Original articles and guides for Mac admins — solutions and insights I've worked out in production, and couldn't find written down anywhere else.
ABM's built-in device management pins every custom package to a SHA-256 hash and can't run scripts. A payload-free pkg whose postinstall pulls the current installer from Azure Blob gets you evergreen installs anyway.
Jamf sites are static and smart groups don't move records into them. Here's a scheduled routine that reads an Entra-tied smart group and assigns each member to the right site through the API.
A policy that worked for years suddenly logs 'bad magic number' after a macOS update. Here's why LibreSSL breaks Jamf's encrypted script parameters — and the openssl flags that fix it for good.
A sealed MacBook configures itself in twenty minutes with nobody from IT touching it. That's not magic — it's a specific chain of network calls, and when zero-touch 'doesn't work,' it's almost always one broken link. Here's the chain.
Every MDM demo looks the same. The real differences show up three weeks in — in how each one does smart groups, scripting, identity, and compliance. A field comparison of the three I run most, with the specifics that matter.
New write-ups on Apple device management — real problems and the fixes that hold up. Straight to your inbox, no spam, unsubscribe anytime.