The march of Macs into the enterprise: Demand is on the increase No, it isn't an April Fool's joke we forgot to publish. The Register* actually made it to a recent in-person Apple event: the 2022 Mac Administrator and Developer conference, MacAD. Apple, it seems, may be getting ever more serious about the enterprise. The theme of the event - with actual humans in the Brighton seafront venue …
I can see the appeal. Walled garden, relatively strong design, lower support costs (except for parts), at expense of greater hardware cost. Some difficulties will arise with AD interfacing, package management/deployment, permissions control & browser compatibility. AD in particular is a showstopper for any other platform to make inroads if we are honest.
But I imagine the main driver is because marketing-motivated people want "shiny". Nothing to do with the computing capability that sits in the box.
Having developed on Mac maybe 20 years ago, it was a much nicer experience at the time than Windows equivalents. Today, the platform is a bit of a pain because of the walled garden; and other development environments have "somewhat" caught up. The power is there under the hood of course; just locked down un-necessarily.
For me, the abstraction of everything behind layers upon layers of API's is such that "knowing" the API is way more important than knowing the language to get stuff done, or what platform you do it on. It wasn't long ago you could download DEV C++ and an SDL library and do fun stuff very easily. Today, just configuring a dev environment and API is an absolute pig; knowing what you need to do anything remotely useful is often half the battle. Co-incidentally, this is also why I have became such a fan of Python. Very easy to find libraries that do what you want for most subjects.
No current platform is any better or worse in regard this particular problem.
Nothing to do with the computing capability that sits in the box. ...... Binraider
It is just that sort possible misinformation which has Apple Silicon competitors playing second fiddle to new leading algorithms and walled garden applications/private and pirate operations, Binraider, for surely it is exceptional processing ability and utility which makes all the difference in the world to deliver worlds leading facilities ..... more exclusively virtually rendered presentations ‽
Does "Enterprise" mean a computer running Adobe software?
Does enterprise mean a bank computer NOT running Adobe software?
Does enterprise mean medical devices?
If those and more are all enterprise, then Apple needs to pick a target and stop with the ambiguous shareholder speak.
Having developed on Mac maybe 20 years ago, it was a much nicer experience at the time than Windows equivalents. Today, the platform is a bit of a pain because of the walled garden;
Macs aren't "walled gardens", never have been and still aren't today. Yes, macOS does have an app store (as does Windows), but there are no restrictions as to where software needs to come from (a lot of Mac software isn't even on the macOS app store). There's also a ton of 3rd party hardware for Macs.
If anything, Macs are even less of a walled garden than they once used to be when Macs still had some proprietary stuff like expansion slots (NuBus), network protocols (AppleTalk) and certain interfaces (ADB), but this has been history for almost a quarter of a century now.
So I'm not sure where you get the walled garden from as this has never been true.
macOS absolutely is a walled garden.
In order to ship any macOS software whatsoever, I have to register with Apple, and send them a copy of every single application I want to ship for them to inspect.
If they arbitrarily decide they don't want me to publish a given build, they won't notarize it and then my customers cannot install it.
While it is still possible for a user to disable the notarization checks, temporarily, and with some difficulty, customers will not do so.
Ergo:
Apple have total control over what products we are able to sell.
They also know exactly what we're developing, even when it is in an alpha stage. If they felt like competing, they can squash us like a bug.
You can be completely accurate but still very misleading.
You act as if registering with Apple is a bad thing. You don't need to sell your application through the app store, but if you think it is unreasonable to require developers to code sign their software, you're one of the reasons why security has gone to hell in the past couple decades.
The computer industry has turned into a wild west that the average computer user has zero hope of surviving.
If you want to install/run an app that hasn't been certified, you can do so easily by doing right-click->open. It's beyond trivial. If something like that is too advanced for a user to perform, then by definition that user does not have the skills required to vet whether a piece of software is safe to use.
I agree that it's annoying how Apple has locked down the hardware, but I've reach the point in my life where I just don't give a shit. My sanity is a precious commodity, and I'm just not willing to spend the spoons necessary to babysit my computer that can go belly up by just looking at it wrong. So, Apple it is. Hardware lock-in aside, Apple's platform is the best compromise I am aware of between flexibility, security, and ease of use.
"What, precisely do you think is inaccurate and why?"
They just don't understand. One of Apples best skills is hiding this kind of developer DRM so that their fans just don't know its there until it smacks them in the face and they have to... err buy a new shiny mac?
Compared to Microsoft's attempt at developer licenses with the Windows RT Surface (single handedly putting the ARM ecosystem back by 5 years) and Windows 8.
In order to ship any macOS software whatsoever, I have to register with Apple, and send them a copy of every single application I want to ship for them to inspect.
Nonsense. First of all, you only need to send them a copy of your application if you want to sell through the Apple app store for macOS. You don't have to do that to sell or offer your app through anywhere else.
In addition, you only have to register with Apple if you want to use Apple's development toolset (XCode), but there are other compilers and IDEs (like VSCodium) which you can use if you're inclined to do.
Lastly, if your software isn't notarized then the user gets a warning but he can still decide to run your application. Yes, it got more complicated on Apple Silicon (command line) but still it's easily possible to run non-notarized apps on macOS.
macOS absolutely is a walled garden.
No, it's not, and the term doesn't mean what you think it does.
On ARM, macOS is absolutely a walled garden, it will only run notorised apps with an Apple signature unless it's an Intel app being emulated on Rosetta.
There are workarounds, some easier than others, but they're all aimed at raising the bar just high enough so users are herded to Apple's App store, making developers pay for a Developer ID and the 30% tithe to the church of Apple.
In my company it wasn't marketing-motivated that wanted "shiny," it was all the engineers that worked on linux-based products that found OS-X's BSD core a much more suitable work environment than windows.
Lots of non-engineers preferred the greater usability and stability. We quickly reached about 50% conversion before some organizational changes forced removal of Macs as an option. (Internal forums were full of discussion, where people argued based on the benefits they saw.)
I've observed the use of Macs in enterprise settings. For those users who know computers well, devs primarily, they're not too bad.
For those who don't, it's a total disaster eventually. The lack of centralised control means that there's too much left to the end user. I've seen fleets of Macs being dumped for Windows laptops and AD, with a sigh of relief all round.
How the hell do you even image a Mac these days?
"The lack of centralised control means that there's too much left to the end user"
As someone who's spent 30+ years with hybrid Mac+Windows networks, this made me properly LOL.
Windows PCs don't have 'centralised control' either, not out-of-the-box. You have to add *infrastructure* to do it: Windows Servers, Active Directory, System Center, WSUS, Intune, and/or a metric f*cktonne of third-party otherstuffs... and on top of that you then need the skills to use it (or get someone to do it for you).
Guess what? Exactly same applies to Macs. Light bulb moment.
Yes, the choices maybe smaller (albeit increasing) and also tilted more towards third-parties (at least historically), but they're there. Yes, the customisation may be more limited, or even better than, Windows PCs. Tools exist that cover Mac deployment, apps, updating and remote support and so forth. You just have to add the right tools and skills to the mix and your Macs will be under your thumb in a heartbeat just like your PCs. Some of those tools even do both platforms to lesser or greater degrees of capability and effort.
Which is better, which is worse? Neither, they're basically just different, that's all. Vive la difference. YMMV etc.
As for imaging: does anyone still 'image' Windows PCs these days? Hasn't that gone the way of the dodo? Isn't 'Modern Deployment' all the rage? https://docs.microsoft.com/en-us/windows/deployment/windows-10-deployment-scenarios
A/C
Except, according to this article, it isn't quite the case that there is a net equivalency in how Mac and Windows can be administered. This article says that:
"The upshot is that on a JumpCloud-managed system, the user will be gently nudged (with a soon to be configurable message) that, maybe it's time to get those updates done?"
I don't know whether that limitation of JumpCloud is universal across all third party Mac enterprise admin tools, but I see no reason to suppose that any other third party product isn't similarly limited (all corrections welcome!).
I think that that specific aspect matters a lot, especially if you're following any kind of zero-trust security principles. Taking that philosphy to the limit, you'd not be letting a badly out of date un-unpatched machine on to the company network or services. It's the user's fault for not updating as and when prompted, but when it's finally considered too toxic to handle it become the admin's job to sort it out.
I absolutely agree that one's mileage will vary. There are of course some users that can be trusted with keeping things as they properly should be. Then again, there's an awful lot more who'd rather not have that burden added to their lives, and a few who absolutely should not be given any say over corporate IT admin whatsoever. If Apple really are saying that the user has to be in charge, that just doesn't suit a large number of people.
Yes, imaging is still a thing. There's not a lot that Windows won't deal with if it finds drivers missing. That means you're not having to maintain the stock company image quite so much to account for the myriad hardware, so it can be nothing more than a quick way of dropping in a guaranteed dross-free Windows install.
I wouldn't be surprised if Apple do take a dive into Enterprise management, but I'd bet that they'd do it as "Apple administer this machine as a service for your company", instead of giving companies the freedom to admin as they see fit. From Apple's point of view this would be fantastic - they'd displace all the third party products that are currently in-use, they get a revenue stream, and they can extend their walled garden even further. It might even suit companies, who can then dispense with their admin staff. And if problems arise, well that's unlikely to annoy enthusiastic embracers of Apple's shiny offerings.
Apple actually bought an MDM company, Fleetsmith, but good gravy is it crap. (At least, at the time I was evaluating it). There are numerous third party solutions that are infinitely better including Jumpcloud, jamf, Addigy, etc, depending on what your needs are.
There are definitely some hooks missing in MacOS that one would expect, especially if you're used to Windows MDM, but IMO it's definitely good enough for enterprise use.
How the hell do you even image a Mac these days?
(I've only seen the user end, don't have details on the management side)
Where I work, you boot the Mac into recovery mode and reinstall, which registers and notes that the serial number matches a managed device. The management tool then applies all the policies and configures your user account and 2FA. AD integration seems adequate, since you can just kinit a Kerberos ticket and all the SSO stuff works fine too.
I work on an engineering team doing development and infra work, and it's really nice to have similar tools as all our Linux stuff locally. I want to say I'd rather have a Linux desktop (and have run on for many years until recently) but Mac is "good enough" at being Linux-ish and integrates with the larger AD environment easier. I run Linux at home other than a Windows laptop for the family.
You don't, because you're not supposed to.
The single biggest annoyance was wiping a machine when giving it to a new user, which Apple finally solved with Monterey.
But everything else should be handled via MDM. This is also how Windows machines should be managed, BTW. Centralized management of Apple hardware still isn't at the level you can get with MS, but it's catching up.
Everything should be MDM now. If you're still imaging machines manually, you're doing it wrong.
Any Linux distribution is much better suited to engineering work than any Apple crapware, where you don't even fully control your computer if you have admin rights.
I do see programming hipsters prefer Mac in general, because they can now show off that they're part of the elite clique of Apple worshippers when they're coding in the trendy coffee shop down the road.
Apple just don't care about the enterprise. They sell consumer kit that has to be integrated into an IT department the same way as a square peg is in a round hole (even if many of their products don't exactly carry consumer level price tags). Apple have had dabbles with the enterprise in the past, but seem to find it all a bit too much like hard work for the reward, and they then completely remove entire product lines a year or two later. There are many management solutions for those of us who have large Mac estates, but it is never easy, and Apple don't care when a patch then makes it even more work. It's just something you end up living with.
My last IOS upgrade broke IMAP functionality for me on the apple email client. The solution was to download another email client, but only after approximately 8 weeks when apple care support came back to me and told me that IMAP was business only functionality, and apple do not provide business support. Their products are consumer only.
Straight from the horses mouth.
AC, as while I'm gone from the company a good long while, the... manner... shall we say... of how I present the info would tie me to things...
So yeah: That answer is total, complete and utter BS.
They have a Business Support team - it used to be called AppleCare Enterprise Support. Now Business Support.
iOS supports IMAP - has done since iOS 2 or 3 (memory fails me on that particular point, right now.)
What iOS struggles with, mail wise, is strong authentication or MFA. (Obviously, iCloud being the exception as it's what they want the consumer to use).
Even now, a few jobs on from my time in company I tell people to use Outlook or other mail clients if they have an exchange server or an IMAP server with strong authentication.
What you in particular need to do, is call back AppleCare, with your case ID (you did get one, it's probably with the survey (which you should fill out negatively, their workers live and die by those and in this case a bad one is deserved)) and calmly and politely request to speak to their second level support about the case.
If they refuse, thank them, end the call and call back in ten minutes - should give whoever is on the case end enough time to fill in notes.
Then, when you call back, ask again to speak to a senior advisor - at that stage unless they've changed their procedures, you should get put through to one (wait times differ, obv...).
Then explain the issue and especially explain the information you've given here.
I'll be honest here: If I was ever caught giving this blatently incorrect info in my time with them, I would have (rightly) been hauled over the coals by team leads, their bosses, etc...
If you get nowhere, kick up a fuss and ask for Customer Relations...
Annoyed Ex-AC AC!
Simple question then, have they resolved the issue regarding strong authentication and IMAP? If not then no amount of calling BS is going to change the fact that the update broke what was working previously.
The solution was to install Outlook or the Gmail client. Both continued to work after the upgrade and still do.
So you pay twice for a piece of kit that you would pay if you'd buy any other equivalent performing kit.
Updates acrively break functionality (I can confirm the IMAP debacle) and to get even to speak to someone (let alone fix it) you have to jump through hoops to maybe get the vendor to do what they're supposed to be doing...
Not ff-ing break existing functionality.
That's exactly what happened with us. Devices that had not had the latest update installed continued to work, updated devices didn't. It took 8 weeks for apple support to confirm this was a post-update problem (which involved lots of screenshots, videos and logs being sent back and forth), and say they were not supporting it. I held off for another 8 weeks, then I decided to bite the bullet and switch to Outlook or the Gmail client depending on the users requirements. We then finished off updating everyone's devices, which broke each one in turn with the Apple client.
As the former Apple employee stated above, this was caused by strong authentication, or the lack of. Apple dropped strong authentication between IOS releases, for reasons only known to Apple but probably in an attempt to push people to their Apple services. If your IMAPs continue to function, great, but they just are not using strong authentication.
I got a feeling that enterprise specific stuff in the OS is about to become a thing of the past anyway. If you're safe in the internet on your consumer Mac, why bother applying any enterprise policies? Your companies intranet will get broken into anyways (says Microsoft) so you should always work like your computer will get broken into, in a way. Better to think like that! I'm sure there is still use for software policies but truth is Macs don't have the thick crust of bloatware that WinBoxes have in a big company and so, they are definitely less annoying using.
I'm surely wrong on many counts here, but there is a grain of reason in my gut feeling, isn't there?
If the assumption is that everything is broken, can I get a refund, please.
Finding software that doesn't require internet access to activate or open is, increasingly a losing battle; besides open source of course.
The bloat line is true. Running Windows even vanilla install natively on intel mac vs OSX there is a more than synthetic benchmark performance difference. But do corp-mandated bloatwares work on Mac, and if not, do you allow macs on your estate? (E.g. monstrosities like FireEye or Tanium).
There's a reason in many businesses, that the exec get their own network, domain, and independent services, rather than the monstrosity foisted upon everyone else.
The particular issues I've had (with our fleet of now about 60 iPads) are that there seem to be differences with what management features are available between enrolled (bought through an Apple dealer) devices and random ones you had to buy retail quickly because Apple's lead time was measured in months.
Also, there is/was no way to push files to a device/app remotely. It may be that some tools do better than others but last time I looked, the restrictions where down to Apple and whilst perfectly sensible in many ways, did not a properly remote-manageable platform make.
The big problem we found was more about profile based management without being forced to use an MDM. We cannot use JamF as it's a US company (our privacy risk managers nixed that), and Snow Software needs a Microsoft server to work, which is something our security team immediately vetoed (like most sane organisations we would never condone exposing a Windows server to the Net).
Basically, it appears we'll probably end up writing our own..
> We cannot use JamF as it's a US company
I'd never even heard of JamF, not being an Apple user, until a few months ago when, apropos of nothing, they started spamming my corporate email address.
To my surprise, research indicated that it is a bona fide company. So I wrote back asking where they had obtained my contact details. Precisely no response, but the spam abruptly stopped.
I wouldn't touch them even if I were running an Apple shop.
-A.
JAMF is legit so stop talking rubbish.
Their MDM control is about the same as any other MDM like Intune and MobileIron and Airwatch. However because they built their product up from the beginning managing MacOS they are one of the best at MacOS computer.
Just jump onto their support forum and you're see how big and widely used they are.
I never disputed they're the best at managing Apple devices (because they are IMHO). They're simply a US company and thus subject to the sort of US laws that caused Safe Harbor and then Privacy Shield to fail which, I must add, didn't actually address the legal issues, they were merely procedural sticking plasters which is why the aforementioned failures did not exactly come as a surprise to our lawyers.
We don't particularly want to get into software development, but it appears we may have to, at least for internal use.
Not true:
https://www.apple.com/uk/support/professional/enterprise/
What Apple hasn't had for a long time was onsite service, and guaranteed reaction times (e.g. 4hrs) are still to come (not sure that is necessary for non-server stuff that Apple sells, though), but Apple most definitely does care for the enterprise market.
But they certainly don't go out of their way to make their products easy to use in an enterprise environment, but that's because enterprise environments are Windows focused. Apple would have to meet a moving target, with their major competitor in the PC space in charge of when and how much that target moves.
Kind of hard to make a commitment for support when a Patch Tuesday that alters AD behavior can set them scrambling with no notice. So maybe it is better in a way to have Apple's half hearted support, because it doesn't raise your expectations too high.
An all Apple corporate environment would be pretty simple to manage, it is the second class status with Windows that makes things difficult. You'd just have to learn a different set of tools but that would be true if you were migrating from Mac to Windows, or Windows to Linux or back in the day Mainframe to Windows.
Kind of hard to make a commitment for support when a Patch Tuesday that alters AD behavior can set them scrambling with no notice. So maybe it is better in a way to have Apple's half hearted support, because it doesn't raise your expectations too high.
Or maybe it's simply time as a business to re-consider the complete reliance on Microsoft centric stuff like AD, because even in a Windows only environment it can (and often does) cause great pain (like the mess Microsoft made out of printing, repeatedly).
Apple would have to meet a moving target
Yup - the traditional Microsoft game which they haven't really changed in the lifetime of the company.
This is why we moved to true Open Standards (the stuff Microsoft absolutely abhors) - Apple products happily support it out of the box (although their webdav sucked - we'll have to check if they fixed that) so the combination of Apple gear and Linux back end works really well for us.
Given the very low patch management overhead it also results in a much better TCO - the "expensive" hardware becomes dirt cheap when you start adding in the staff time now not wasted on managing and waiting for yet another patch or update.
That said, I realise we've been lucky to have management who actually have a clue. It's rare.
Every macOS update is multiple GB, I lose the whole morning every time as it takes forever.
Worse, every update takes down the entire office, as every Mac hits Apple - it doesn't seem to be possible to cache it locally, unlike WSUS/apt etc.
Windows updates are far smaller, Linux ones are almost always miniscule, both are easy to cache locally so the office pipe has to download them once, then everyone gets it over the gigabit link.
Every macOS update is multiple GB, I lose the whole morning every time as it takes forever.
Weird? I have several machines on the beta channel (read: much larger downloads due to diagnostics code) and I have as yet to spend more than 30 minutes updating a machine. Ever. Since roughly MacOS 10.3 or so.
Worse, every update takes down the entire office, as every Mac hits Apple - it doesn't seem to be possible to cache it locally, unlike WSUS/apt etc.
RTFM. System preferences - sharing - content caching. It's even built in - no need to find and configure extra software, and the other devices on the network will automatically find it and use it. Note of warning: it is one of the few options that does prompt a full reboot, though.
Windows updates are far smaller,
LOL, that's not what our network monitoring software said before we terminated our use of Windows - the only thing smaller is the data flow outbound to Microsoft. Also, YOU choose when to update. No mid-day interruptions, no "please wait with the shutdown because I don't care you have to go somewhere but I have more sh*it to install".
If you lose a whole morning, maybe you should invest in reading up on what you use.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
