macOS Corporate Owned

Corporate-owned macOS devices are the workhorses of most organizations. These are devices purchased by the organization and issued to users as their primary device to get work done.

Fortunately, Apple and Jamf have made the on-boarding of new macOS devices in management – thereby becoming sanctioned – extremely easy.

The overall process is:

1. An organization purchases new devices via their authorized Apple reseller
2. The device is drop-shipped to the end user
3. The user unboxes and powers on their device
4. The device is automatically enrolled into the organization's Jamf Pro instance
5. A local user account is created on the device using the employee's IdP credentials.

Configuring Zero-Touch Device Deployment

We strongly recommend utilizing Apple's Automated Device Enrollment (formally "Device Enrollment Program") capability to automatically on-board devices into device management without IT having to manually pre-configure them. This will enable devices acquired via authorized suppliers – Apple, carriers, or other resellers – to automatically become "sanctioned" by enrolling to MDM upon first boot.

To adopt this deployment method, follow the below steps:

1. If you don't already have a Apple Business Manager or Apple School Manager account, create one per these Apple Sign Up Instructions.
2. Setup Automated Device Enrollment in Apple Business/School Manager.
3. If this is your first use of Jamf Pro, follow the Jamf Pro Getting Started Guide.
4. Complete the steps to Integrate Jamf Pro with Automated Device Enrollment (video).
5. Configure Computer PreStage Enrollments to define how new devices should behave once enrolled from Automated Device Enrollment.

At this point, all new devices purchased from the indicated authorized suppliers will automatically enroll into Jamf Pro out-of-the-box!

Deploying Jamf Connect

Jamf Connect complements automated device enrollment into Jamf Pro by providing IT administrators with additional capabilities:

• Creating a local standard or administrator macOS account based upon the user's IdP credentials and group memberships.
• Providing an enhanced and customized zero-touch onboarding experience.

We recommend configuring Jamf Connect to bind your end users' macOS corporate managed devices with their cloud identity:

1. Configure Jamf Connect to integrate with your organization's identity provider.
2. Create a Jamf Connect Configuration via Jamf Pro.
3. Configure multi-factor authentication to enhance endpoint activation security.
4. Deploy Jamf Connect via Jamf Pro.

Now when users on-board their new macOS device, their device will not only be enrolled into Jamf Pro, but they will have their local user account created per the identity provider identity and entitlements. Cool!

Customizing Zero-Touch Enrollment

You can further customize the on-boarding process in an advanced, script oriented manner. This allows you to present text, images, and even videos during the initial macOS provisioning process to help on-board your user into your organization.

See Customizing the Zero-touch macOS Onboarding Experience blog article for details.

Deploying Jamf Protect

Jamf Protect provides comprehensive and zero-touch deployed on-device and in-network threat protection on macOS devices.

The Jamf Trusted Access solution necessitates the deployment of Jamf Protect to actively guard devices from threats while assessing a device's risk level, which influences risk-based access to organization data.

1. Get started by setting up your Jamf Protect environment. For a more guided set up, see the Jamf Protect Evaluation Guide.
2. Deploy Jamf Protect via Jamf Pro to guard against on-device threats and help maintain device compliance.
3. Configure and deploy Network Threat Prevention to actively block malicous network traffic from impacting the endpoint.

Deploying Jamf Trust

The Jamf Trust app is required to enable various security services on macOS devices, including Jamf Private Access.

Private Access is used in the Jamf Trusted Access solution to enable access for trusted devices to company resources. The following steps outline the high-level steps required to streamline deployment of the Jamf Trust app via Jamf Pro:

1. Follow the steps in Enabling Access for Trusted Devices to configure Private Access in RADAR.
2. Configure and deploy these additional profiles to streamline the Jamf Trust activation process:
   1. Bootstrapping the Jamf Trust App Activation: Be sure to define Jamf Protect as a required security app as advised to reduce threat exposure.
   2. Pre-Authorizing VPN Installation: Eliminate the user to have to authenticate to their device to install a VPN configuration for Private Access.
3. In Jamf Pro, configure the "Jamf Trust" app to be automatically deployed to target devices via Volume Purchasing:
   1. Configure Volume Purchasing Integration.
   2. "Purchase" a large number of licenses of the "Jamf Trust" app in Apple Business/School Manager.
   3. Deploy the Jamf Trust app via the Volume Purchased App Deployment process.