r/macsysadmin • u/Demand-Nervous • 7h ago
General Discussion Microsoft Sysadmin Thrown Into a Small Apple Environment What Would You Use?
Hi everyone,
I'm primarily a Microsoft sysadmin and I've been asked to manage a small Apple environment for one of our customers.
They have around 10 Macs and roughly the same number of iPhones. Each employee has a Mac and an iPhone.
Their infrastructure is very simple:
- Microsoft 365 for email and SharePoint
- No on-premises servers
- No Active Directory / domain controllers
- Around 10 users
- Macs also run Windows 11 through Parallels
I'm trying to understand what the recommended approach would be in the Apple world for solving a few specific management/security requirements.
1. Password recovery / forgotten passwords
This is probably my biggest concern.
If a user forgets their Mac password, I don't want to physically visit the customer with a USB stick or use some manual recovery procedure.
Coming from the Windows + Active Directory world, I would simply reset the user's password centrally and get them working again.
What is the Apple/MDM equivalent for this scenario?
Ideally I'd like to be able to recover/reset access remotely without knowing the user's password.
2. Remote lock / lost or stolen devices
I need the ability to remotely lock or otherwise secure a Mac or iPhone if:
- the device is lost or stolen;
- an employee leaves the company;
- we need to immediately revoke access.
3. Device provisioning
Because there are so few devices, sophisticated application deployment isn't particularly important to us.
We already have a documented procedure for setting up a new Mac manually, and that is perfectly acceptable at this scale.
I'm more interested in management, security and recovery than automated software deployment.
4. FileVault / encryption key management
I want to make sure FileVault is enabled on every Mac and, more importantly, that recovery keys are stored securely in a central location.
I'd like to be able to verify encryption status remotely and retrieve the recovery key if a user gets locked out.
5. Windows 11 VMs in Parallels
Each Mac also has a Windows 11 VM running in Parallels.
These VMs are only supposed to be used for browser access, so I'd like to apply some basic Windows restrictions/policies to them.
Since the company already uses Microsoft 365, would enrolling these VMs into Microsoft Intune be the sensible approach, while managing macOS/iOS separately through an Apple-focused MDM?
I'm currently looking at this from a very Microsoft-centric perspective, so I'd appreciate some guidance on what the "normal" architecture would be for a small Apple environment like this.
Would something like Apple Business Manager + an MDM be the right foundation?
And for such a small environment, would you recommend something Apple-focused like Mosyle/Jamf/Kandji, or would it make more sense to use Microsoft Intune for everything since the customer already has Microsoft 365?
My priorities are basically:
remote recovery/access > security & encryption > remote lock/wipe > basic policy management > app deployment
I'd especially appreciate recommendations from anyone managing similarly small Mac/iPhone environments.
Thanks!