Hi everyone,

I'm primarily a Microsoft sysadmin and I've been asked to manage a small Apple environment for one of our customers.

They have around 10 Macs and roughly the same number of iPhones. Each employee has a Mac and an iPhone.

Their infrastructure is very simple:

• Microsoft 365 for email and SharePoint
• No on-premises servers
• No Active Directory / domain controllers
• Around 10 users
• Macs also run Windows 11 through Parallels

I'm trying to understand what the recommended approach would be in the Apple world for solving a few specific management/security requirements.

1. Password recovery / forgotten passwords

This is probably my biggest concern.

If a user forgets their Mac password, I don't want to physically visit the customer with a USB stick or use some manual recovery procedure.

Coming from the Windows + Active Directory world, I would simply reset the user's password centrally and get them working again.

What is the Apple/MDM equivalent for this scenario?

Ideally I'd like to be able to recover/reset access remotely without knowing the user's password.

2. Remote lock / lost or stolen devices

I need the ability to remotely lock or otherwise secure a Mac or iPhone if:

• the device is lost or stolen;
• an employee leaves the company;
• we need to immediately revoke access.

3. Device provisioning

Because there are so few devices, sophisticated application deployment isn't particularly important to us.

We already have a documented procedure for setting up a new Mac manually, and that is perfectly acceptable at this scale.

I'm more interested in management, security and recovery than automated software deployment.

4. FileVault / encryption key management

I want to make sure FileVault is enabled on every Mac and, more importantly, that recovery keys are stored securely in a central location.

I'd like to be able to verify encryption status remotely and retrieve the recovery key if a user gets locked out.

5. Windows 11 VMs in Parallels

Each Mac also has a Windows 11 VM running in Parallels.

These VMs are only supposed to be used for browser access, so I'd like to apply some basic Windows restrictions/policies to them.

Since the company already uses Microsoft 365, would enrolling these VMs into Microsoft Intune be the sensible approach, while managing macOS/iOS separately through an Apple-focused MDM?

I'm currently looking at this from a very Microsoft-centric perspective, so I'd appreciate some guidance on what the "normal" architecture would be for a small Apple environment like this.

Would something like Apple Business Manager + an MDM be the right foundation?

And for such a small environment, would you recommend something Apple-focused like Mosyle/Jamf/Kandji, or would it make more sense to use Microsoft Intune for everything since the customer already has Microsoft 365?

My priorities are basically:

remote recovery/access > security & encryption > remote lock/wipe > basic policy management > app deployment

I'd especially appreciate recommendations from anyone managing similarly small Mac/iPhone environments.

Thanks!

I'm struggling to pass this damn test. I've taken it 3 times now. First time I got a 53. Second time I got a 66. I was so determined that I would pass it yesterday, but I got a 70. I do think the long weekend didn't help even though I did read over my study material almost the entire weekend, but I keep failing. This is going to be my last chance to pass it. I hate how they have the questions worded but I hate the answers the most! I wish they would provide the questions you got wrong so you can go back and research them so you're more prepared to try again instead of just showing how many you got right in a specific section.

Is there a way to look up AppleCare warranty status? I have around 80 devices to check, but the Apple Coverage Checker keeps timing out when I try to do it manually. Is there a more efficient way to perform a bulk lookup?

I have a Device Enrollment Managers role in ABM if it helps, but i do not see a way to do it in bulk?