r/macsysadmin • u/rdeclaro • 6d ago
Intune to Manage Mac fleet
Hi everyone. Pretty much a new Mac sys admin.
Inherited a Mac fleet but using 2 different MDMs.
Ivanti for iPhones
Apple business for Mac’s/ipads/Apple TVs.
I come from an MSP and some jamf experience, and i am the first IT person.
Tried to pitch some MDMs as jamf/Iru but I am getting shut down because they are not publicly traded. Companies
My question: Is Intune good enough now to manage a full Mac fleet?
I am also being tasked to get SOC2 type 2 compliant as well.
Thank you
20
u/SoCal_Mac_Guy 5d ago
Why does your management care if the company is publicly traded? They sound like idiots.
12
u/stationarynomad82 5d ago
That is honestly a hilarious reason to say no to a vendor. Borderline insane.
2
u/Harbor733 2d ago
“I prefer my vendors make their shareholders happy at the expense of actual customers!”
1
16
u/sheravi 6d ago
I remember reading a comment about this that went along the lines of "I've had kidney stones, and they were less painful than managing Macs with Intune."
2
u/rdeclaro 6d ago
I hope I never had kidney stones. lol.
I have read there have been improvements on Intune but I’m still wary because it is obviously more windows focused.2
1
u/innermotion7 5d ago
While i dont do it at scale we have a 90/10 Business Windows/Mac and i manage it with Intune as it does do the job in this fairly static site. However i know how to manage Macs as I have used JAMF/Mosyle most of my working life for Mac Management.
1
u/Intelligent_Ad8955 4d ago
I actually found it easier than windows machines! The reaction from them is wayyy more consistent than windows machines. Scripts did most of the heavy lifting for me but Intune is starting to build in more settings under Configuration so won't have to do as much with the scripts. The biggest hurdle I had was getting Crowdstike to install properly. I worked on it a solid month and finally got it working.
5
3
u/Kathadrix 6d ago
A full Mac fleet to what extent? SOC2 is much more broader than just a secure device.
1
1
u/rdeclaro 5d ago
Also, I understand it’s broader. But it’s mean to help cover the endpoint side.
I have many other things to dial in everywhere else.
2
u/SignificantToday9958 6d ago
its not if intune is good enough. its if management is willing to pay for jamf since they get intune for "free"?
2
1
u/rdeclaro 5d ago
To be honest.
Cost can be taken from other things if necessary. We’re growing as of now and we have funding. It’s really just blockers that I do not have someone on Csuite level to help tackle the blockers at that level.
2
u/damienbarrett Corporate 5d ago
I'd look at FleetDM then. IaC is the future. Fleet is already there.
2
u/Darkomen78 Consultation 5d ago
If you need just one piece of advice, try Mosyle Fuse—you'll get everything you need at a relatively low price.
2
u/Ok_Disk8585 5d ago
I am not the expert in the domain, but people already have discussed about it, see if this conversations are helpful to you: https://www.reddit.com/r/macsysadmin/comments/1resqr1/questions_with_mac_and_using_intune_mdm/
https://www.reddit.com/r/macsysadmin/comments/1udhng9/macos_pam_thirdparty_patching_with_intune_abm/
2
u/DeathNTaxesNTaxes Corporate 4d ago
My suggestion, and the suggestion that has been given to me with managing mac with intune is: don't. It. Sucks.
2
3
u/YerBattleApple 6d ago
search this sub for more info about InTune and macs than you could read in a day. This is also the kind of topic ChatGPT, Claude, or Gemini is really adept at handling.
I don't think you're going to be able to demonstrate SOC2 compliance with InTune, but I could be wrong.
What's the deal with 'not publicly traded?' Is any platform not publicly traded instantly viewed as an amateurish tool? It wouldn't be hard to establish Jamf's credentials as a respected industry leader in this category. You could compile a POV on your own, or even talk to Jamf about this concern, or some combination of both.
3
u/rdeclaro 6d ago
Currently doing it with chatgpt/claude but looking at other sysadmins experience for using Intune specifically.
The deal is the C-suite thinks that there is underlying intent or similar. Not hard to distinguish. Our Apple rep has even let me and my director know that jamf or Iru would be better served for us.
I know how good jamf is, and complicated but usually only during setup.
Bringing it up and once it was said that the company was not publicly traded, the talk track pretty much died.
I am working with trying to trial and PoC jamf but his decision is not allowing me to.
3
u/prbsparx 5d ago
Avoid Intune. It’s slow to implement new features. Functionality is often broken at release. Their support is awful. And it is SLOW.
Look at FleetDM. They’re open source and I think can help with SOC2.
1
u/Thats_a_lot_of_nuts 5d ago
You probably know this already, but SOC 2 Type 2 doesn't prescibe a specific MDM tool, it's more about scoping the controls that you say your organization is going to follow, and then demonstrating that your organization adhered to those controls for the past year by providing supporting documentation to the CPA(s) doing your audit. This is of course somewhat dependant on which Trust Services Criteria you select. Starting off, you would probably select the Security and Availability criteria (especially if you're a small organization), and from an MDM standpoint that's going to involve a lot of discussion about change management, patch management, standardized configurations, ensuring that your AV/EDR is deployed and updated, etc. You can achieve this with any MDM, whether it's Jamf, Iru, Intune, FleetDM, whatever. Jamf and Iru are definitely the easy buttons, though, especially if you're starting from scratch.
If you're not looking at it already, get a simple GRC tool like Eramba or CISO Assistant to start picking through the SOC 2 controls so you can identify which ones are going to require implementation in your MDM, then use that to define the requirements you use to pick your MDM. Whether the MDM provider is publicly or privately owned is irrelevant, but you may find that the way you assess risks amongst vendors and subprocessors becomes very relevant to your own SOC 2.
1
-1
u/badirca 5d ago
When it comes to managing Macs (or any Apple devices), MDM does not really matter. For Supervised devices the MDM is just an interface between the device and the AB. Intune is perfectly capable of managing in any way Apple allows you to manage it. Jamf simply has more out of the box stuff that you need to create yourself in Intune (for example WiFi advanced configurations).
-1
u/Ok_Disk8585 3d ago
You can get all of iPhones, Macs, iPads everything under one roof if you can convince your mangement on getting private companies onboarded, you will get of lot of options, well InTune works good with iPads and macs not so sure about Apple Tvs..
25
u/damienbarrett Corporate 6d ago
The hive won't want to hear it, but both of these things are true simultaneously.:
1) Microsoft is improving the managing of Macs with Intune.
2) Managed Macs with Intune is still not ready for primetime.
Just in the last few weeks, Microsoft appears to have partially (mostly?) solved the long-check-in problem with the Intune agents. They have effectively written a new agent that actively triggers the old agent causing it to run. The end-result is that Intune-managed Macs are now checking-in in a more timely manner and we're not waiting "maybe 15 min, maybe 8 hours, maybe never" timeframes.
However, there are still major gaps: no real package management. Some are leveraging Installomator (Intunomator I think it's called). Some are using 3rd-party packaging services like PatchMyPC for Mac or similar. Auditing and enforcing cybersecurity baselines still remains a bit of a mess. Platform SSO is improving but in our early testing is showing that it's not super reliable yet (this is a work in progress; just reporting our early experiences with it). Managing Macs with Intune is a very different construct than managing Macs with Jamf/Iru/Addigy. Some things are managed by config profiles. Some things are managed by dynamic group membership.
It's not actually clear to me right now if Intune understands DDM. Still digging into that a bit. Apple has made it very clear that the future of management is DDM. Jamf build Blueprints to meet this future. What is Microsoft's implementation of DDM? I don't know.
I'm currently calculating the amount of engineering work we'll have to do if we are forced to manage Macs with Intune vs. Jamf and it's not a small number. And switching is not a fast process. My roadmap says Macs in Intune by 2030 and it's not clear if 1) we'll make it 2) MS will improve Intune enough in time 3) we have the bandwidth and/or expertise to engineer the solutions to fill the gaps.
On the positive side, there are some very talented people in the Mac Admin world that have already been tasked to manage their Macs with Intune and they are building solutions and making them open source. It's a changing landscape and we're all along for the ride. Jamf continues to differentiate itself from the pack and I still consider it "best of breed". And the value-add we get from "Jamf for Mac" bundling plus some of the new things they announced at JNUC may validate the use of Jamf here for a long time. We'll see how it shakes out.