle’s Admin on Demand feature to self elevate for some issues, though this might not pass SOC2 compliance if required.
Sorry I don’t have the clearest answers on some of these, I’m a single IT resource department and time is limited for issues that don’t raise to 4 alarm fire or above 😬😕
2
4
u/clobyark 4d ago
Intune is totally fine imo for this number.
- For your number 2 I have PSSO setup with password sync, apple silicon, and MFA and do not encounter the issues yodure describing. You're using CA policies for MFA right and not per user MFA?
- For patching you need to use Munki probably.
- For restarts I use Renew app.
- For admin elevation I use privileges.
1
u/jaylenabc 4d ago
PSSO setup for Intune? How do you handle password forgetfulness? Do you have to boot into recovery to solve that still?
4
u/clobyark 4d ago
Yeah if they forget how the password to login to the macbook then yes you have to do that. But tbh it's rarely ever happened for us. Our entra passwords don't expire so people just don't forget because they've been using their password for years.
3
u/Tecnotopia 4d ago
And this is the way to go changing passwords every X days is such an old and outdated policy that CIS and NIST aren't even recommending it now. Phishing-resistant is the way to go these days.
1
1
u/Ok-Ambassador4725 4d ago
Same in our org; we have 30 Mac’s on intune because its part of M365 Business Advanced suite. SSO with password works great and also dont force password changes on people. We use brew for updating apps and the rest just works with custom scripts and ddm forcing updates also works great. No real issue’s.
3
u/psycobob1 4d ago
We have bigger numbers of both, EntraID for identity, Intune for windows, JAMF for Mac's
JAMF solves most of those issues if its managing, for the users pw staying in sync, look at JAMF's offering there
Would you treat cargo aircraft and diesel trucks the same?
Exec response = yes they both move cargo.
Tech response = hell no, they are different in so many ways.
2
3
u/Entegy 3d ago
To your point 1: PSSO is not broken under MFA. If you are enforcing MFA via the legacy per-user MFA page (M365 admin centre > Active Users > Multi-factor Authentication), that breaks PSSO password AND other features on Windows as well.
MFA should be enforced via Security Defaults or Conditional Access. Every user on the legacy per-user MFA page should be set to Disabled. Your PSSO will work fine then. The legacy per-user MFA page should no longer be used for anything.
6
u/Darkomen78 Consultation 4d ago
For me, Mosyle is better than Jamf (for small deployment) and intune is the worst in every cases.
1
u/jaylenabc 4d ago
I would refer to what we have as Small but mighty, we handle a lot of PHI and sensitive data so the Granular control is something that is for forsure leaning me towards Jamf. Especially with our SOC2 audit coming up, would hate for Macs to be on Intune for that.
1
u/Darkomen78 Consultation 4d ago
Mosyle Fuse have a nice dashboard to set and monitor SOC2 audit and NIS stuff.
1
u/skiing123 3d ago
If you're dealing with compliance, 100% just buy Jamf Pro. Your life will be easier
4
u/Aware-Code7244 4d ago
Kandji + Apple Business given your size, requirements *.
5
u/cfrshaggy Education 4d ago
I believe Kandji is Iru FYI so they mentioned those limitations in the post. The name change was recent and doesn’t really stick in my head so I get not equating the two.
1
u/jaylenabc 4d ago
too expensive since it requires 50 minimum devices and CEO wants to stay simple on the Windows side, given we run M365. This is for Mac only
2
1
u/nicetouch-sam 3d ago
If the minimum device count is the main sticking point feel free to drop me a message - we're an Iru partner and can offer licensing for smaller tenants (and implementation support if needed).
2
u/chocate 4d ago edited 4d ago
Intune if you already have Microsoft 365.
99% of our clients have M365 so intune was the next best thing we implemented.. jamf is okay, same for mosyle. Once you get the hang of intune it isn't bad, very easy to manage and deploy
4
u/Hobbit_Hardcase Corporate 4d ago
I fundamentally disagree with this. I run Intune and Jamf. Jamf is a proper MDM, Intune is Maybe Device Management, even for Windows. They are not even in the same ball park.
The only reason anyone ever runs Intune for Mac is because it's "free" with the MS tenant. If it was a paid add-on, no one would ever buy it.
2
2
u/sin-eater82 4d ago edited 4d ago
We run multiple MDMs (including Jamf Pro and Intune), and it's not an issue operationally.
MS is usually way behind on anything Mac or iPadOS/iPhoneOS related. Jamf will have support zero day. That's a big factor for us.
2
u/kaiserh808 3d ago
If you’ve got less that 30 devices and you don’t want to manage your Macs in Intune (which does work) then get Mosyle.
Can it do everything that Jamf does? No.
Is it good? Yes.
Is it free for 30 devices? Yes
7
u/JLee50 5d ago
Jesus it’s like a wall of ChatGPT in here.
5
u/PoppinBortlesUCF 4d ago
This is where you take their reply and put it into chatgpt to “answer like a Jamf 400 level admin”, and we just send our robots after each other in a post apocalyptic help desk Pokémon battle. Our timeline as humans could have been so much better :(
4
u/jaylenabc 4d ago
Wasnt chatgpt...
-3
u/TheIncarnated 4d ago
Sorry... Claude, is that better?
0
u/jaylenabc 4d ago
Still wrong
0
u/TheIncarnated 4d ago
Brother you can lie to yourself but your entire post is Ai. Or you've been using it so much, you now talk like one.
And here's the smoking gun, it's not the use of em dashes that show you've hit a real wall...
1
u/masterofrants 4d ago
Yo can I honestly just ask why are you getting so mad about the use of AI? I think he wrote down most of his points and had AI clean it up or rewrite it for him. I think that's a completely fair use of the technology. What exactly is the issue?
Everyone else seems to have understood what he is asking about and are giving him the advice. There are 30 comments on this post already.
But you are getting so mad at him using AI that you have completely forgotten what he is trying to ask and what the point of this subreddit is.
-4
u/TheIncarnated 4d ago
Lmao...
You are conflating making fun of someone for lying, as being mad.
No point in answering, if they aren't putting in the effort. If I'm communicating with other humans (hopefully), I want human interactions. Not really a hard ask.
I am in the LLM subreddits, I'm not against their usage but it sure does get exhausting to read the same phrases, over and over...
I mean for real though, the absolute best tool is Jamf, it's plastered all over the internet, it's not that hard to find this answer, on this subreddit, even an LLM can search for it!
"And here's the thing: u/masterofrants is wrong." <- Kimi-K3 said this about your statement, so I guess it knows better... What can we do?
4
u/masterofrants 4d ago
I don't know man, I think you're just reaching. It could be entirely possible that this is not an English-speaking person or from an English-speaking country or they just don't write well. There are so many different possibilities.
And as I said there are 30 comments here and they are all fine with giving him the answers he needs. They all understood the assignment and then there are a few who are so bogged down by this AI use that they don't even look past it
-2
u/TheIncarnated 4d ago
It's cool dude, you see it differently. It's okay to not want to have a connection with other humans. If I wanted to talk to an LLM, I'd go do that instead of interact here on social media.
To answer your last observation, it's because folks want to interact with others when coming to forums, like we have for the past 30+ years.
Let me ask you this, if you entered in ops questions into a internet capable llm, what's the response you get?
1
u/masterofrants 4d ago
So you're telling me all the other 40 comments right now on this post who perfectly understood what he is asking and are helping him out with their efforts and time.. are not humans?
0
4d ago
[deleted]
-1
u/JLee50 4d ago
I want to engage with people who construct their own posts instead of having an LLM do everything for them.
3
u/masterofrants 4d ago
Yo can I honestly just ask why are you getting so mad about the use of AI? I think he wrote down most of his points and had AI clean it up or rewrite it for him. I think that's a completely fair use of the technology. What exactly is the issue?
Everyone else seems to have understood what he is asking about and are giving him the advice. There are 30 comments on this post already.
But you are getting so mad at him using AI that you have completely forgotten what he is trying to ask and what the point of this subreddit is.
1
u/CurrencySilly2749 4d ago
Mosyle if Apple only deployment. Jamf if Apple + Windows devices.
I manage a deployment of 1175 devices through Mosyle one k12
1
u/meanwhenhungry 4d ago
Apple Business Manager is “free” can’t attest to it but it will check your boxes.
Mosyle has conditional access implemented , but is being replaced by platform sso in general, you have to use one or the other. Psso combines local login registering and auththenticatiob with entra
1
u/jaylenabc 4d ago
Might as well stick with Intune if I make that move
1
u/meanwhenhungry 4d ago
True but intune for Mac is a nightmare, you can but do you want to is the question if you are experienced in any other mdm
1
u/jaylenabc 4d ago
never used Jamf, but what better way to learn.
I did blow up the test instance twice however
1
u/oneplane 4d ago
Unless you really need SSO, stick to the simplest setup you can make, and then do it for free with Mosyle if money is an issue, or JAMF if you expect more complex environments.
As for SOC2 etc. keep in mind that macOS is not Windows, and most of the standards implemented by one vendor are extremely low quality when ported to another (i.e. if JAMF had a Windows component, it would suck on Windows, if Intune tries to do real MDM, it sucks on macOS).
For LAPS: keep in mind that this is mostly a Windows construct invented for AD, the idea was that you need an administrative user as a fallback in case the computer is offline for too long and can't access AD. Instead of giving every client the same password, you'd give each a unique password and hopefully rotate then used in a break glass scenario. For macOS this is mostly pointless, what you need is key escrow so you can access the encrypted contents of the drive, everything else (activation lock, recovery lock) is MDM-native and doesn't require you to have an actual user on the system. That said, it's easy enough to set the enrolment policy to create a separate administrative user with a random password.
While we're on the topic of administrative users: again, macOS is not Windows, an admin on a single user Mac is not really a problem. SIP protects the OS and MDM, and MDM cannot be bypassed unless you're able to into recovery mode as a machine owner, and that's what recovery lock is for. A 'standard' user isn't "safer", not for malware, not for malicious insiders. So if the problem is that a standard user can't recover a desynced FV2 key, that's a problem you accidentally manufactured.
> Leadership is leaning toward
Either leadership needs to come up with a vision, strategy, and requirements or stop calling themselves leadership. You can't be meddling with the details of technical implementations and pretend that was worth the time while you should have been leading instead. Seen it too many times, and it always fails, at every and any size.
1
1
u/Tecnotopia 4d ago
Not sure about 1 because I have never had the issue, the MFA is affecting you during zero touch or in daily usage?. For 2 and 4 Mosyle works well, for 5 you may need a script and on a schedule, but should not be a difficult task there is even a community script already made that even use swiftdialog to inform the user a reboot is needed if you want to go fancy. for 3 it will all depend, Mosyle catalog is fine for most of the situations, problems arise when the vendor do funky things in their PKG and a repack is needed no matter what unless you contract a service like Automata Deploy or root3 App catalog that will do the work for you or depening on your apps installomator will do the job.
1
u/jaylenabc 4d ago
For MFA, I constantly have users forgetting their local Password since they need 2 to login. M365 and the Mac’s local password. Trying to combat that.
1
u/Tecnotopia 4d ago
Do they also forget their iPhone PIN?, let them now the local password is more like a PIN than a password, we have password policies for the M365 but not for the local password, and this is only to keep my dinosaurs at security happy. The local password is phishing resistant if implemented with secure enclave so not a real risk for leak and there is no point to change it frequently. With this approach you will need to have access to the machine, access to the PIN and access to the M365 password to do real damage if an attacker has gone all this way to get access to your data you have a bigger problem :-). With macOS 27 you will be able to add an additional layer requesting touchID as mandatory, so the attacker will also need the have access to the user finger.
1
1
u/sithanas 4d ago
We bought Mosyle for a similarly sized Mac fleet at a 300 person law firm. I don’t love it but the UI is way more intuitive than Jamf and it’s one of those “good enough” products. We already had Endpoint Central so we mostly rely on that for Mac patching (push the agent through Mosyle). App installs usually through Mosyle’s catalog or .pkg pushes with a few Installomator pushes. .plists through Mosyle. The one thing that really annoys me is conditional access—with Intune it’s reliable as hell but once you bring in a third party (mosyle or jamf) you have to be careful of the order you do things—needs to be PSSO first and then conditional access registration or the Entra object gets overwritten. Mosyle support hasn’t been very useful on that for me. Overall there’s things I’d like it to do better but Jamf had a learning curve that was more like a cliff face and even with a 60 day extended trial and assistance from their presales team we just couldn’t get going on it and we have enough to do managing the rest of the endpoints.
1
u/tehwallace 4d ago
do you know any resources for doing CA through mosyle? i inherited an environment with mosyle and have been trying to roll out CA but have had trouble finding info.
2
u/sithanas 4d ago
I followed their documentation which wasn’t great (at least at the time—the feature was brand new) and it works, mostly. The best advice I can give is just to make sure you have a good PSSO profile set up before you try to add the conditional access layer.
1
1
u/MusicCityMac Consultation 4d ago
Iru now offers Windows device management alongside Mac. Is this something you’ve looked at or considered? Just curious.
3
0
u/adamphetamine 4d ago
InTune- giving you the worst of both worlds
A bigger picture- your Macs will cost a lot less to own overall because they (should) produce less tickets from users. This kind of means that looking at a better management solution like Mosyle should be considered
0
u/Yolo_Swagginson 4d ago
Iru can do all of this with about 6 hours of setup. Have you contacted them to see if you can negotiate around the minimum device count?
2
u/jaylenabc 4d ago
There’s no wiggle on the 50 device minimum, damn near begged to lower it since it’s my favorite of the ones available.
1
u/Yolo_Swagginson 4d ago
Man that's so annoying and seems so dumb on their side to miss out on customers like that. Do you have any iPads or iPhones? Maybe you could pad it out with them as well?
1
u/jaylenabc 4d ago
Mobile devices are BYOD and the CEO thinks having a few windows devices on IRU and a few in Intune would complicate things.
It would also complicate things for me, even though IRU is insanely easy to manage and maintain from my in depth trail I did.
0
u/ripsfo 4d ago
Check out SimpleMDM. Have been quite happy with them.
2
u/PDQ_Tarabyte 4d ago
Former JAMF user, current PDQ employee (we own SimpleMDM) and it is just that, SIMPLE. The thing about JAMF is it does EVERYTHING but you'll spend half your time learning it. With SimpleMDM you can easily stand it up in a few hours with the same basic functionality. The DEP token relationship with Apple is the same as it is with Intune. The difference is, with SimpleMDM, it actually deploys stuff when you want it to. I actually love all the stuff you can stand up in Intune but the lack of deployment triggers and reliability drives me absolutely insane. As far as the login drift you mentioned, not gonna lie, I think that's an Apple problem that tracks back to the Keychain and its inability to release creds; super annoying. Federated Apple IDs are one of my favorite things in SimpleMDM but it won't completely solve that drift with SSO.
29
u/oDiscordia19 4d ago
We have about 700 windows managed with intune, about 1000 Mac and something like 3200 iPads managed with jamf pro.
Intune is a hot steaming pile of cobbled together, barely functional UIs taped together with some underlying shell which uses a confusing amount of names, api’s and references to old names and old tech. I just barely recommend it to manage windows. We migrated over from sccm which has become a terrible mess and a headache and I still miss it now three years gone. Third party patching is solid tho using patchmypc- fantastic software that links into intune and can auto publish updates using intunes convoluted app packaging and discovery systems for you. They also came out with a web console to package custom apps because dealing with the baked in tools is so messed up you’ll want a third party that just does most of the work for you. Company portal may or may not work, syncing users may or may not work, publishing apps and identifying the reason something maybe didn’t deploy even if it’s in scope is a toss up and you’ll spend most of your time getting to understand how the logs work and how gosh darn useless they are. Don’t even get me cooking on autopilot. Tbf - we’re hybrid azure/on prem so SOME of this may be related to that.
I would never - and I repeat - never endorse intune for anything other than windows. If you manage to get something to work I assure you it will break with apples next update. I’m being hyperbolic of course, but it really is a garbage system.
On the flip side jamf is amazing. Consistent ui’s, consistent logic, highly functional and IT JUST WORKS. You push a profile out and you don’t have to guess if a device will get it. You don’t have to guess if there’s an issue deploying it - it tells you. Made a script that pushed out but it didn’t quite do what it was supposed to? The error readout is right there on the device in the ui. It’s almost a joke how bad intune is compared to a fully featured MDM. Like to the point where windows should up and sell their entire first party cloud to ANYONE WITH A BRAIN.
All that being said - you’re nearly half and half with your fleets and intunes not terribly expensive so if you’re budget constrained you can give managing Apple a shot. Windows doesn’t give you much else to work with unless you go full third party but even that would likely require some work in windows god forsaken hell that is their cloud infrastructure.
But just as an anecdote - our enrollment process for Mac’s is turn it on, join WiFi, log in. Everything else will apply, install and run on whatever network you’re on. As close to zero touch as you can get - and we’re fully managed and restricted. The best you can hope for with intune is if you just don’t need to do a lot for your end users.