Managing a MacBook in a Google / MS environment

[timbo343]

It would seem the day has come where an employee at one of our sites has requested a Macbook to be used over a Chromebook or a Windows device. Now the question is, which is the best platform for managing this device, is it Google Workspace or should we stick it on Intune? It won't be added to the local school domain and instead be used as a cloud device for use with Google Workspace and MS Office and really just general admin work.

 

Bear in mind that none of us have any experience of managing Macbooks.

 

Is there a way to lock the Macbook down so the end user cannot have free reign on it?

 

Is there a way to have mixed profiles on the device like a windows device?

 

Is it easy to manage?

 

I highly doubt that when we hand the Macbook over to the end user we probably won't see it again until said user has an issue with it or when it gets handed back to us for when they leave.

 

Any help / assistance / pointers would be muchly appreciated.

[TheHyperTechie]

You are limited with Google Workspace for management of MacOS devices. You would need drive for desktop installed on it, this would allow you to carry out basic tasks e.g. block the device from accessing work information (fundamental management). It isn't a suitable management platform on it's own...

 

What Apple MDM do you use? you may be able to manage it through that. This is what I would do, you could even setup a free Mosyle tenant and manage it there for free.

[timbo343]

What Apple MDM do you use? you may be able to manage it through that. This is what I would do, you could even setup a free Mosyle tenant and manage it there for free.

 

The school in question doesn't have an Apple MDM as this is the first Apple device in the school. Other schools have their own individual Apple MDMs.

 

The school had Mosyle for 1 device which was used for a student own device who needed an iPad for simplicity and large fonts though the student has now left the school. This was added into the free version of Mosyle but features of Mosyle free were very limited. I wonder if the limited features of free Mosyle would be fine for the Macbook - something to test I guess.

 

In terms of user accounts, is it still best practice on a Macbook to have local user profiles?

[mthomas08]

Mosyle can manage Macbooks I believe.

 

We're a Microsoft Vanilla network and have some iPads managed through Mosyle. Took me a while to get everything working.

-Had to take ownership of the Apple system (this took an age.. to prove my ID etc)

-Suppliers added the iPads to it

-Connected to M365 which syncs all users

-Download the apps and the licenses (even free ones)

 

Setup Mosyle

-Connect to Apple/setup licenses and keys etc etc

-Setup each profile (each profile does a set function e.g. WiFi profile/App Profile)

-Tweak certain things so they can't alter much

-Test

 

I have 2 different types.

1) Sign In system at reception (only the sign in app can be seen etc)

2) Staff shared (staff can sign in and get specific apps - some things locked down)

 

Took about 2 months but most of that was fighting Apple to take ownership of the domain.

[speakercon]

Do they have a good business case for wanting a macbook, ie it can do something the other two OS's can't?

[PotNoodleTech]

Yeh I'd be looking at the busienss case first and foremost as "want because.......erm.......well....... shiny silver yum" is not gonna get you far with me, wheras "would like have to access garageband or Lumafusion in order to deliver the 2025 video music course" is a whole different ball game.

 

Also I believe (not 100 sure%) that the free version of Mosyle only supports Ipads and if you want to start adding desktop or laptop macs you have to pay.

[TheHyperTechie]

Yeh I'd be looking at the busienss case first and foremost as "want because.......erm.......well....... shiny silver yum" is not gonna get you far with me, wheras "would like have to access garageband or Lumafusion in order to deliver the 2025 video music course" is a whole different ball game.

 

Also I believe (not 100 sure%) that the free version of Mosyle only supports Ipads and if you want to start adding desktop or laptop macs you have to pay.

 

You can manage one or the other. So either you manage iPads/iPhones/iPods or Macs. They can't be managed simultaneously, at least with the "free" tier.

[PotNoodleTech]

Ah that explains it as we've already got ipads on there so thats why it's on about charging for anything else.

[TheHyperTechie]

The school in question doesn't have an Apple MDM as this is the first Apple device in the school. Other schools have their own individual Apple MDMs.

 

The school had Mosyle for 1 device which was used for a student own device who needed an iPad for simplicity and large fonts though the student has now left the school. This was added into the free version of Mosyle but features of Mosyle free were very limited. I wonder if the limited features of free Mosyle would be fine for the Macbook - something to test I guess.

 

In terms of user accounts, is it still best practice on a Macbook to have local user profiles?

 

If the school doesn't have an MDM already, I would be looking at the Mosyle free tier to manage it. If the school plans on buying iPads in the future though, you would need to upgrade your Mosyle licenses to allow for simultaneous management of both operating systems (MacOS/iOS)

 

At least with this route you can lock it down correctly and manage it effectively.

[timbo343]

The free version of Mosyle doesn't work with Macbooks. Looks like it's either Intune or Google Workspace.

[5tu]

Mosyle is so cheap and easy to use I’d always recommend it over Intune. We use it for managing Macs and iPads. Works really well.

[timbo343]

Mosyle is so cheap and easy to use I’d always recommend it over Intune. We use it for managing Macs and iPads. Works really well.

 

Sure, thing with this is, they have bought a staff member a device and not listened to the advice that was given to them or that there is another platform that needs to be used to managed the damn thing!

Edited December 10, 2024 by timbo343

[5tu]

Sure, thing with this is, they have bought a staff member a device and not listened to the advice that was given to them or that there is another platform that needs to be used to managed the damn thing!

 

I don’t disagree with you, was just answering the OP’s question.

[TheHyperTechie]

The free version of Mosyle doesn't work with Macbooks. Looks like it's either Intune or Google Workspace.

 

Are you sure? their website states the free tier supports Full MDM protocol for MacOS.

 

You have to go to My School > Preferences > Other Settings and then enable the MacOS platform.

Edited December 10, 2024 by HyperTech

[timbo343]

I don’t disagree with you, was just answering the OP’s question.

 

Sure, apologies if it came across differently

[timbo343]

Are you sure? their website states the free tier supports Full MDM protocol for MacOS.

 

You have to go to My School > Preferences > Other Settings and then enable the MacOS platform.

 

Yuo, i'm sure

 

[Brimstone]

For a single MacBook all the faffing around with ASM and Moysle would be over the top, unless you already have a significant number of iPads.

 

All I’d do is create an admin account and turn off any settings to restrict access and then create a teacher account, depending on how much control you want you could restrict access to the App Store as well.

[TheHyperTechie]

Yuo, i'm sure

 

[ATTACH=CONFIG]72774[/ATTACH]

 

Yes, this is because you have the iOS management platform enabled. You can't have both, you either turn on the MacOS platform, and disable the rest - or vice versa.

[timbo343]

Yes, this is because you have the iOS management platform enabled. You can't have both, you either turn on the MacOS platform, and disable the rest - or vice versa.

 

We'd have to setup another Mosyle tenant to get round that restriction - one for iPads and one of Macs.

[synaesthesia]

For a single MacBook all the faffing around with ASM and Moysle would be over the top, unless you already have a significant number of iPads.

 

All I’d do is create an admin account and turn off any settings to restrict access and then create a teacher account, depending on how much control you want you could restrict access to the App Store as well.

 

For a single Macbook I'd tell whoever bought it to send it back and liaise with IT next time they have a wonderful idea like that.

Had an English teacher through recently (sorry, "doctor") demanding the same otherwise he was simply too good for the school!