How To Set up JAMF MDM Start To Finish

What's going on, everybody? It's Richard Kohberger here, the blue collar nerd. And in this video we're going to be revisiting a very important topic, and that is MDM or mobile Device management. If you own or manage a business that gives devices such as phones, tablets or laptops out to employees, then you need an mdm. I made a video on this topic a few years back, but that video was really more like a psa, just telling you, hey, you need to do this. But this video is going to be much more instructional and I'm going to go much more in depth. So first of all, why do you need an mdm? Well, there are three main reasons. Reason number one is to maintain ownership and control over your company's devices. Because without an mdm, if you just hand somebody a regular old device, the second you do that, you lose all control over that device. Meaning not only do you give up control over what happens on that device and the kind of apps that are allowed on it and kind of settings that need to be enabled on it and things like that, but you're now completely at the mercy of that employee to later relinquish control of that device back to you. Because with no mdm, once you give them the device, they can lock you out. And when it comes time to return that device, they could just not unlock it. And if you're thinking, oh well, if that happened, I would just call the company that I bought the device from and they would unlock it for me. I'm afraid it's not that simple. Even if you have a receipt to prove that you, the company, purchased that device, that is not enough to prove that you still own that device. Because people buy and sell devices after market all the time. So with an mdm, you avoid that situation. You can always reset the device on a company level, but you also gain a whole bunch of control over what is and isn't allowed on that device and how that device looks and behaves. And MDM is also going to help you maintain control of the security of these devices and the information that is housed on them. For example, you could put in a policy that forces all of your devices to use a passcode so that if the device gets left somewhere, nobody can just pick it up and see all of the company information that's housed on that device. You're also able to send commands out to the device. So, for example, if somebody reports a device missing, then you could put it in lost mode. And in lost mode, the device will be totally Locked down. And until you take it out of lost mode, all the device can do is just display a message telling the person who has the device who to contact. You could even remotely erase the device if you wanted to do that. These types of commands are also really helpful for remote troubleshooting. For example, you could force restart a device remotely from your mdm. Or you could uninstall and reinstall an app remotely. All right, now the next two reasons to have an MDM are operational efficiency and scalability and brand protection. So first of all, with an mdm, you can allow or disallow certain apps behaviors or settings on any device or groups of devices. For example, if you wanted to, you could take the App Store away altogether. Just say the App Store app isn't allowed. And then the only way that apps get onto the device is if they're pushed out from the company level. But you don't have to be that strict if you don't want to. You could also just disallow certain apps. Maybe you just want to disallow video streaming apps like Netflix, for example, because you're worried about overusing data. You could do that as well and still give them access to the App Store. It's totally up to you. You could also preload things. Like you could preload a company calendar into the native calendar app, or you could preload your office WI fi into the device so that they don't have to ask you, hey, what's the WI fi password? Plus, if you want some of your employees to have a paid app, well, then you can buy the app on the company level and then push that out so that the individuals don't have to buy it. That's where a lot of companies get into trouble because they run into that problem and they say, okay, I want everybody to have this app, but it's paid and I'm not going to make them pay for it. I want to pay for it as the company. And the solution that they come up with is to have a shared company icloud account. No, bad. That's a bad idea. Don't even think about doing that. Don't even think about thinking about doing that. That's a bad idea. If you have a shared company icloud account already, that's an emergency. Fix that today. I'm serious. ICloud accounts are intended for individuals who have multiple devices that are all owned by that one individual. And because that is the intention, data is easily shared between those devices, potentially personal data like text messages. MDM is the proper solution. So like we talked about with an mdm, you can control, yes, what apps are on the device, but you can also control things like the app layout and the wallpaper. So for devices that are customer facing, like a customer is going to see this device, it probably makes sense to control what that wallpaper and stuff is just to deliver a consistent experience and make sure that the wallpaper is something that you as a company agree with, because otherwise not only will the devices look inconsistent, but you're also putting in a lot of faith that nobody's going to pick a very individualized wallpaper. So with an mdm, once everything is properly set up, and any devices that you buy from an authorized retailer can be automatically enrolled into your mdm, meaning once this is all set up properly, you could have the device sent directly to the employee, still wrapped in the cellophane. And when they take it out and turn it on, it is going to set itself up on the MDM and it's going to become magically one of your company devices. It'll be set up just the way you want it and you will be maintaining control over the device. One last note before we jump into how to do this. I do just want to make it clear that what you're controlling with an MDM is the device itself, not any of the information on the device, which is a good thing because we don't wanna be opening ourselves up to any privacy concerns. So, for example, having an MDM doesn't give you the ability to read text messages on your company devices, but it does give you the ability to choose whether the messaging app is available on that device in the first place. Now, real quick, I want you to know that the initial setup of MDM is kind of a pain in the butt. It's not terribly complicated. Like, you certainly don't need to be an IT professional to do this, but there's just a lot of steps and all of the steps kind of make it seem more complicated than it really is. Once everything is set up, though, I don't think it's a very steep learning curve. I think you'll get it pretty quick. All right, with all that said, let's jump in. So for this walkthrough, I'm going to be focusing on Apple devices, specifically iPads and iPhones. Although the software that I'm going to be showing today can also do Mac computers. If you were looking for more Android or Windows based solutions, I'm sorry, this is not going to be the tutorial for you, but there are solutions out there for you. I believe that the Google Work suite has MDM for Android devices. Okay, so step one is to sign up for Apple Business Manager. I will put a link in the description below for where to go to do that. Now, in order to sign up for Apple Business Manager, you're going to need something called a D U N S number. This is a type of business identification number. Your business might already have one. I'll also put a link in the description down below to look up whether you do already have a DUNS number and that same page will walk you through what to do to get one if you don't already have one. The entity that issues these numbers, by the way, is called Dunn and Bradstreet. Alright, once you have an Apple Business Manager account set up, you're also going to need to sign up for some sort of mdm. The MDM that I'm going to be showing off today and the one that I recommend is a very popular one called jamf. If you do decide to go with jamf, I have a referral link in the description down below and I would very much appreciate it if you signed up through that link. It doesn't cost you anything extra, but JAMF will kick me a few bucks for sending them the business. No one's asking me to make this video. I'm doing it on my own time. So the one thing I ask in return is that if you do end up signing up for jamf, just do it through that referral link. Okay, now before we go any further, there's something we need to talk about and that is the three different types of MDM enrollment. So hands down, the best type of enrollment is no touch automated enrollment. So with that, you buy a device either directly from Apple or through one of the authorized resellers, you're able to link up any authorized retailers that you're buying from in the Apple Business Manager and I'll show you that in a second. And that way when you buy a device, Apple Business Manager knows about it, then you're able to tie your MDM to Apple Business Manager. And then as soon as that device gets taken out of the box and turned on and connects to the Internet, the first thing it's going to do is talk to Apple Business Manager who is going to automatically enroll it in the mdm. Then everything is just automatically set up. You have the maximum amount of control and there is no way that the end user of that device can remove that management. That's because with this method, Apple is the most Confident that you, the business are the true owner of that device. They know that you bought it and it was immediately enrolled. Okay, but that only works for brand new devices that you buy after you get all of this set up. So what if you already have a fleet of devices? Well, that's where we're gonna have to make some compromises. So the second best type of enrollment is through Apple Configurator. This is an app available on the Mac App Store that is made by Apple and it is able to place devices into what is called supervised mode, which gives you the maximum amount of control and then from there you can enroll it in the mdm. There are downsides to this though. Downside number one is you have to completely reset the device for this to work and you cannot then restore that device from a backup because if you restore it from a backup, it's going to restore back to its non supervised state. Downside number two is you have to physically have the device in hand and you have to have access to a Mac so that you can use Apple configurator. And downside number three is that with this method there is a 30 day provisional period where the end user could unenroll the device from the supervision and mdm. And that's because with this method, Apple has less confidence that you are the true owner of the device. Right? Like maybe you just took this device and plugged into your computer and reset it and put it in supervised mode. And so therefore it gives the end user a month long opportunity to undo that. Okay, and then there's the third method which is the worst method, but it's better than nothing. And this is open enrollment. So with open enrollment you can basically just send the end user a link and they tap that link and go through a few steps and that enrolls their device in the mdm. But this does not put the device in supervised mode. So you have very limited control. So you're not going to be able to control a lot of settings, you're not going to be able to unlock it if they decide to lock you out. You're not gonna be able to like enforce update rules. So like with supervised mode, you could say that I want these devices to stay up to date or to stay one version behind or something like that. You won't get that. You get some very, very limited restrictions and you're able to push apps to the device, but that's it. Also, the end user can take the MDM off anytime they want, forever. On the upside, you don't have to Reset the device to do it that way. That one gives you the least amount of control because there is the least amount of confidence that you are the owner of the device. Maybe you just tricked somebody into clicking that link and going through the steps and. All right, now that we understand all that, let's jump into jamf. So once you have your JAMF account set up, you're going to fill out some basic info. Email, password, name of your company, what industry you're in, things like that. It's also going to send you a link to verify your email and then you'll be taken to the main JAMF dashboard. Okay, now the first thing that we need to do is create an Apple APNS account and tie that to jamf. So APNS is the Apple push notification service. And it's necessary for some of the communications that need to happen between jamf, your MDM and the devices. It's also necessary for certain features like let's say a device is lost and so you want to put it in lost mode. You can do that from Jamf, but it uses this, it uses APNs. So on that sidebar there in JAMF under Apple Services, you're going to click apns. JAMF makes this pretty easy. They really walk you through it. And there's even instructional videos included in here. Basically you're going to first press that button that says Download certificate signing request, that's going to download a file for you. Then you're going to hit next and click that button that says open the Apple Push Certificate portal. And then and you're going to log in there using the same credentials that you use to set up the Apple Business Manager. By the way, I know I told you earlier to never ever, ever have a shared company icloud account and I did mean it. You definitely shouldn't have multiple devices out there that are all logged into one iCloud account. But for Apple Business Manager, you might want to have an icloud account that's just the company iCloud account versus one that's tied to a specific individual just because if that individual ever leaves, you don't want everything to be tied to their individual email account. Anyways. Once you get into there, you're going to click this green button that says create a certificate. You'll agree to some terms and conditions you'll hit next. Then you're able to put in some notes. You just type in JAMF there so you know what it's tied to in the occasion that you end up with multiple later on for Most small businesses, you'll never end up with multiple, but it doesn't hurt to label it, just in case. And then you're going to click on Choose File and choose that file that we just downloaded out of jamf. And then you should get this confirmation page, assuming everything goes well. Okay, Then we have to do basically that, but the other direction. So we're going to hit that download button to download a file here from Apple, and that's going to download another file. We're going to go back into jamf, we're going to click next to go to the next step, and then we're going to upload that certificate that we just downloaded from Apple. And this is a trend you're going to notice. We're doing this same kind of thing multiple times where we're putting some sort of token, a little file in JAMF and we're putting a token in Apple. And that just allows the two to kind of have handshakes and talk to each other. Okay. Then JAMF is going to ask you which Apple ID you used. This is helpful because these things have to be renewed every year. And sometimes you can forget which Apple ID you tied all of this to. And so this will remind you and prevent that issue. Once all that's done, your screen should look like this. And in that sidebar next to apns, you should have a little green check mark. Then we're going to move on to the auto enrollment tab. And this is what's going to tie JAMF to our Apple Business Manager so that we can do what we talked about earlier, where we just buy a device and it's automatically enrolled. So on the first page you're going to have three different options. If you're watching this video, most likely the option you want is Apple Business Manager. So we're going to select that and click Next. And now we're getting back into another one of those little token handshake type workflows like we just did. So we're going to click this button to download the token out of jamf. Click Next and then you'll have this convenient link to open Apple Business Manager. Open that, get logged in. If it doesn't log you in by itself, then click on Settings in the bottom left and click Device Management Settings. From there you should have this button that says Add MDM Server. So click on that. You can name the server. I would just call it jamf. You can call it whatever you want, though. And then we're going to click Choose File and find that token that we just downloaded out of jamf. Okay, now after you hit save, then you're going to click this button that says Download Token. And then you guessed it, we're going to go back into jamf, click next and we're going to upload that file that we just downloaded into jamf. Once that's done, you click this button to choose Setup Assistant steps. Okay, so what this means is you know how when you get a brand new device, there's a certain setup process like it's going to ask you to set up face id, it's going to ask you to put in iCloud account, etc. Etc. Well, with Jamf, we're able to configure our devices to skip some or all of those steps when they're being set up. So for most companies, you're probably going to want to skip things like setting up an Apple Watch, new feature highlights, setting up an Apple id, setting up Apple Pay. You get the idea. It's up to you which steps you do and do not include. Okay, then we're going to save that and we are done setting up the auto enrollment. So now we're going to move on to the Volume Purchasing tab. And this is what's going to allow us to push apps out to our devices. So again on step one, you're going to want to select Apple Business Manager. Then we're going to move on to step two and hey, we're back on that token bs. So we're going to click the link again to open up Apple Business Manager. We're going to go back to Settings in the lower left and this time we're going to click Apps and Books. Scroll down. You should see this section that says My Server Tokens. Most likely you only have one there. It's the one that we just set up. So click Download next to that. Then we're back in jamf. We're going to click next and we're going to upload that file that we just downloaded. Then it's going to ask you to choose your country or region. And that's because different countries have different versions of the App Store. So you got to tell it which one to pull from. And then again it's going to ask you what Apple ID you used. For the same reason as before, this needs to be renewed every year and sometimes you can Forget which Apple ID you used. And with that, we should have all three services set up. The APNs, the auto enrollment, and the Volume Purchasing. All right, now that everything is set up, let me show you around JAMF and show you how to actually use it. So under the Devices tab, that is of course where you're going to see any devices that you have enrolled in jamf. You can click on any individual device to see more details about it. So you've got these different tabs here. So the dashboard for a high level overview, the Details tab for more detailed information about the device. There's a Notes area where you can just type in any notes. And there's a tab where you can see what apps are installed on this device. From here, you can also force update apps or remove an app from a device. This is really useful if, say, for example, you have not given your employees access to the App Store, but there is some app that they need that's behaving weird and you want to try uninstalling and reinstalling the app just for troubleshooting reasons. Well then you can do that remotely right here from jamf. Up here we also have some additional options. We can lock the device, we can force a sync if we feel like we're looking at out of date information or something. And then we've got this kebab menu here that gives us all kinds of options. You can restart the device, you can erase the device, you can enable lost mode. So if somebody's reported this device missing, you can just put it in Lost mode and that will lock it and just display a message of like, hey, this is where to return this device to. Or this is a phone number to reach out to if you find this super useful stuff. You also of course have filters up here. If you have a lot of devices to sift through, you have sorting options. You can change the view if you prefer, more of a list view and even more options over here. Okay, then on the Apps tab. So basically, in order to put an app on a device, you have to have a license for that app. Normally licenses are acquired by buying an app or downloading an app through the App Store. But with JAMF combined with Apple Business Manager, we're able to acquire licenses in bulk and then just distribute those out to devices. So to do that, you actually acquire the licenses in Apple Business Manager and then that syncs over to jamf. So here I am in Apple Business Manager. I'm going to go to Apps and Books under this content section in the side menu here. And then up here I'm able to search for any app that I want. So let's say I wanted to put Waze on my devices. I could search for Waze. I'd Find that. Click on it. You see that I have some licenses already because I actually do have Waze on some of my company devices. You're going to choose where to assign it to. There should only be one option. We see that the price here is $0, so we're not going to be charged anything for this. And then we put in the quantity of how many licenses we need. I recommend overshooting here. I haven't really found any downside to doing that. So if I needed to install it on 25 devices, technically I need 25 licenses. But I mean, what the heck, I'm just going to go ahead and grab a hundred of them, because that way I don't have to come back in here when I get new devices and, oh, I don't have any licenses. I've got to come get some and all of that stuff. Then I would click get, and then that is going to give me those licenses. And then those licenses are going to sync over to jamf. So then in jamf, I would come to the apps tab and say, add an app. You would find the app that you just got the licenses for. You would say, add to my apps, and then you'll have it available to distribute. Sometimes the syncing of the licenses can take a few minutes, just FYI. Okay, then we come to the most important tab. That's the blueprints tab. So this is where you can create blueprints for how you want certain groups of devices to be set up. So let's say you're an H Vac company. If you have managers with iPads, you probably want them to be set up a little bit differently than technicians with iPads. And so you would set up two different blueprints, a manager iPad blueprint and a technician iPad blueprint. And maybe you give technicians both iPads and iPhones. And so you want a different blueprint for technician iPad versus technician iPhone. So in the blueprint setup, you have this side panel of tabs here. So apps, that's where we're able to assign apps to this blueprint. So maybe I want every technician iPad to automatically get service titan as an app that downloads right away. You can also assign web clips, which are basically little shortcuts that look like apps on the home screen, but they just take you to a website. You have security options. Maybe you want to require a passcode so that nobody can just pick up the device off the street and just like start scrolling through all of your company stuff. You can assign an email account, you can assign wifi Profiles. So like I said, if you just wanted to go ahead and put like the Office wifi WI fi in there so that the device is automatically able to connect to that without them having to do it and put the password in, you can do that. And then there's the restrictions tab. This may not look like much right now, but there are so many options in here. Look, let me just open one of these up. Bam. Look at all that. Look at all these options. Disable installing apps. Disable deleting apps. Disable deleting system apps. Disable Camera. Disable FaceTime. Disable Safari. Block all cookies in Safari. Disable messages. Disable podcasts. You don't need any more. True crime. It's poisoning your brain. Tim. Disable news. Disable Apple Music. Disable in app purchases. So much stuff. That's just under the app section. Then under app usage we can choose to allow all apps. We can hide some apps or we can go the other way and only allow some apps. Security and privacy, all kinds of things under here. Disable connecting with computers. Disable Apple watch pairing. Prevent changes to passcode, Prevent password autofill. Again, just so much stuff. I'm not going to attempt to read them all off, but I'm just going to rattle some off at you. Under network and cellular, you could disable airdrop, you could force WI fi on. You can prevent changes to personal hotspot, which is great. I have had somebody one time their, their data usage was like through the roof and I found out they were just using their company device as like their home Internet. Like that was just their router. Icloud, you could choose to disable basically anything related to icloud. Siri, you could disable Siri altogether. Disable Siri when locked. Force profanity filter in Siri children. Under wallpaper we can prevent changes to the wallpaper. And then you'll see over here on the side menu we have a whole separate section where we can set the wallpaper. And then under updates we can set up a certain update policy. So maybe we wanted to delay iOS updates for 30 days just to give things a bit of a buffer and help ensure that we're not going to break any essential apps. Okay, next on the side menu is single app mode. Single app mode is exactly that. It makes the device only able to use a single app. This is more intended for like devices that are meant to be kiosks or something. Okay, then under wallpaper we have the option to individually set the home screen wallpaper and the lock screen wallpaper Then under lock screen we can put in a lock screen message. A few options here. This is one good place to put in like a if lost, return to type of message for if the device gets lost and you haven't put it in lost mode yet but somebody does find it. Although it can also be good to just put in the name of the device. Hey, this is Sarah's iPad. So that if you have like a meeting and everybody's got the exact same looking iPad, they don't get mixed up. Okay. And then custom profiles. You could do things like automatically attach a calendar to the native calendar app with this. That's a little bit more advanced and outside of the scope of this video. So I'm not going to go into too much detail there. Okay. Finally, on the main navigation panel here we have the open enrollment. Open enrollment is that enrollment method that we talked about earlier that you can use a pre existing device with it and you don't have to reset the device but it doesn't give you very much control. So here you can get that link or use the QR code that you send off to the device that you want to enroll. Teammates is where you can add like other admins for JAMF and then more settings where you could like edit some basic information. You can choose here whether or not you want apps that you deploy to automatically update and you can also choose a default enrollment blueprint here. So by default when a brand new device gets enrolled into jamf, it's just going to be in the like staging area waiting to be assigned to a blueprint. But if you wanted it to just be assigned to one by default, you could set that up here. So that is an overview of jamf. Now one more thing back over in Apple Business Manager that I do want to highlight. Before you buy your first device for auto enrollment, you should come into the settings in Apple Business Manager and then go to this device management settings section and make sure that your Apple customer number as well as any reseller numbers are entered in here. This is what connects your account so that any devices that you buy are going to be enrolled in Apple Business Manager and therefore enrolled in your MDM for your Apple customer number. If it's not already in here, then you'll have to contact Apple. You want to speak to somebody specifically on the business team. I'll see if I can find a number that will get you there faster and if I can I'll put it in the description down below. And for resellers, for example, if you buy your Apple Devices from the carrier like Verizon, they should have a reseller number that you can input here. Again, you'll have to contact them for that and speak to somebody on the business team. Keep in mind that whenever you purchase devices, they need to be linked to this account. So if you're buying them online, make sure you're logged into an Apple ID that's tied to this account. You can't just walk into an Apple store at the mall and say one iPhone please and then walk out and expect that somehow that's going to work. Link to this. You never gave them the account. Like that's just not going to work. All right. Now something else I'm sure you want to know is how much does this cost? Well, JAMF offers a few different products. The one that I was showing off in this video is called JAMF now and it's the one that is best suited for small businesses. They have other products that are better suited for enterprise businesses. But if you're an enterprise business, then you probably have an IT department and so you probably have this taken care of care of already and so you're probably not watching this video. So with JAMF now, at least at the time of me recording this video, your first three devices are free and then it is $2 per device per month after that. Which to me that's totally worth it. I mean if you're a business that distributes devices to employees, I consider this pretty much non optional. The only time I would say you could maybe get away with not having an MDM is if you're a very small business with a very small handful of devices. Let's say say maybe like four devices and you really don't plan on growing. That's going to be it then maybe in that situation you could justify that it's worth the risk to not have one. But if you do plan to grow, then you should just go ahead and get on board with this early because like we talked about earlier, the best way to do this is with the no touch automatic enrollment and that only works with new devices that you're buying. So the earlier you're able to get set up with this, the better. Now I know that a lot of you watching this video are going to already have a sizable fleet of devices that are not on MDM that have to be reckoned with somehow. If you're going to do this for those, I would really recommend getting all of the devices in hand and then setting them up with Apple configurator. There are other videos out there explaining how to do that and I'll find a good one and I'll link it in the description down below for you. Now is that going to be annoying? Yes. First of all, you're going to have to have a discussion with your employees and explain to them what's happening and kind of get some buy in from them, which is probably going to be kind of difficult to do. Like I'm going to be honest with you, like they're probably not going to like this. It does mean that they are going to have less control over this device that they used to have total control over. But I would definitely at least recommend letting them know why you're doing it. Show just a little bit of empathy. Let them know, like look, this is what's best for the business and I have to make a business decision here and let them know about the pieces that are going to make their lives easier. Like now you can buy apps for them and put them on the device and now you'll have a lot more ability to help them troubleshoot while they're out in the field, things like that. Also to make sure to let them know that the device is going to have to be reset to factory settings for this to work. So make sure they know if they have any pictures or whatever on that device that they want to save, they need to get those off of there and then you'll have to wrangle them in. You'll probably want to do this like not all at once because the process itself takes some time per device. Like you're going to be plugging in the device and then doing everything on Apple Configurator and then that one's done, then you're plugging in another device and if there's like a line of 50 people behind you that all have somewhere to be and it's the morning meeting that you decided to do this. Like that's probably not the. You probably want to schedule people to come in like one to three at a time. Now if that's just absolutely not going to work for you, then you can do the open enrollment. But again, you do lose a lot of functionality when you do that. Like I said, if you do decide to sign up with jamf, I've got a referral link. I'm going to put it in the description down below. I'll probably pin a comment as well. If you do decide to go with jamf, please use that referral link. It's the only form of compensation that I will get for the time that I put into making this video. Anyways, that's all I got for today. Be sure to, like, comment and subscribe. I'll catch you guys in the next one. Appreciate it. Peace.