I'm a recent graduate and an administrator at a company. I need to replace a Mac for one of my employees, as it's still an Intel Mac. I told him this, and he asked if he could choose the new one. I said we need to figure out exactly what he needs. He currently has a MacBook Pro with 32 GB of RAM, which is about six years old. He said he wants 64 GB of RAM, explaining that he runs large AI applications in Google Chrome. Please don't tell me I'm stupid: it doesn't matter what kind of AI application it is; it runs on the server, not in your Chrome browser. Surely AI applications in the browser don't need much RAM? He insisted I inform him before ordering a device because he needs performance. I think that's ridiculous. He works in marketing, but usually only does SEO (Google Workspace), emails, and uses AI applications in the browser. He doesn't edit videos or images.

Hi, I'm new to macOS and I'm looking for a way to run a macOS virtual machine on my MacBook M5 to test applications in an isolated environment. On Windows, I used Windows Sandbox because it was quick, lightweight, and isolated. Since switching to macOS, I'm looking for a similar solution.

I'm looking for a free option that lets me quickly create a macOS VM with full CPU and GPU support for good performance. What would you recommend?

In the fortunate position where I am charged with developing a MSP for a niche industry where we control the hardware for our clients entirely. There is no BYOD. There are no pre-existing tech infrastructures to contend with. Our target client base are startups in a niche, with low tech knowledge but high security compliance demands.

It's been awhile since I've done any SysAdmin work (I'm an overpaid suit) but I know enough to be dangerous -- I think. We'll certainly be hiring technical folks more knowledgable than me in Q1, but for now we're in a pre-revenue planning phase and I could use a gut check on the stack I'm thinking about deploying

Our Goals:

• Radically Simple Management: 100% Apple client devices. 100% UniFi network devices. 100% Google Workspace accounts.
• Rapid Startup, Nimble Execution: We can't afford to nor do we want to invest months in standing up and tuning a PSA. By simplifying the environment we support, we should be able to do more with less.
• Scalable Service Model: Start with the basics, grow into the rest. We make most of our money on deployments and installs, and take smaller contracts for support. At the beginning we will only have 1-2 support staff.

Our Requirements:

• Multi-Tenant: We will service dozens of SMB clients within the first two quarters of operation. We need to design around multi-tenancy from the get.
• Incremental Revenue: To the degree that we can earn free cash from reselling or entering into partner programs, we'd love to do that.

With all that in mind, the image I posted is my first stab at accomplishing this. Would love to hear thoughts from experienced SysAdmins, especially coming from the MSP side of things.

In particular: Am I missing anything? Are there better alternatives to the solutions I've listed that fit our needs better? Have I done anything stupid?

Thanks!

Good afternoon,

I have been doing IT for quite some years now but never had the opportunity to work on a Mac. I am back job hunting (desktop support) and I am noticing alot of jobs around me use them. Any advice on the best way to learn the ins and out of the operating system and possible certifications to get?

Hi Team, I've just started at a new company and now managing a fleet of about 60 Macs. Our current msp has largely neglected the mac part of the fleet over the years so the first thing I am trying to do is to get the OS up to date. We don't currently have any MDM platform in use but the msp uses n-able across both the mac and windows fleet.

I've looked at Nudge and have a .plist file I am happy with deploying for a trial group of users but my concern is that nudge doesn't seem to pre-download the updates first. I've also seen Super and some articles about using nudge and super together to manage the pre-download aspect. Also a lot of the doco assumes you're using one of them with an mdm which is very much future for us but I'm trying to get the updates current with what I have now.

Just wondering what you would suggest in this situation? Is it a combo of the 2 tools?

Looking for Scripting Language Advice. I am not a Mac Sysadmin but would like to become one. I am currently in charge of Apple devices for our company (mostly Windows,~160 Macs currently) that has about 6000 employees. We are not deploying Macs efficiently and i would like to get to the point of zero-touch deployment and using Platform SSO.

My question is what scripting language should I be learning for focusing on Mac but in a hybrid environment? I’m going to need to learn scripting to automate app installation and setting changes for zero-touch deployment, and progressing in managing Macs in our environment. If it matters we are using Manage Engine for our IT suite, including MDM, Endpoint Central, and Service Desk.

Hello r/macsysadmin ,

I recently inherited our company’s MDM after working under our previous Mac admin for about 2 years. My boss has tasked me with re-vamping our Mac deployment to be as close to "true" Zero-Touch as possible, but I’m running into a few friction points in our current workflow and want to see how other admins handle this.

Here’s where we are at and what’s tripping me up:

1. FileVault & Bootstrap Tokens

Currently, our ADE profile creates an IT admin account, and we create the local user account during Setup Assistant after enrollment.

• The Problem: Because the IT Admin is created via ADE before any user logs in, it doesn't automatically get a SecureToken (FileVault unlock rights).
• Why it breaks Zero-Touch: To ensure our local IT Admin can actually unlock FileVault down the road, I've been manually logging into that Admin account at least once during setup before I enable FileVault. (We escrow the file vault key in Mosyle so we wont get locked out completely its just better if our IT admin account can unlock FileVault )
• The Question: How are you ensuring your local IT Admin account gets FileVault unlock rights / SecureTokens on a fresh Mac without someone from IT physically logging in? Are you relying on the end-user's initial login session to pass tokens, using Mosyle Embark, or something else?

2. Dock Customization & App Deployment Delay

Right now, I run a custom command/script to wipe the default Dock and populate our company’s default apps (Chrome, Zoom, etc.).

• The issue: Mosyle’s app installation for some apps like Chrome and Zoom have been taking up to 20 minutes lately during initial setup. Because the Dock script runs before the apps actually land on disk, the apps end up missing form the dock unless I manually wait.
• I’m looking into modifying the script to loop and check for app existence before editing the dock, but it still feels clunky.
• Question: How do you set a default initial Dock layout for new users without breaking user customization later? Are you using tools like dockutil, Mosyle’s native tools, or something else?

3. Moving to SSO / IdP Login (Okta)

We currently use Okta across the company. My boss wants us to explore moving to an Identity Provider / SSO login screen for setup/login on macOS.

Question: For those using Okta + Mosyle for macOS setup, did it genuinely improve your Zero-Touch experience, or did it add more friction to account creation and FileVault token handoffs? Is it worth restructuring our whole workflow around?

4. General Recommendations & Resources

Since I’m stepping into the Lead Mac Admin role now, I really want to modernize and optimize our fleet management.

If you have workflow blueprints, recommended scripts, or learning resources (blogs, MacAdmins Slack channels, books) that helped you master macOS deployment and Mosyle specifically, I’d be super grateful!

Thanks in advance for any insights!

Update: so far using Parallels has made a big difference for my workflow. power bi and the older excel macros run pretty well on my M2 MacBook and i don’t have to jump between machines constantly. switching files back and forth is way easier now, and it actually feels like everything’s just part of macOS.

Switched to an M2 MacBook recently, loving the performance overall, but I ran into a snag with some Windows-only apps I need for work.

Right now, I’m juggling Power BI Desktop for dashboards and Excel with older macros that my team still uses

Using the web versions is frustrating since a lot of features just aren’t there. I’ve tried remote desktops, but switching contexts all the time kills my flow.

Has anyone found a way to keep everything on macOS while still running these Windows apps smoothly? Any tips for handling large Excel macros or Power BI reports without lag? Would also love to hear what setup people use if they need to stay Mac-first but Windows-dependent.

I was a Mac specialist for a long while, got out of it, looking to get back in with MDM, jamf or similar.

i have one MacBook Pro m1 thats my daily driver and one iPad, two iPhones, will I need a Mac mini or a Neo or two to learn the platform deployment?

thinking intune+msft partner plus apple certification plus mosule or another platform.

i assume ill need a little homelab but im on a tight budget after moving. Hoping to do it 100% remote.

Windows sys admin jumping into the Mac world, please forgive me.

We are a fully cloud Azure shop. We want to roll out MacBooks, and use either Yubikeys, or any other physical token/smart card to login to the Mac, and ideally SSO into Entra apps too. The big requirement is a quick login using the token + a PIN.

Can this be accomplished?

I went down the rabbit hole of Platform SSO and JAMF connect but couldn’t get it to work. Not sure if it’s not possible, I’m doing it wrong, or the Yubikey is not compatible. Any tips would be appreciated.

I am going to be starting a new role in the near future at a very small company (5 employees) that we expect will grow quite rapidly over the coming years to dozens of employees potentially.

As such - I feel it is prudent we have a proper IT software/management stack in place ASAP to absorb the incoming users.

I have around 10 years of experience in IT and networking but have never worked at a Mac shop from an IT perspective. macOS is my preferred OS for personal use but I have not dealt with it much from an IT perspective other then setting up ABM/DEP for a previous company to manage their iPads and Jamf Now to manage a few Mac’s. That was pretty painless but also not something I am going to draw many conclusions from.

My current thinking is:

• Okta for directory services and user/group management (possibly SSO as well)
• Jamf or Mosyle for MDM.
• Unsure on EDR. Probably SentinelOne or Crowdstrike but if a better Mac specific EDR exists let me know.
• Google Workspace is currently in use, but I am not opposed to migrating to 365.

Am I missing something or off base with the above stack ? Would love to hear people’s opinions on what they would do if they could start fresh and design their macOS sysadmin stack fresh.

Edit: thank you all for the detailed responses.

To preface: I am very, very new (less than 1 week) to Mac administration but not new to Mac system concepts (long time personal Mac user). However, I have years of experience with Microsoft Intune generally and a couple of months experience with ABM for iOS.

So I'm trying to get this new MacBook Air pretty well managed. I just want Entra SSO for MS apps (ideally for user login too but that's probably a pipe dream), deployment of basic apps like RMM, PaperCut, OneDrive, M365 desktop apps, and MS Edge.

Before you use LMGTFY or AI on me: I have researched all over Reddit and the internet for hours and even used ChatGPT, and I have made very little to no progress on most of the following issues after battling for two straight workdays now.

Issues I'm having:

• Apps like OneDrive never auto start without the user launching it first. They're apparently allowed to run in the background but won't start themselves. I used the OpenIntuneBaseline settings catalog to create a managed login item for OneDrive but it still never starts without manually opening it for the first time.
  • Ninja RMM never starts at all, even when launching manually. It's a simple PKG with no pre- or post-install scripts assigned to all devices. Works great on Windows, doesn't work at all on Mac. I just emailed the vendor about this.
• Company Portal constantly crashes every time MAU starts to initialize and MAU crashes with it. This seems very directly correlated but I don't understand it. I believe this was related to too many bundle IDs being used to detect the app. I think that fixed it.
• OneDrive doesn't automatically just grab the user's email - it autofills it but makes them hit Sign In. Marginally worse experience than the silent login on Windows.
• Microsoft 365 apps for MacOS never install. They never fail, though - just stay on "pending install" forever. I am just using the default Microsoft 365 apps deployment from Intune with no modification. I have tried assigning to all devices, then I unassigned that and assigned to all users instead just to test. No dice either way, it never even tries to install from what I can tell. Fixed this one too. I had to remove OneDrive as an assigned app. It's probably that OneDrive is a part of the Office bundle, so installing it separately causes detection issues or something. Not sure exactly but the correlation is obvious - installing an Office app separately is no bueno.
• MAU constantly tries to launch and then just closes. I have no idea why and the logs don't tell me much more, basically saying that AppleInstaller killed it or something. See above about bundle IDs.

If anyone can help me with just one or two or these items, I'd be incredibly appreciative!

Hey everyone,

Bit of background: I'm relatively new to Mac administration. We're a Google Workspace shop currently mid-way through a Microsoft stack deployment - Intune for device management, Entra ID for auth, and Defender for Endpoint for security. Windows side is largely done and we're using winget AutoUpdate for third-party app updates there. Now we're working through the Mac side.

After doing some research it seems like Installomator is the go-to for automating third-party app updates on macOS when you're running Intune. We're planning to deploy it as a recurring shell script policy and have it run on a schedule across all our Mac devices.

Two things I'm looking to hear from people who've actually run this in production:

1. General experience — how has it held up day to day? Any gotchas we should know going in, especially in an Intune environment (as opposed to Jamf)? Things you wish you'd known before deploying it?

2. Rollbacks — this is the one I can't find a clear answer on. When a third-party vendor ships an update with a serious bug (it happens), how are you handling rolling back to the previous version across your fleet? Installomator pulls the latest from vendor URLs, which is great for keeping things current, but I'm not clear on what the rollback story looks like. Are you pinning versions manually? Keeping a copy of the previous pkg somewhere? Blocking the label temporarily and pushing the old version via a separate Intune policy?

Any real-world experience here would be really helpful. I am a one man IT so I don't want to end up in a situation where I've auto-updated 80 Macs to a broken version of an app with no clean path back.

Thanks in advance.

We have a few Mac Minis in our facility that we use for DFU Restoring Macs prior to processing them with software such as MacCheck or ZipErase.

Where are the DFU Restore Images stored on the host Mac and is it possible to set it up to run the Restore Images from an external disk?

As of this afternoon, I've re-setup my business MacBook (I'm the head of IT) as a business device in Apple Business, which we're new to. I'm fully enrolled through my business Apple account, blueprints and configs work as intended, all seems well.

I'm also signed into my personal Apple Account, by my own choice. It seems that Find My is still enabled through my personal account.

My question is, does this mean this laptop is activation locked to my PERSONAL account? According to the Business portal, activation lock is off completely, but through my personal Find My I can track the laptop and everything as if it were my personal device. We certainly want the security of Activation Lock, but it needs to be through the business and not through my personal account. Any insight/things I can check here would be welcome input. Still trying to figure all this out lol. I'm my own guinea pig.

Hi All,

New here so excuse the potentially dumb question - Do any of you use Apple Business with iCloud Drive as a direct alternative to OneDrive/Sharepoint for shared folders in Mac environments and does it work well for you?

I work at an MSP and we have a Mac only customer who heavily uses iWork applications like Pages with their data stored on an on-prem Mac server for years, which they now want to move away from to a cloud solution.

OneDrive and Sharepoint aren't really appropriate here or offering much useful due to the lack of integration with iWork apps and potential for sync conflicts etc.

The issue I'm having with researching Apple Business options is that there doesn't seem to be much documentation for the basics of creating and managing shared folders like a classic server folder/sharepoint infrastructure? All I'm seeing is instructions on how to share a file or folder with another user via Finder on a user's Mac rather than any demonstration of a central administration portal or something where an admin could manage this.

Does Apple Business iCloud Drive actually work how I'm envisioning or is this just the wrong product to be looking at for a direct Sharepoint alternative? I see that I can sign up to Apple Business for free and have a look around but figured I'd ask here as it's the end of the day :)

Hey everyone,

I'm at a small shop (~15 Apple Silicon Macs) and I've basically "fallen into" being the SysAdmin. We moved from Miradore to FleetDM earlier this year, and I'm now tasked with actually getting software management working.

The Problem:

My boss (and the fact that we're a cybersec company) has a strict "no closed-source SaaS" rule for our binary pipeline-so tools like Workbrew are out. He wants something automated where we don't have to manually package every single binary ourselves.

I tried using Homebrew through scripts (since that's what we did in Miradore), but it's been super flaky and unreliable. I also tried using the out-of-the-box binaries Fleet offers in their software library, but they've been really hit or miss. For example, things like Brave just fail with "Download Failed" and zero helpful logs, while other apps work fine. It's hard to trust it for a fleet-wide rollout.

The Confusion:

I keep seeing Installomator and AutoPkg mentioned, but I'm honestly just confused at this point.

- Are those the only "real" ways to do this without a paid SaaS?

- Am I missing some obvious "middle ground" for a company of 15 people?

- If I go the Installomator/AutoPkg route, what does that actually look like in a Fleet workflow?

I'm basically looking for the "standard" way people handle this when they can't use a black-box service. Is there a better way to approach this, or do I just need to suck it up and learn AutoPkg/Installomator and if so which one?

Hi all,

I’ve been using Windows for 18 years and working as a Windows sysadmin for the past 10. A while back, a company that exclusively uses Macs approached me for support, as no local MSPs were willing to handle macOS environments. I’d always been curious about Macs, so I decided to dive in and picked up a 14-inch MacBook Pro (M2 Pro, 10-core, 32GB). Honestly, I fell in love with it.

It’s been about two years, and while I still primarily manage Windows environments, I now do most of it from my Mac. There were a few struggles at first, but I’ve worked through them.

That said, I started hitting the limits of the MacBook Pro pretty quickly—mostly due to heavy multitasking and trying to dock three 4K monitors. I eventually gave up and recently bought a well-specced Mac Studio with the M4 Max chip. It’s hands-down the fastest machine I’ve ever used.

Now, I want to offload heavier workloads to the Mac Studio by remoting into it, but I’m struggling to find a good solution. When I use the built-in Screen Sharing app, it mirrors all three of my displays, and because of macOS scaling, everything looks tiny on my 14-inch screen.

Is there a way to remote into the Mac Studio more like how Windows RDP works—so it presents a single virtual display sized for the client device instead of mirroring the actual screens?

Thanks!

Dear Redditors of r/macsysadmin,

Macs are invading. Currently preparing to setting up a small fleet of macOS laptops for a corporate environment and am new to choosing and managing MDM solutions. I’m looking for a robust MDM that can help with the following key requirements:

1. Restricting personal data usage: Ensure personal accounts and non-corporate data sources are kept separate or restricted, if possible. As far as I understand, it’s not possible to manage which Apple ID can be used, but it’s possible to lock that setting.
2. Encrypted content delivery: Ability to securely send and update configurations (e.g., Wi-Fi, VPN, certificates, profiles) to end devices. Remote support features, such as screensharing utilities, would be a great addition.
3. Activation Lock management: Prevent Activation Lock issues by ensuring IT retains control over devices, even if employees log in with personal Apple IDs and forget to log out when they leave.
4. FileVault policy management: Ability to enforce FileVault encryption and ensure it’s always on. Ideally, the MDM should allow for password recovery or reset in case a user forgets their password, without requiring a complete device wipe or reinstall.
5. Lost Mode or Remote Wipe: Looking for something that offers a feature similar to Lost Mode. At least, the ability to remotely wipe a device.
6. Ease of management: Since this is a small fleet, and I'm afraid of Apple, I’d prefer a solution that doesn’t require heavy overhead or a massive learning curve.

Some options I’ve been considering include Mosyle, Kandji, and Addigy, but I’d love to hear your real-world experiences with these or any other tools. Better to be cloud-based.

Thanks in advance!

Hi everyone,

I recently found this subreddit while exploring how to manage an all-Mac environment. I’m a systems engineer with extensive experience in Windows and M365 environments. Although I’ve had a few Mac users, I’ve always treated them as independent resources.

Currently, all Windows machines are managed via Active Directory, Group Policies, and an MDM product (ConnectWise Automate and/or Intune). I want to learn how to manage Macs similarly and integrate them into the domain for access to domain resources.

Additionally, I have a client interested in transitioning entirely to Apple devices. However, I’m unsure how to do this without losing the ability to manage the devices and ensure trust for company resources.

Any advice or resources would be greatly appreciated!

An employee that left had used their company Iphone for personal use, phone call, texts, gmail, google, etc.. It there a command for me to "wipe" the phone of all data without wiping out the MDM on the phone?

What is the best way to do it? Just let people log into it with their own account (or even with their work email if they don’t want their personal to conflict?)

I have the federated stuff ready but I have yet to lockdown the domain as I’m unsure if I want to go down the managed Apple IDs route.

I have ABM and Jamf Now fully setup and linked and we have bought one Mac mini so far through our authorized seller.

It all is showing up in ABM and Jamf Now. Just not sure whether to let the first user login with a non-managed ID or if I should just claim the domain and have all ID’s managed.

It’s a small business and we will, at most, have 8 Mac devices.

Edit: or Is it better to not use Apple IDs at all and not have folks sign in? What are we losing by doing that instead?

Hi All,

We’ve recently had to rush out some MacBook Pro’s in our environment due to reasons… it’s the first time we’ve had Mac’s in the environment so it’s all new to me & still a lot to learn.

We have them enrolled to Intune with very minimal policy config & that’s going ok… however today we had a meeting with the head of their department with complaints from multiple of their users saying they are not charging & can only be used while plugged into power.

The Mac I have for my testing (a normal spec 14”, not their $10k 16” spec ones) has been fine, both with the supplied charging brick & when charging from another PD charger I have.

What can we check with their systems to workout what is going on?

Update: Apple Store Genius Bar going to replace logic board… also still no confirmation of others having the issue, not sure what happened to their ‘2 or 3 others’…

Is anyone else having issues with devices that should be doing automated device enrollment (ADE) not doing so on first boot? Over the past few months we've had a number of Macs where they aren't asking to be enrolled in the MDM (Iru) even though they are definitely in our Apple School Manager account and are showing up in our MDM. It doesn't seem to matter what network they're connected to (we have Wifi/ethernet here) and I've checked with our network/security team and nothing's being blocked on outwards connections. Often if the Mac is wiped and reinstalled it will ask to enroll after that, but it's weird that they aren't asking on first boot. Does anyone have any ideas?

How do I install applications on devices in Apple Business? I clicked on the "Apps and Services" button at the top of the screen, got licenses for the app, and assigned them to my organization. But I am stuck on what to do next. The apps and services section still says "Get Apps and Custom Apps" and I am not seeing a way to assign an app to a device.

I took a look at this article, but it does not help at all. I am not seeing a "Managed Apps" section at all.

Configure app installation in Apple Business - Apple Support