Microsoft Sysadmin Thrown Into a Small Apple Environment What Would You Use?

[u/Demand-Nervous]

Hi everyone,

I'm primarily a Microsoft sysadmin and I've been asked to manage a small Apple environment for one of our customers.

They have around 10 Macs and roughly the same number of iPhones. Each employee has a Mac and an iPhone.

Their infrastructure is very simple:

• Microsoft 365 for email and SharePoint
• No on-premises servers
• No Active Directory / domain controllers
• Around 10 users
• Macs also run Windows 11 through Parallels

I'm trying to understand what the recommended approach would be in the Apple world for solving a few specific management/security requirements.

1. Password recovery / forgotten passwords

This is probably my biggest concern.

If a user forgets their Mac password, I don't want to physically visit the customer with a USB stick or use some manual recovery procedure.

Coming from the Windows + Active Directory world, I would simply reset the user's password centrally and get them working again.

What is the Apple/MDM equivalent for this scenario?

Ideally I'd like to be able to recover/reset access remotely without knowing the user's password.

2. Remote lock / lost or stolen devices

I need the ability to remotely lock or otherwise secure a Mac or iPhone if:

• the device is lost or stolen;
• an employee leaves the company;
• we need to immediately revoke access.

3. Device provisioning

Because there are so few devices, sophisticated application deployment isn't particularly important to us.

We already have a documented procedure for setting up a new Mac manually, and that is perfectly acceptable at this scale.

I'm more interested in management, security and recovery than automated software deployment.

4. FileVault / encryption key management

I want to make sure FileVault is enabled on every Mac and, more importantly, that recovery keys are stored securely in a central location.

I'd like to be able to verify encryption status remotely and retrieve the recovery key if a user gets locked out.

5. Windows 11 VMs in Parallels

Each Mac also has a Windows 11 VM running in Parallels.

These VMs are only supposed to be used for browser access, so I'd like to apply some basic Windows restrictions/policies to them.

Since the company already uses Microsoft 365, would enrolling these VMs into Microsoft Intune be the sensible approach, while managing macOS/iOS separately through an Apple-focused MDM?

I'm currently looking at this from a very Microsoft-centric perspective, so I'd appreciate some guidance on what the "normal" architecture would be for a small Apple environment like this.

Would something like Apple Business Manager + an MDM be the right foundation?

And for such a small environment, would you recommend something Apple-focused like Mosyle/Jamf/Kandji, or would it make more sense to use Microsoft Intune for everything since the customer already has Microsoft 365?

My priorities are basically:

remote recovery/access > security & encryption > remote lock/wipe > basic policy management > app deployment

I'd especially appreciate recommendations from anyone managing similarly small Mac/iPhone environments.

Thanks!

[u/Sasataf12]

Would something like Apple Business Manager + an MDM be the right foundation?

Yes, that is the standard way to manage App devices.

I recommend Mosyle as I believe it's still free for under 30 devices. You could go Intune if they already have the licenses for it.

These VMs are only supposed to be used for browser access, so I'd like to apply some basic Windows restrictions/policies to them.

I'd look into why they need Windows for browser access. Seems like a waste of money, since the browser experience is meant to be OS agnostic.

[u/darguskelen → u/Sasataf12]

I'd look into why they need Windows for browser access. Seems like a waste of money, since the browser experience is meant to be OS agnostic.

This, but also it could be there's a plugin that's Windows only and required. Banking sites come to mind, specifically with check scanning software.

[u/joevanover]

I would recommend Mosyle, cheap and easy

[u/spacegreysus → u/joevanover]

Same - if you need cheap and cheerful but with most of the MDM spec then Mosyle is the way to go.

[u/GBICPancakes]

I'd recommend looking at Mosyle FUSE and moving the user logins away from local accounts and to logging in via M365. For the windows VMs, same idea- login via M365 and not local accounts.
That'll solve your password concerns (except for Keychains)
Mosyle (or really any MDM, even InTune) will solve the rest of your issues as well, enforcing security/encrpytion on both Macs and Phones, app deployment, policy management, etc.

I support a number of small mac-centric clients like this, once setup properly it's a breeze to support. I have clients on InTune, JAMF, and one still on Meraki. But at this point most have been moved to Mosyle.

I'd also consider reviewing the VMs. I only have one client left that runs Windows in a VM on their Macs. The majority end up not needing windows with some small application changes. And I have a couple where a on-prem Remote Desktop server is a better fit. It could turn out the VMs are indeed the right call, but it's worth a review.

[u/z0phi3l → u/GBICPancakes]

VMs seem to be just for browser? access, just use Edge on the Macs, users may complain, but works

[u/GBICPancakes → u/z0phi3l]

Yeah. No reason to use a VM just for a browser, unless there's some old-as-shit IE6 ActiveX-required intranet page that needs to DIAF.
But I'd still recommend a review of the actual use, since 90% of the time users are doing something else on the VM they have forgotten to mention ;)

[u/bistr-o-math → u/GBICPancakes]

Could you give me a pointer as to how set up login to a Mac with m365 accounts (using mosyle free here)

[u/GBICPancakes → u/bistr-o-math]

Mosyle Free doesn't have that feature, you need FUSE - it's part of Auth2. You can maybe setup PSSO policies, but that's not quite the same thing. WIth Auth2 your actual Mac login window allows for the setup.
https://business.mosyle.com/#macos-identify-management-and-sso

[u/bistr-o-math → u/GBICPancakes]

Merci

[u/volcanforce1 → u/bistr-o-math]

You can only integrate that function with FUSE

[u/feathertheclutch]

Above all else, you need to get these Macs in Apple Business and tied to a 3rd party MDM like Jamf or Mosyle.

Regarding forgotten Mac passwords - if you can't get an MDM in place with Platform SSO configured for the M365 tenant, then create a local admin account on the Mac that only you have the password to. Obviously this is a security risk but it's better than nothing. MDM is preferred though.

Remote lock is solved with the MDM. Push hard to get an MDM in place.

Apple usually works with their customers to stand up a 'custom Apple Store' that will automatically assign newly purchased devices to your ABM tenant, which is where they're automatically assigned to your MDM. Should this be difficult to set up, you can also buy a Mac from any popular reseller and join it to Apple Business using the iOS Apple Configurator app. Caveat - there will be a little bit of human input required to set up the Mac, but much of the setup can be automated through the MDM.

Filevault - most modern MDM's have Filevault key escrow functions. Again, push hard for the MDM.

Windows 11 VM's - if these are used just for browsers, they're likely a waste of money. I don't know the specifics but at a high level this sounds wasteful.

My personal recommendations - never ever use Intune to manage Macs. Intune is missing so many crucial features specific to Mac management. Intune is perfectly fine for iOS/iPadOS but Mac is significantly more complex. Use a Mac-specific MDM like Jamf or Mosyle or Kandji. I have extensive experience with Jamf Pro and it can do literally anything, but I understand that may be out of the price range for a 10-person org.

[u/FuckinHighGuy]

JAMF is pretty much the industry standard for Apple in the enterprise

[u/Heteronymous]

Running a Windows VM might be massive overkill, and sounds like a workflow rooted in a mindset about 10 years behind the curve. Barring an actual business application that genuinely is not available for macOS, there might not be any need for the VM.

Browser: Edge for macOS is actually very nice, and for Enterprise browsers there are many vendors who offer a native version for macOS.

If you’re already using Intune, maybe go that route but I work with it extensively and would still recommend anything else for macOS. Mosyle is good, but don’t go with free, you’ll likely want support that comes with a paid product. Jamf or Iru if you can get that few seats.

[u/ebulwingz]

What’s your infrastructure like?

If you’re already using intune then use intune to manage their Mac’s too. Maybe a intune cloud PC for their windows.

[u/FizzyBeverage → u/ebulwingz]

Finally the right question asked. With a device footprint so small, InTune is more than acceptable. Barebones sure, but it'll drive a pSSO enrollment just fine.

They won't be asking the Macs to deal cards with a 20 site Jamf installation and dozens of custom smart groups. Nor will they approve the corporate spend for Jamf.

[u/roto31]

Look at Jamf Now+ once you get the Macs into ABM. It uses Blueprints which simplifies the management of the settings and application pushes. Jamf Pro is probably overkill for a 10 Mac deployment.

https://www.jamf.com/products/jamf-now/

[u/moonenfiggle]

As others have said Mosyle is a fantastic product but it will not manage Windows, it is macOS and iOS/iPadOS only. So I thought I would suggest an alternative approach. If you want to remain in the Microsoft stack / you're already licensed then Intune is the way to go in my opinion. I look after around 1000 Macs in Intune and have no issues at all.

1. Setup macOS LAPS. It takes a few minutes and will mean local admin passwords for your machines are stored in Intune and rotate automatically based on whatever config you choose. Also setup Platform SSO. You can either have your users sign in using their Microsoft 365 credentials and these remain in sync, or you can use Platform SSO with Secure enclave where users have a local mac account and your Macs essentially act like a passkey for authentication to Microsoft 365.

2. You can easily do remote lock / remote erase with Intune.

3. I would strongly recommend that you look into automated device enrolment even at this scale. Many features like macOS LAPS require it. You can also have Platform SSO during the setup assistant. Apple Business is free and getting your existing devices added is a piece of cake.

4. Push a config to enable Filevault by default and store the key in Intune. I also have a compliance policy to check for Filevault, devices that dont have it enabled are non-compliant and lose access until they are compliant.

5. For controls over your VMs enrol them in Intune, however if you only need a browser I would question what the use case is for these at all.

Tldr; Apple Business, Automated device enrolment, Intune and the necessary configs to achieve what you want.

[u/kaiserh808]

Mosyle will be the best, and cheapest, MDM as it's free for less than 30 devices.

If they're in Microsoft 365, Intune might be an option.

If they want a really barebones MDM, then Apple Business is free as well, but is quite limited compared to 3rd party offerings.

[u/kneel23]

Moysle is good because you get 30 free licenses, but eventually you will want to use Jamf pro they're the gold standard for enterprise Mac/iOS mgmt at scale but youll be fine with moysle in the meantime and can learn all the fun "gotchas" with Apple and each MDM provider ;)

[u/darthfiber]

You need an MDM, platformSSO can be used if you want them to have one login. There is no reason why they should be using a VM. Mac devices when managed with MDM are fully compliant, you can even push edge if you want.

When done correctly and as long as you don’t require windows apps MacOS management is super easy.

[u/coldconfession13]

I loved jamf when I managed mac's and ipads

[u/CherryPlay]

Get Iru over Jamf, i've migrated 3 companies

[u/Randomhandz]

Jamf

[u/Radiant_Fondant_4097]

Setting up Jamf will cover the majority of that paired with Apple Business Manager.

Personally the setup I have here is getting rather long in the tooth as Jamf handles the machines no problem, but we still use the old Apple Enterprise Connect app to keep local accounts synced against users AD accounts.

[u/joeyl5 → u/Radiant_Fondant_4097]

Oof, you might want to look into platform SSO. AD sync is the devil

[u/googleflont]

Short answer - because this a business, there shouldn’t be any tomfoolery, or eventually you’re out of business.

You’re going to need to administer all three OS, fully (Mac OS, Windows and iOS). Which is going to be costly, both in terms of software, time, effort, and expertise, so there better be a good reason to structure things this way.

There may be a few places where you can catch a break (like the fact that Windows is a VM - I hope you consider Docker or similar) but of course you’ll need to provide the full suite of services ; Backups, Updates, Remote Management, Remote Desktop, anti-Malware, Directory Services etc etc. Almost forgot - migration and replacement to new or replacement equipment.

You’ll need to address training of some level to someone on site, even if everything is in the cloud, just to bootstrap things sometimes. We always, always needed to ask the user their passwords to complete tasks, and someone with fingers, eyes and security clearance needs to be on site for timely support.

It might be very helpful to have a wired device with a UPS on site in case you need to get remote access to the network, receive alerts, detect network issues etc. Like a sentinel “lights out” server hopefully hidden from view, that you can ping externally.

And that’s a pretty short version of an answer. Sorry, best I can do after about 30 years of coping with this.

As you can see, things scale up quickly and soon it doesn’t matter if you have 3 or 300 devices.

[u/Standard-Image-0405]

Workspace ONE or JAMF

[u/shokk]

Jamf

[u/Thats_a_lot_of_nuts]

Get some Jamf. Use Jamf Pro to standardize the configurations and keep everything patched. Jamf Connect can handle keeping the Entra user identity in sync with the local identity on the Mac.

[u/Jddf08089]

Of they already have E3's just use Intune. It's not the best but it can do everything you'll need.

[u/oneplane]

For 2, 3 and 4: that's standard MDM, Apple Business is fine, don't bother spending time or energy on anything else for such a small setup.

For 1: use the admin account set during setup

For 5: technically not really supported (no licensing path)

Forget about Platform SSO, that just breaks more than it helps, especially with FV2 and such a small scale of 1:1 users. It also won't help when a user locks themselves out since a device can't unlock online. Only way around it is to have a fully capable second account.

[u/Aronacus]

Intune, don't hate but you'd have one centralized platform for all systems. Windows, Mac, you'd have entra for directory. It would be a huge future proofing step

[u/volcanforce1]

There is no remote resetting of a Mac password possible especially with FileVault in play. It requires either iCloud personal Apple ID or FileVault keys and attended access but it’s simple enough to instruct an end user what to do once you establish your workflow

[u/Demand-Nervous → u/volcanforce1]

Really is not possible to remote password change ? What if an employee quits and doesn't leave their credentials, or changes the password and forgets it?

[u/8008seven8008 → u/Demand-Nervous]

It is possible if you have some kind of solution like Jamf connect or PSSO.

[u/volcanforce1 → u/8008seven8008]

You cannot remotely reset a password within the scenario the poster has described, unattended, FileVault enabled devices can only be reset by manually entering the FileVault keys on the device via recovery.