WEBVTT 00:01.650 --> 00:04.440 Right, and this lesson we're going to talk about mobile device management. 00:04.570 --> 00:11.760 This is more or less an introduction and overview of what mobile device management or MDM is for short. 00:12.270 --> 00:15.220 And talk a little bit about what this is. 00:15.240 --> 00:18.240 So this really was introduced originally. 00:18.730 --> 00:26.790 The hence the name Mobile was originally introduced as a concept for iPhones, for iPhone, iOS, iPad. 00:27.630 --> 00:34.500 And it's basically a technology that's used for managing an endpoint device settings, using custom 00:34.500 --> 00:36.970 XML configuration profiles. 00:36.990 --> 00:45.120 And these are basically a file that ends in a config profile when you're talking about the Apple platforms. 00:45.840 --> 00:51.690 And they're basically made up of one or more payloads of what they're called that that specify a device 00:51.690 --> 00:52.080 setting. 00:52.320 --> 01:04.260 So you could have a single mobile config profile that says, you know, here's where the doc is on your 01:04.260 --> 01:04.640 Mac. 01:04.650 --> 01:06.450 This is the size. 01:07.380 --> 01:10.530 This is the, you know, the icons that are included. 01:11.520 --> 01:15.540 And that would be considered the the information about the doc the doc settings would be considered 01:15.540 --> 01:18.400 a payload inside the mobile config profile. 01:18.420 --> 01:21.900 And you can have multiple payloads per mobile config. 01:21.910 --> 01:27.540 You can have that that same doc payload and then a wallpaper payload that is there as well. 01:27.540 --> 01:29.490 And so you could push out that. 01:29.490 --> 01:34.770 And when it's installed, it would set your dock where you want it and change the wallpaper to a standard 01:34.770 --> 01:37.200 profile center wallpaper they would use. 01:37.200 --> 01:38.400 They'd be at your organization. 01:39.150 --> 01:44.550 And so you can you can sort of bunch these together and choose how you want to set them up. 01:44.550 --> 01:51.250 Some administrators prefer to have a single payload per config profile so they can get very granular 01:51.370 --> 01:53.130 and in setting up machines. 01:53.400 --> 01:59.910 Others tend to bundle them together where they may have something that's, you know, all the user interface 01:59.910 --> 02:05.580 type things like the doc in the wallpaper and that kind of thing, all in one profile and then maybe 02:05.580 --> 02:10.020 another profile that has the VPN settings and Wi-Fi settings. 02:10.060 --> 02:11.550 That's their network profile. 02:12.180 --> 02:17.070 You can really decide how you want to do that and structure those accordingly. 02:17.070 --> 02:23.100 But essentially what you're doing when you're building these mobile config profiles is setting up a 02:23.100 --> 02:31.590 set of settings and configuration policies that you want to install on a machine and enforce on a on 02:31.590 --> 02:32.040 a machine. 02:33.500 --> 02:42.140 So one of the things that have really changed in the last 12 to 18 months is how MDM has really gone 02:42.140 --> 02:51.080 from being a nice to have on OS to a requirement on these newer Mac OS 11 and and later versions of 02:51.080 --> 02:52.010 the operating system. 02:52.970 --> 02:58.770 What we were doing before with iOS is now kind of migrated into Mac OS. 02:58.820 --> 03:05.780 So when you're talking about using MDM on iOS, you're really looking at pushing these configuration 03:05.780 --> 03:10.730 profiles out either through Apple Configurator with an attached device or you're pushing them out most 03:10.730 --> 03:19.400 often over the air using an MDM solution like Apple profile manager or one of the various third party 03:19.400 --> 03:28.640 ones like jambe or ADG into Microsoft has one call into and we'll get into those a little bit later 03:28.640 --> 03:29.360 or Morsell. 03:29.960 --> 03:35.660 But essentially, you're making these changes and then you're pushing the changes out to the machines 03:36.380 --> 03:40.100 over the Internet and they're and they're hitting the machines and getting installed. 03:41.300 --> 03:46.610 So as I mentioned, mobile sort of designates the origin of the technology on iOS devices. 03:47.600 --> 03:52.640 And this is really taking off not only in the Apple realm, but it's also taking off from Windows as 03:52.640 --> 03:53.000 well. 03:53.690 --> 04:02.330 Microsoft has a product called Intune that they're using to do more MDM, not only on Android and iOS 04:02.330 --> 04:08.180 devices, but also Mac OS and even Windows PCs, Windows 10 and one to the Web and also provide for 04:08.520 --> 04:12.740 MDMA like management through the Intune product. 04:14.090 --> 04:22.070 And what you can typically do with this on devices that are running Mac OS 10 X, which would be like 04:22.550 --> 04:29.780 Catalino, which is 10 to 15 last Mac OS 10 version and older is you could build your profiles and then 04:29.780 --> 04:36.950 you could use a script using the profiles command to install those without needing an MDM. 04:37.280 --> 04:45.170 But as you move into Mac OS 11, the profiles command has been deprecated and removed from Mac OS, 04:45.170 --> 04:52.280 and it is no longer available for sysadmins to use to install mobile config profiles. 04:52.300 --> 04:54.260 So you have to purchase an MDM solution. 04:54.270 --> 05:01.790 So if you're using Mac OS Big Sur, which is, you know, the minimum requirement on apt selection. 05:02.090 --> 05:06.020 So if you've got Apple, Silicom Macs, are you planning to purchase Apple's little Comox in the near 05:06.020 --> 05:06.500 future? 05:07.310 --> 05:08.300 Please be aware of that. 05:08.480 --> 05:13.580 You will need an MDM if you're choosing to push mobile config profiles to the machines. 05:13.910 --> 05:20.990 So if your workflow today involves using the profiles command or, you know, using mobile config profiles 05:20.990 --> 05:26.940 in some way and you don't have an MDM, you should definitely go shopping for one before you plan your 05:27.440 --> 05:30.170 migration to Mac OS 11 or Apple Silicom. 05:31.910 --> 05:39.830 There's a lot of very good MDMA vendors out there, I had mentioned a few of them had a G kanji Mosul. 05:40.340 --> 05:46.040 Mosul has an education version and a few and Mosul fuse, which is their hire and business package as 05:46.040 --> 05:46.400 well. 05:47.270 --> 05:52.210 A lot of these and that, of course, Champ and JMW Jam now has been around for a very long time. 05:52.220 --> 05:57.470 They started many years ago with the the Apple immagine solution, Casper. 05:57.650 --> 06:03.140 And they've always been on the forefront of Mac OS Systems Administration. 06:03.140 --> 06:06.380 So there's there's a number of really good ones out there. 06:06.380 --> 06:07.910 They all have different cost structures. 06:07.910 --> 06:08.930 They all have different features. 06:09.200 --> 06:18.650 A lot of them are starting to bundle their bundle of other products in with their MDM. 06:18.650 --> 06:27.380 So, for example, Morsell Fuze includes the ability to push certain applications out that are not in 06:27.380 --> 06:28.010 the app store. 06:28.040 --> 06:34.430 They kind of maintain a list of of packages that they maintain themselves that are sort of pushed out, 06:34.430 --> 06:38.990 as well as authentication against, say, Microsoft Azure. 06:39.800 --> 06:45.950 You know, if you want to do have an authentication product that goes along with your MDM, as well 06:45.950 --> 06:51.170 as all the mobile configuration profile settings and payloads that would be in your traditional MDM 06:51.170 --> 06:54.710 solution, JMW does much the same thing. 06:56.180 --> 07:01.910 And when you look at something like Fleet Smith, that's one that Apple's actually purchased. 07:02.600 --> 07:08.600 It's still operating under the Fleet Smith name, but it's actually owned by Apple as sort of like their 07:08.600 --> 07:11.900 first a first party MDMA solution. 07:12.470 --> 07:14.570 There's just many, many of these out there. 07:15.110 --> 07:16.370 Too many to list here. 07:16.620 --> 07:24.320 I had also mentioned that if you are using Office 365, Microsoft also has a tier of that product that 07:24.320 --> 07:29.030 includes Intune, which also works for a mobile device management. 07:29.660 --> 07:31.010 Some of these are better than others. 07:31.430 --> 07:34.910 And depending on your needs, you're going to have to kind of evaluate what works best. 07:34.910 --> 07:40.100 If you're already a Microsoft shop and you're already managing Windows machines with Intune. 07:40.370 --> 07:47.600 Take a look at Intune for iOS and Mac OS, and maybe that will, you know, satisfy the need without 07:47.600 --> 07:51.080 having to purchase additional services just for the Mac. 07:52.220 --> 07:58.550 And, you know, a lot of them all have sort of a free trial. 07:59.720 --> 08:06.170 You know, I think you can get 10 seats a fleet smith to use as long as you want to learn how to use 08:06.170 --> 08:06.810 the system. 08:07.340 --> 08:10.630 Mozilla has a similar thing, I think JMW now as of as well. 08:10.640 --> 08:15.710 So take a look and see, you know, depending on what your needs are, what is out there that can meet 08:15.710 --> 08:16.130 them. 08:16.730 --> 08:21.710 They all are relatively easy to use, but there are some that require more scripting than others. 08:21.710 --> 08:27.350 So depending on what you want to do and what your you know, your level of competencies with some of 08:27.500 --> 08:32.870 the scripting and things like that versus the graphical user interface setup, take a look at what's 08:32.870 --> 08:35.420 out there and see what will work best for you. 08:36.740 --> 08:41.810 I would say at least as far as getting started in MDM, if you haven't done anything with mobile device 08:41.810 --> 08:47.000 management before, I would you know, what we're going to do in this course is we're going to cover 08:47.780 --> 08:50.420 Apple Configurator and Apple profile manager. 08:50.540 --> 08:56.090 And so Apple Configurator is a great way to just kind of learn what payloads do to your machines. 08:56.420 --> 09:03.440 So, you know, I would recommend taking a test iOS device and just hooking up to configurator and, 09:03.440 --> 09:09.650 you know, push the push the buttons, make some changes to the settings and push those out to the devices 09:09.650 --> 09:11.090 and see how they change the device. 09:11.990 --> 09:15.890 You know, I could sit here and demonstrate every single one of the payloads to you, although I think 09:15.890 --> 09:17.120 you'd probably be bored sleep. 09:17.840 --> 09:22.190 There's really no better way to get into this stuff than just rolling up your sleeves and getting your 09:22.190 --> 09:27.740 hands dirty and having a test device that you can push configurations to and and see how it reacts is 09:27.740 --> 09:32.750 really a great way of kind of understanding what the payloads do and then how you may want to arrange 09:32.750 --> 09:38.450 those into specific configuration profiles and how those get built into your users and your groups. 09:38.450 --> 09:45.680 And that's what we get into as we roll into Apple profile manager a little bit later in the course. 09:46.070 --> 09:49.100 One of the things with profile manager is it's a reference spec. 09:49.100 --> 09:55.210 It's basically, you know, not really intended unless you have a very, very small group of machines, 09:55.220 --> 10:00.470 really not intended as a production environment for for MDM. 10:00.890 --> 10:07.210 You could get away with it for like you say, you know, a small organization, but with you know, 10:07.220 --> 10:11.960 with the way that it's set up and what we're going to do in this course, it's perfect for just kicking 10:11.960 --> 10:15.230 the tires on an MDM solution and seeing what the possibilities are. 10:15.560 --> 10:22.970 And you can, you know, look at all the different available available payloads on a per operating system 10:22.970 --> 10:23.360 basis. 10:23.370 --> 10:27.080 So it's separated into iOS, macOS and those that that will do both. 10:28.190 --> 10:30.550 And so it's a really good tool to kind of, you know, try. 10:30.660 --> 10:35.310 You over the air thing, especially if you've got, you know, some facts that you want to try. 10:35.400 --> 10:40.410 Just an out of box experience and take them through the whole process of enrolling them into an over 10:40.410 --> 10:42.960 the air MDM and then pushing configurations to them. 10:43.920 --> 10:46.570 You know, Apple profile manager is pretty cheap. 10:46.680 --> 10:48.480 It comes with MapQuest server. 10:49.140 --> 10:56.340 All you need is a Mac that you can run it on and another Mac that you can, you know, try to manage. 10:56.370 --> 11:02.230 So definitely worth messing around with if you're interested in just kind of kicking the tires on MDM, 11:02.230 --> 11:07.290 but not sure, you know, how it fits with your overall desktop strategy. 11:07.500 --> 11:12.210 And then if you really, you know, know that you need an MDM, you've read about it, you've seen what's 11:12.210 --> 11:15.540 out there, and you want to just dive into the deep end. 11:15.750 --> 11:22.500 By all means, pick up a free trial of one of the various commercial MDM solutions and give them a test 11:22.500 --> 11:22.850 run. 11:22.860 --> 11:25.430 And, you know, you'll find some that you'll like. 11:25.440 --> 11:31.050 And, you know, depending on the price performance feature set, you kind of filter down to what you 11:31.050 --> 11:34.530 think will work for you, get your test instance up. 11:35.370 --> 11:39.470 I've had, you know, very good support from Mosul. 11:39.480 --> 11:43.380 I've had very good support from into from Microsoft on Intune. 11:43.560 --> 11:49.440 And, you know, there's the vendor will help you along the way, make sure that you get your system 11:49.450 --> 11:49.830 operating. 11:50.310 --> 11:55.930 The great thing about a lot of these third party MDM is that they are all cloud hosted. 11:55.950 --> 12:01.050 So you don't have to really have, you know, anything sitting on your network. 12:01.350 --> 12:05.850 That's one of the major downsides, I would say, with profile manager is that it still needs a Mac 12:06.120 --> 12:11.940 running Mac OS 10 servers sitting on your network somewhere, you know, in a DMZ pointed out to the 12:11.940 --> 12:16.890 Internet so that it can push these configuration profiles out. 12:17.400 --> 12:23.670 So, you know, using one of the MDM third party vendors to to get kind of a test instance up is great 12:23.670 --> 12:25.740 because it's already in the cloud. 12:25.740 --> 12:27.390 There's no infrastructure for you to set up. 12:27.960 --> 12:34.360 You just have to request it through the the vendors website and start setting it up with your environment. 12:34.380 --> 12:41.790 So I will say a lot of these all kind of, you know, work the same way because they are based on the 12:41.910 --> 12:46.620 the the data and the configuration in the API that Apple provides. 12:47.010 --> 12:54.110 So, you know, a lot of the same things that will go into setting up, say, an Apple profile manager 12:54.120 --> 13:02.790 instance, like, you know, installing your your tokens for dapper VPE, configuring different server 13:02.790 --> 13:06.470 addresses, configuring users groups, a lot of those kinds of things. 13:06.480 --> 13:12.840 And obviously the payloads themselves are all going to be very similar from solution to solution. 13:12.850 --> 13:20.550 So you should be able to really grasp the concept of using MDM with almost any of these systems. 13:20.550 --> 13:23.150 And a lot of that is transferable knowledge. 13:23.160 --> 13:27.720 So, you know, whichever one you are starting to play with doesn't mean you have to stick with that 13:27.720 --> 13:27.990 one. 13:28.200 --> 13:34.680 And it's not a waste of time to to learn how Apple profile manager works as well, because once you 13:34.680 --> 13:40.230 kind of, you know, learn the basic concepts of the stuff and the setup of it, you really would apply 13:40.230 --> 13:43.890 those same concepts and set up to any of these MDM vendors. 13:44.970 --> 13:48.690 So like I say, the best thing to do at this point is just roll up your sleeves and dive in. 13:49.200 --> 13:55.320 We'll go through a lot of the different, you know, configuration options with Apple profile manager 13:55.320 --> 14:02.040 and, you know, setting up PvP tokens and setting up all of the other different connections back to 14:02.040 --> 14:04.470 Apple school manager or Apple business manager. 14:05.160 --> 14:10.440 And then, you know, you can take that information and apply it to your own organization and your own 14:10.440 --> 14:17.220 MDM vendor and start playing around with what is available to you and how you want to basically build 14:17.220 --> 14:18.900 your management strategy around that.