admin

SOP — Manage macOS Devices with Jamf

Version 1.0 Date 2026-06-22 Tenant context mptwork.com · Jamf Cloud mptwork.jamfcloud.com Product Jamf Pro (full Apple device management) Companion SOPs Apple Business / APNs accounts — sop-get-apple-id-abm-google-managed-play-mptwork.md · Intune alternative for Mac — sop-manage-devices-intune-mptwork.md Goal: enroll and govern company and BYO Macs with a repeatable pattern — integrate Apple → enroll

SOP — Subscribe to and Manage Google Workspace

Version 1.0 Date 2026-06-22 Example domain mptwork.com Admin console https://admin.google.com Replace the example values (mptwork.com, sample users) with your own. The Admin console setup wizard generates your exact verification token and DNS records — copy those from the wizard; the values below follow Google'

SOP — Provision a Company Apple Account, Apple Business (ABM), and a Corporate Google Account for Managed Google Play

Version 1.0 Date 2026-06-22 Tenant context mptwork.com (mptwork.onmicrosoft.com) Purpose Create the three organization accounts that Intune needs to manage Apple and Android devices Companion SOP Device management — sop-manage-devices-intune-mptwork.md Recency note (June 2026): On April 14, 2026, Apple Business Manager became "Apple Business" (it

SOP — Set Up and Manage Microsoft Entra ID

Version 1.0 Date 2026-06-22 Tenant context mptwork.com (mptwork.onmicrosoft.com) Console Microsoft Entra admin center — https://entra.microsoft.com Companion SOPs M365 setup — sop-subscribe-manage-m365-mptwork.md · Device management — sop-manage-devices-intune-mptwork.md Goal: stand up Entra ID as the identity provider for mptwork.com — strong authentication, Conditional Access, and single sign-on

SOP — Manage User Devices with Microsoft Intune

Version 1.0 Date 2026-06-22 Tenant context mptwork.com (mptwork.onmicrosoft.com) Console Microsoft Intune admin center — https://intune.microsoft.com Companion SOPs M365 setup — sop-subscribe-manage-m365-mptwork.md · Endpoint protection & compliance — sop-m365-intune-defender-soc2-iso27001.md Goal: enroll and govern company and BYOD devices across four platforms with a consistent pattern — enroll → make

SOP — Subscribe to and Manage Microsoft 365

Version 1.0 Date 2026-06-22 Example domain mptwork.com Example tenant mptwork.onmicrosoft.com Companion SOP Device management & endpoint protection — sop-m365-intune-defender-soc2-iso27001.md Throughout, replace the example values (mptwork.com, sample users) with your own. Always copy the exact domain-verification and MX values from the admin center — the ones below

SOP — Microsoft 365 Intune and Defender

Version 1.1 Date 2026-06-22 Scope Tenant signup → Intune device management (Windows, macOS, iOS, Android) → Microsoft Defender endpoint protection → SOC 2 / ISO 27001 control mapping and evidence (assessment handled outside Purview) Primary admin portals M365 admin (admin.microsoft.com), Entra (entra.microsoft.com), Intune (intune.microsoft.com), Defender (security.microsoft.

Global Network Reference Architecture

Version 1.0 Date 2026-06-22 Scope 3 subsidiaries (US, Japan, UK) · AWS, GCP, Azure · on-premises offices Companion diagram global-network-hub-spoke-topology.svg Supernet 10.0.0.0/8 (RFC 1918) 1. Purpose and scope This document describes the target-state global network connecting three subsidiary offices and their respective public-cloud and on-premises environments.

Use Case — OpenVPN Client VPN to the UDM Pro Max with RADIUS Authentication

Gateway UniFi UDM Pro Max (US HQ office) VPN client pool 10.12.70.0/24 (the VPN VLAN) Auth backend UDM built-in RADIUS server Tunnel OpenVPN (UDP 1194), TLS + username/password via RADIUS 1. Choosing the approach (read first) UniFi's VPN options don't include a

Use Case — Site-to-Site VPN: US Office ↔ AWS VPC

On-prem side US HQ office, UniFi UDM Pro Max — 10.12.0.0/16 AWS side US AWS prod VPC, us-west-2 — 10.1.0.0/20 Tunnel IPsec site-to-site (IKEv2), static routing DNS UDM built-in DNS → conditional forward → Route 53 Resolver inbound endpoint 1. Architecture Office (UDM Pro Max) AWS

Use Case — US Office Network on a UniFi UDM Pro Max

Subsidiary US (10.0.0.0/12) Location US HQ office (on-premises) Gateway UniFi Dream Machine Pro Max (UDM-Pro-Max) On-prem block 10.12.0.0/14 (US on-prem) Office block 10.12.0.0/16 (US HQ) Segments 8 VLANs (Corporate WiFi, Guest WiFi, Data, Application, Management, Printers/IoT, VPN,

Use Case — US prod VNet in Azure

Subsidiary US (10.0.0.0/12) Provider / region Azure · West US 2 (westus2) Environment prod VNet Regional (vnet-us-prod-westus2), address space 10.8.0.0/19 Subnets 4 regional tier subnets (pub, app, data, mgmt) + platform subnets Each subnet is regional and automatically spans West US 2 zones 1, 2,