Jamf Pro vs Jamf Now for Mac - question for admins

[Gozzy]

Hi,
I recently started working for a company that only uses Mac, now coming from Windows world, I was thrown in the Deep end a bit, but I am unable to figure out the following without actually having to sign up for both products.

I was told to enroll all our Macs with JamF, and at the time we settled on Jamf Now as we have less than 25 Macs, and it was suggested like this during sign up with Jamf, however after I open enrolled my Mac I am a bit disappointed that most of the Options especially in "Restrictions" in the Dashboard seems to be aimed towards iPhones/iPads and things of that sort and very little options for Macs.

Can anyone tell me if JamF Pro is better suited for Macs? We need more control on our Macs (Accounts / Security / Granular Restrictions) and currently JamfNow seems very limited as most of the options I would like to use are aimed for mobile devices

Example screenshots (most are for mobile):


AND



Thanks in advance!

 

[SauRoNZA]

As you’ve found Jamf Now is a sort of Lite “off the shelf” version of Jamf and along with that offers very little customisation.

(I think it stems from when they were still focused on schools and just needed some basic stuff in place on end user devices)

It’s meant for small businesses with no IT and to cover only a few bases.

Jamf Pro is the full fat package that gives you everything you could possibly want.

You could do more with custom configuration profiles and use Jamf Now to push them to machines, but it is very manual and can get very messy quickly so I would not recommend.

Better to bite the bullet and switch to Pro now rather than later.

The better you do this at the beginning the easier it is down the line, so plot and plan exactly what you expect it to do and implement it from the start.

What kind of industry? If there are compliance needs then Jamf Pro has also made it very easy now to just tick the boxes and set the rules and monitor them without needing to manually go create configs. Ballache for us having done it manually for so long as we need to reverse them one by one before switching.

Talk to your Jamf Account Manager they should be more than happy to set you up with a Jamf Pro sandbox to play on.

If you are looking for a local distributor/partner drop me a DM and I can put you in touch with someone.

 

[SauRoNZA]

Also I think Now can only do user-based enrolment and doesn’t do DEP if I remember correctly.

Depends how much scaling you expect to happen, but doing zero touch deployments down the line especially for remote people is pure magic.

 

[Gozzy]

Thanks for the reply it is much appreciated, I work for small overseas fintech company, and we need some of the control for compliance reasons, unfortunately all our macs are already in the hands of the staff and they are scattered in different countries, so open enrollment is my only option for now (without wiping) - but future mac devices will be automatic device enrollment upon purchasing which will help a lot, but I inherited it like this lol - I have a plan to do open enrollment on all our macs and once done I am going to create another non admin profile on the users devices, to lock them out of clicking the "un-enroll" button in System Settings, if we need a partner I will DM you

Thanks again!

 

[SauRoNZA]

Thanks for the reply it is much appreciated, I work for small overseas fintech company, and we need some of the control for compliance reasons, unfortunately all our macs are already in the hands of the staff and they are scattered in different countries, so open enrollment is my only option for now (without wiping) - but future mac devices will be automatic device enrollment upon purchasing which will help a lot, but I inherited it like this lol - I have a plan to do open enrollment on all our macs and once done I am going to create another non admin profile on the users devices, to lock them out of clicking the "un-enroll" button in System Settings, if we need a partner I will DM you

Thanks again!

Oh yeah if it's fintech then Jamf Now is never going to cut it and Jamf Pro will make your life SO SO SO much easier with the compliance blueprints they have in place now.

Yeah it can be a bit tricky to do DEP without physical access to getting the user to run commands for you. But you would definitely to enrol manually without a wipe.

We've had the idea of Admin (for us) and Standard accounts for users many a time, but in the end it proved to be more trouble than it was trying to solve.

But you'll be able to lock all of that stuff out anyway with configuration profiles and no need to remove admin rights to do it since the MDM takes over completely. They would be able to run a "sudo jamf removeFramework" with sudo access, but that becomes more of an HR problem and a disciplinary if your policy states you are not to fiddle with it.

 

[Gozzy]

Awesome thanks for the tips and tricks man, I will use my own mac as the guinea pig and once happy I will push it across the business, you have helped me more than JAMF support staff! Appreciated!