SOP — Manage macOS Devices with Jamf

Goal: enroll and govern company and BYO Macs with a repeatable pattern — integrate Apple → enroll → configure → deploy apps → secure → support via Self Service. Jamf Pro is used throughout; replace example values with your own.

0. Prerequisites and product choice

• Jamf Pro is the tool for full IT-managed macOS (this SOP). Alternatives: Jamf Now (lightweight, small business), Jamf School (education). Jamf also offers Jamf Connect (identity / IdP-backed Mac login) and Jamf Protect (endpoint security), sold standalone or in bundles — verify current packaging and pricing at jamf.com.
• A company Apple Account and a verified Apple Business organization (formerly Apple Business Manager) — see the companion Apple SOP. The same Apple Account is used for the APNs certificate.
• Admin access to your Jamf Cloud instance (mptwork.jamfcloud.com) with a Jamf Pro administrator account.
• Macs ideally purchased through Apple or an authorized reseller so serial numbers can be assigned in Apple Business for zero-touch enrollment.

Part 1 — Stand up Jamf Pro and Apple integrations

1. APNs push certificate: Jamf Pro → Settings → Global → Push certificates (Apple Push Notification service). Download the CSR, sign in to the Apple Push Certificates Portal with the company Apple Account, upload the CSR, download the certificate, and upload it back to Jamf. Record the Apple Account and renew annually with the same account — if it lapses, all Macs lose management.
2. Automated Device Enrollment (ADE) token: in Apple Business, create an MDM server, assign it your devices, and download the server token (.p7m). In Jamf Pro → Settings → Device Enrollment, upload the token. This links Apple Business to Jamf for zero-touch enrollment.
3. Volume purchasing (Apps & Books): download the content token from Apple Business and upload it under Jamf Pro → Settings → Volume Purchasing to license App Store apps.
4. (Optional) Identity: deploy Jamf Connect to tie the macOS login to your IdP (Microsoft Entra / Google / Okta) with password sync, or configure SSO to the Jamf Pro console.
5. (Optional) Conditional Access: integrate Jamf Pro with Microsoft Intune (via Entra) so Mac compliance state is shared and Entra Conditional Access can gate corporate access.

Part 2 — Structure: groups, categories, and sites

1. Categories: Settings → Categories — create logical buckets (e.g., Security, Productivity, Browsers) for policies and Self Service.
2. Static Groups for fixed sets; Buildings/Departments for org metadata; Sites only if you need delegated multi-tenant administration.

Smart Groups (dynamic, criteria-based) — the backbone of scoping. Examples:

Part 3 — Enroll Macs

3.1 Corporate zero-touch (PreStage / ADE)

1. Confirm the Mac's serial is assigned to the Jamf MDM server in Apple Business.
2. Jamf Pro → Computers → PreStage Enrollments → create a PreStage:
   • Choose which configuration profiles/packages install during Setup Assistant.
   • Configure account creation (e.g., create a hidden managed local admin; set the user's account to Standard).
   • Set Minimum Required macOS Version and Setup Assistant panes to skip.
   • (Optional) add Jamf Setup Manager for a branded, scripted enrollment experience.
3. Scope the PreStage to the device serials. On first boot, the Mac enrolls automatically with supervised, User-Approved MDM.

3.2 BYOD / existing Macs (User-Initiated Enrollment)

1. Settings → User-initiated enrollment → enable for macOS and brand the page.
2. Users browse to https://mptwork.jamfcloud.com/enroll, sign in, and install the MDM profile (this requires user approval for full management privileges).

Part 4 — Configuration profiles (settings and security)

Computers → Configuration Profiles → create profiles with the needed payloads, then scope to Smart Groups. Common baseline:

Part 5 — Policies and packages

Computers → Policies carry out actions on a trigger at a frequency:

1. Build or upload packages (apps, fonts, settings) and scripts.
2. Create policies with triggers such as Enrollment Complete (provisioning), Recurring Check-in (maintenance), or a Custom event, scoped to Smart Groups.
3. Typical policies: install the base app set at enrollment, run inventory/maintenance scripts, bind/configure settings, and set the device name.

Part 6 — App and patch management

1. App Installers (Jamf App Catalog): deploy and auto-update common third-party apps (browsers, Zoom, etc.) from Jamf's curated catalog — Jamf handles packaging and patching.
2. Volume-purchased (VPP) apps: assign App Store apps device- or user-based.
3. Patch Management: track app versions against latest and remediate out-of-date software via Smart Groups + policies.
4. Self Service: publish optional apps and IT actions for on-demand install (Part 8).

Part 7 — Security and compliance

1. FileVault: enforce via the Disk Encryption profile and escrow recovery keys to Jamf; use Reissue FileVault key for rotation. Track the Macs - FileVault Off Smart Group to zero.
2. Endpoint security (Jamf Protect): deploy for threat prevention, behavioral detections, and telemetry; forward events to your SIEM.
3. Compliance benchmarks: apply hardened baselines (e.g., CIS for macOS) via configuration profiles/policies and report on drift.
4. Conditional Access: with the Intune integration (Part 1), require a compliant Mac in Entra Conditional Access before granting access to Microsoft 365 / SaaS.

Part 8 — Self Service and end-user experience

1. Brand Self Service (Settings → Self Service) as "MPT Work."
2. Publish app installs, printer setup, VPN, and IT scripts as Self Service items so users help themselves without a ticket.
3. Use Notifications to message users about updates or required actions.

Part 9 — Inventory and reporting

1. Computers → Search Inventory for hardware, OS, apps, encryption, and management status.
2. Use Extension Attributes to collect custom inventory data; build Smart Groups and Advanced Searches for reporting and exports.
3. Review the dashboard for at-a-glance fleet health (encryption, enrollment, patch posture).

Part 10 — Lifecycle and remote actions

From a computer record → Management commands:

Leaver/offboarding: lock or Wipe corporate Macs (or Remove MDM for BYOD), reclaim the VPP/app licenses, and release the device assignment in Apple Business if redeploying.

Part 11 — Ongoing operations

Appendix — Building blocks and caveats

Enrollment methods

Glossary: Smart Group = dynamic, criteria-based device set; Policy = triggered action (packages/scripts); Configuration Profile = managed settings payloads; Self Service = user app/action catalog; App Installers = Jamf-curated managed app deployment + patching.

Caveats

• The APNs certificate must be renewed yearly by the same company Apple Account; lapse = total loss of management.
• ADE requires devices to be assigned in Apple Business; non-Apple-channel devices need user-initiated enrollment.
• Apple Business is the April 2026 successor to Apple Business Manager (same business.apple.com).
• Verify current steps against Jamf's Learning Hub — console layout, Setup Manager, and Declarative Device Management evolve frequently.