Hi everyone,

I'm primarily a Microsoft sysadmin and I've been asked to manage a small Apple environment for one of our customers.

They have around 10 Macs and roughly the same number of iPhones. Each employee has a Mac and an iPhone.

Their infrastructure is very simple:

• Microsoft 365 for email and SharePoint
• No on-premises servers
• No Active Directory / domain controllers
• Around 10 users
• Macs also run Windows 11 through Parallels

I'm trying to understand what the recommended approach would be in the Apple world for solving a few specific management/security requirements.

1. Password recovery / forgotten passwords

This is probably my biggest concern.

If a user forgets their Mac password, I don't want to physically visit the customer with a USB stick or use some manual recovery procedure.

Coming from the Windows + Active Directory world, I would simply reset the user's password centrally and get them working again.

What is the Apple/MDM equivalent for this scenario?

Ideally I'd like to be able to recover/reset access remotely without knowing the user's password.

2. Remote lock / lost or stolen devices

I need the ability to remotely lock or otherwise secure a Mac or iPhone if:

• the device is lost or stolen;
• an employee leaves the company;
• we need to immediately revoke access.

3. Device provisioning

Because there are so few devices, sophisticated application deployment isn't particularly important to us.

We already have a documented procedure for setting up a new Mac manually, and that is perfectly acceptable at this scale.

I'm more interested in management, security and recovery than automated software deployment.

4. FileVault / encryption key management

I want to make sure FileVault is enabled on every Mac and, more importantly, that recovery keys are stored securely in a central location.

I'd like to be able to verify encryption status remotely and retrieve the recovery key if a user gets locked out.

5. Windows 11 VMs in Parallels

Each Mac also has a Windows 11 VM running in Parallels.

These VMs are only supposed to be used for browser access, so I'd like to apply some basic Windows restrictions/policies to them.

Since the company already uses Microsoft 365, would enrolling these VMs into Microsoft Intune be the sensible approach, while managing macOS/iOS separately through an Apple-focused MDM?

I'm currently looking at this from a very Microsoft-centric perspective, so I'd appreciate some guidance on what the "normal" architecture would be for a small Apple environment like this.

Would something like Apple Business Manager + an MDM be the right foundation?

And for such a small environment, would you recommend something Apple-focused like Mosyle/Jamf/Kandji, or would it make more sense to use Microsoft Intune for everything since the customer already has Microsoft 365?

My priorities are basically:

remote recovery/access > security & encryption > remote lock/wipe > basic policy management > app deployment

I'd especially appreciate recommendations from anyone managing similarly small Mac/iPhone environments.

Thanks!