Hi all,
We've been slowly killing off Macs here as they just were not being used, with the exception of one member of staff who uses Pro Logic X on an aging iMac. It's showing it's age, and I would like to kill off the old Mac Mini running Server that we had installed to look after the suites of Macs we once had.
But, I've been told to keep this one member of staff on Mac so we've got hold of a shiny new Mac Mini and I'm playing with getting it setup and trying to understand things better but hitting a few brick walls with it due to my lack of understanding on these devices. It all seems overkill for just one member of staff, but from a technical curisosity point of view and again while only just one device I really do want to do it 'properly' from a professional stand point also. Also, the device will be used by a few other students as well so it's not like it's a 1:1 device so not wanting students accessing it using a staff members logon.
Device is enrolled via DEP into our Apple School Manager from our reseller, as we use a number of iPADs that are enrolled into Mosyle as our MDM for these devices.
My options that I'm playing with at the moment are:
Enroll it into Mosyle and manage it in that, but to utilise the new Auth 2 so I can get Single Sign On to work using Microsoft as the Indentifier involves upgrading to their One K12 level from Premium which while not a massive cost increase ($5.50 per device/year to $9 per device/year) you have to have a minimum of 30 devices which seems stupid as I only want one device. I played about a bit with it enrolled into Mosyle Premium but need to sort of SSO bits and although I could join it to AD we're not using On Prem storage anymore so woud like to tie it better to M365, OneDrive etc.
Or, lets see what InTune can do, so have setup the link with ASM to InTune and all the necessary tokens for ASM, Intune, VPP, etc and all seems good after resetting the device so it's no longer part of Mosyle. Management profile gets forced onto device when erased/reset and get's joined into InTune ok and following a few guides setting up Config Profiles for SSO enable me the ability to log on to the device using M365 credentials which in turn creates the local user and keeps the password in sync. Part of this process is installing Company Portal but the profile that this wants to install when you sign in throws up an error about not finding the profile using the Encryped Profile Service. Do I actually need this as InTune obviously installed this but is it actually required if the device has been added via DEP? Am I just going round in circles? I feel while InTune is limited, as long as I can get it working from the user ease point of view and get all the hardening sorted out later. InTune is sort of the future right? I get the impression MacOS integration is improving all the time so want to really
Appreciate any help, I'm doing a lot of reading trying to get myself up to speed, but appreciate a few pointers to get me in the right direction.
Pete
↧