Right, and this lesson we're going to talk about mobile device management.
This is more or less an introduction and overview of what mobile device management or MDM is for short.
And talk a little bit about what this is.
So this really was introduced originally.
The hence the name Mobile was originally introduced as a concept for iPhones, for iPhone, iOS, iPad.
And it's basically a technology that's used for managing an endpoint device settings, using custom
XML configuration profiles.
And these are basically a file that ends in a config profile when you're talking about the Apple platforms.
And they're basically made up of one or more payloads of what they're called that that specify a device
setting.
So you could have a single mobile config profile that says, you know, here's where the doc is on your
Mac.
This is the size.
This is the, you know, the icons that are included.
And that would be considered the the information about the doc the doc settings would be considered
a payload inside the mobile config profile.
And you can have multiple payloads per mobile config.
You can have that that same doc payload and then a wallpaper payload that is there as well.
And so you could push out that.
And when it's installed, it would set your dock where you want it and change the wallpaper to a standard
profile center wallpaper they would use.
They'd be at your organization.
And so you can you can sort of bunch these together and choose how you want to set them up.
Some administrators prefer to have a single payload per config profile so they can get very granular
and in setting up machines.
Others tend to bundle them together where they may have something that's, you know, all the user interface
type things like the doc in the wallpaper and that kind of thing, all in one profile and then maybe
another profile that has the VPN settings and Wi-Fi settings.
That's their network profile.
You can really decide how you want to do that and structure those accordingly.
But essentially what you're doing when you're building these mobile config profiles is setting up a
set of settings and configuration policies that you want to install on a machine and enforce on a on
a machine.
So one of the things that have really changed in the last 12 to 18 months is how MDM has really gone
from being a nice to have on OS to a requirement on these newer Mac OS 11 and and later versions of
the operating system.
What we were doing before with iOS is now kind of migrated into Mac OS.
So when you're talking about using MDM on iOS, you're really looking at pushing these configuration
profiles out either through Apple Configurator with an attached device or you're pushing them out most
often over the air using an MDM solution like Apple profile manager or one of the various third party
ones like jambe or ADG into Microsoft has one call into and we'll get into those a little bit later
or Morsell.
But essentially, you're making these changes and then you're pushing the changes out to the machines
over the Internet and they're and they're hitting the machines and getting installed.
So as I mentioned, mobile sort of designates the origin of the technology on iOS devices.
And this is really taking off not only in the Apple realm, but it's also taking off from Windows as
well.
Microsoft has a product called Intune that they're using to do more MDM, not only on Android and iOS
devices, but also Mac OS and even Windows PCs, Windows 10 and one to the Web and also provide for
MDMA like management through the Intune product.
And what you can typically do with this on devices that are running Mac OS 10 X, which would be like
Catalino, which is 10 to 15 last Mac OS 10 version and older is you could build your profiles and then
you could use a script using the profiles command to install those without needing an MDM.
But as you move into Mac OS 11, the profiles command has been deprecated and removed from Mac OS,
and it is no longer available for sysadmins to use to install mobile config profiles.
So you have to purchase an MDM solution.
So if you're using Mac OS Big Sur, which is, you know, the minimum requirement on apt selection.
So if you've got Apple, Silicom Macs, are you planning to purchase Apple's little Comox in the near
future?
Please be aware of that.
You will need an MDM if you're choosing to push mobile config profiles to the machines.
So if your workflow today involves using the profiles command or, you know, using mobile config profiles
in some way and you don't have an MDM, you should definitely go shopping for one before you plan your
migration to Mac OS 11 or Apple Silicom.
There's a lot of very good MDMA vendors out there, I had mentioned a few of them had a G kanji Mosul.
Mosul has an education version and a few and Mosul fuse, which is their hire and business package as
well.
A lot of these and that, of course, Champ and JMW Jam now has been around for a very long time.
They started many years ago with the the Apple immagine solution, Casper.
And they've always been on the forefront of Mac OS Systems Administration.
So there's there's a number of really good ones out there.
They all have different cost structures.
They all have different features.
A lot of them are starting to bundle their bundle of other products in with their MDM.
So, for example, Morsell Fuze includes the ability to push certain applications out that are not in
the app store.
They kind of maintain a list of of packages that they maintain themselves that are sort of pushed out,
as well as authentication against, say, Microsoft Azure.
You know, if you want to do have an authentication product that goes along with your MDM, as well
as all the mobile configuration profile settings and payloads that would be in your traditional MDM
solution, JMW does much the same thing.
And when you look at something like Fleet Smith, that's one that Apple's actually purchased.
It's still operating under the Fleet Smith name, but it's actually owned by Apple as sort of like their
first a first party MDMA solution.
There's just many, many of these out there.
Too many to list here.
I had also mentioned that if you are using Office 365, Microsoft also has a tier of that product that
includes Intune, which also works for a mobile device management.
Some of these are better than others.
And depending on your needs, you're going to have to kind of evaluate what works best.
If you're already a Microsoft shop and you're already managing Windows machines with Intune.
Take a look at Intune for iOS and Mac OS, and maybe that will, you know, satisfy the need without
having to purchase additional services just for the Mac.
And, you know, a lot of them all have sort of a free trial.
You know, I think you can get 10 seats a fleet smith to use as long as you want to learn how to use
the system.
Mozilla has a similar thing, I think JMW now as of as well.
So take a look and see, you know, depending on what your needs are, what is out there that can meet
them.
They all are relatively easy to use, but there are some that require more scripting than others.
So depending on what you want to do and what your you know, your level of competencies with some of
the scripting and things like that versus the graphical user interface setup, take a look at what's
out there and see what will work best for you.
I would say at least as far as getting started in MDM, if you haven't done anything with mobile device
management before, I would you know, what we're going to do in this course is we're going to cover
Apple Configurator and Apple profile manager.
And so Apple Configurator is a great way to just kind of learn what payloads do to your machines.
So, you know, I would recommend taking a test iOS device and just hooking up to configurator and,
you know, push the push the buttons, make some changes to the settings and push those out to the devices
and see how they change the device.
You know, I could sit here and demonstrate every single one of the payloads to you, although I think
you'd probably be bored sleep.
There's really no better way to get into this stuff than just rolling up your sleeves and getting your
hands dirty and having a test device that you can push configurations to and and see how it reacts is
really a great way of kind of understanding what the payloads do and then how you may want to arrange
those into specific configuration profiles and how those get built into your users and your groups.
And that's what we get into as we roll into Apple profile manager a little bit later in the course.
One of the things with profile manager is it's a reference spec.
It's basically, you know, not really intended unless you have a very, very small group of machines,
really not intended as a production environment for for MDM.
You could get away with it for like you say, you know, a small organization, but with you know,
with the way that it's set up and what we're going to do in this course, it's perfect for just kicking
the tires on an MDM solution and seeing what the possibilities are.
And you can, you know, look at all the different available available payloads on a per operating system
basis.
So it's separated into iOS, macOS and those that that will do both.
And so it's a really good tool to kind of, you know, try.
You over the air thing, especially if you've got, you know, some facts that you want to try.
Just an out of box experience and take them through the whole process of enrolling them into an over
the air MDM and then pushing configurations to them.
You know, Apple profile manager is pretty cheap.
It comes with MapQuest server.
All you need is a Mac that you can run it on and another Mac that you can, you know, try to manage.
So definitely worth messing around with if you're interested in just kind of kicking the tires on MDM,
but not sure, you know, how it fits with your overall desktop strategy.
And then if you really, you know, know that you need an MDM, you've read about it, you've seen what's
out there, and you want to just dive into the deep end.
By all means, pick up a free trial of one of the various commercial MDM solutions and give them a test
run.
And, you know, you'll find some that you'll like.
And, you know, depending on the price performance feature set, you kind of filter down to what you
think will work for you, get your test instance up.
I've had, you know, very good support from Mosul.
I've had very good support from into from Microsoft on Intune.
And, you know, there's the vendor will help you along the way, make sure that you get your system
operating.
The great thing about a lot of these third party MDM is that they are all cloud hosted.
So you don't have to really have, you know, anything sitting on your network.
That's one of the major downsides, I would say, with profile manager is that it still needs a Mac
running Mac OS 10 servers sitting on your network somewhere, you know, in a DMZ pointed out to the
Internet so that it can push these configuration profiles out.
So, you know, using one of the MDM third party vendors to to get kind of a test instance up is great
because it's already in the cloud.
There's no infrastructure for you to set up.
You just have to request it through the the vendors website and start setting it up with your environment.
So I will say a lot of these all kind of, you know, work the same way because they are based on the
the the data and the configuration in the API that Apple provides.
So, you know, a lot of the same things that will go into setting up, say, an Apple profile manager
instance, like, you know, installing your your tokens for dapper VPE, configuring different server
addresses, configuring users groups, a lot of those kinds of things.
And obviously the payloads themselves are all going to be very similar from solution to solution.
So you should be able to really grasp the concept of using MDM with almost any of these systems.
And a lot of that is transferable knowledge.
So, you know, whichever one you are starting to play with doesn't mean you have to stick with that
one.
And it's not a waste of time to to learn how Apple profile manager works as well, because once you
kind of, you know, learn the basic concepts of the stuff and the setup of it, you really would apply
those same concepts and set up to any of these MDM vendors.
So like I say, the best thing to do at this point is just roll up your sleeves and dive in.
We'll go through a lot of the different, you know, configuration options with Apple profile manager
and, you know, setting up PvP tokens and setting up all of the other different connections back to
Apple school manager or Apple business manager.
And then, you know, you can take that information and apply it to your own organization and your own
MDM vendor and start playing around with what is available to you and how you want to basically build
your management strategy around that.