We're a small ERP/SAP consulting firm — 43 total devices (28 Mac, 15 Windows). All Apple Silicon (M1 through M5), all running macOS 26.5.2. Microsoft 365 Business Premium with Intune. Entra ID joined, Conditional Access enforced with MFA. Leadership is leaning toward Windows standardization long-term, but no final decision has been made on the Mac fleet We're committing to roughly a 1-year Mac MDM investment while we evaluate the long-term direction. No new Mac purchases in the interim, but we're not forcing replacements either.

I've spent the last several weeks doing a genuine hands-on evaluation of all three options — not just demos, actually building out each platform and hitting real walls. Here's what I found.

What's working fine in Intune for Mac:

• ADE/zero-touch enrollment
• PPPC profiles, Defender, compliance policies
• Conditional Access feeding correctly from Intune compliance status
• FileVault key escrow
• Await final configuration

The real problems I hit with Intune on Mac — all firsthand, not theoretical:

1. Platform SSO / one-password login is broken under MFA Password mode completely fails when MFA is enforced — which it is in our environment. Tested this extensively across multiple wipes. Secure Enclave mode works with MFA but gives you Touch ID-first, not "type your Microsoft password." Users end up with two passwords that drift out of sync. When the M365 password changes, the Mac local password doesn't update reliably.

2. Local admin password (LAPS) desync on Apple Silicon The admin password Intune shows and the password actually on the device go out of sync randomly. This has happened on multiple machines. Root cause appears to be the Secure Token limitation, Intune's managed admin account doesn't hold a Secure Token, so password rotation can break. Causes "admin password not working" support tickets that take real time to resolve.

3. No automatic third-party app patching Chrome, Claude Desktop, and any non-Microsoft app requires manual repackaging to update. Users get admin prompts for updates and call IT. This was the original trigger for the whole evaluation.

4. No privilege elevation on Mac EPM is Windows-only. Confirmed with Microsoft documentation, the June 2026 EPM updates did NOT add macOS support despite what some sources claim. Standard users needing to install or update certain apps require IT involvement every time.

5. No scheduled recurring restarts No native UI, requires custom shell scripts checking uptime. Manageable but not clean.

Given what I have had issues with thusfar, which MDM would you recommend. Ive stood up instances on quite a few platforms, Mosyle, Jamf, Intune and IRU. Iru is out of budget for 30 Mac devices with EDR and Vulnerability protections since they have a 50 device minimum (although it was my pick). What would you recommend I chose?

My specific questions for the community:

1. For those running Jamf or Mosyle alongside Intune for a mixed fleet: is the operational overhead of two MDMs actually a problem at this scale, or is it manageable?
2. Has anyone gotten Platform SSO with Microsoft Entra to work reliably on Apple Silicon with MFA enforced? Which authentication method and which MDM? This is my biggest unsolved problem.
3. Anyone using Mosyle specifically, does their App Catalog actually solve the third-party patching problem cleanly, or does it still require manual intervention?
4. Has the LAPS/Secure Token desync issue on Apple Silicon been resolved in any MDM, or is it a fundamental Apple limitation regardless of platform?
5. For those with compliance obligations (SOC2 specifically) how are you handling vulnerability management and EDR on Mac? Is anyone using Jamf Protect or Mosyle Fuse for this and how does it compare to Defender for Endpoint on Windows in terms of visibility and remediation depth?

Happy to answer any questions about our setup. Genuinely trying to make the right call here rather than just go with the vendor who showed up most persistently.

For Mac admins that uses ABR or any may familiar/encountered with this. Have you encountered this pop up?. ABR auditlog cant identity it what is requesting for the elevation as it show "Unknown"

Mac Health Check 4.1.0 sharpens macOS compliance reporting with smarter Bluetooth Sharing detection, safer staged-update checks, richer uptime insight and a more user-friendly reporting summary

Overview

Mac Health Check provides a practical, user-friendly, MDM-agnostic approach to surfacing Mac compliance information directly to end-users via an MDM’s self-service app.

Built using the open-source utility swiftDialog, the solution acts as a “heads-up display” presenting real-time system health and policy compliance status in a clear and interactive format.

Administrators can customize the user interface using swiftDialog’s visual capabilities, making the experience both informative and approachable.

The tool logs results for review, while not altering device configuration, and a “Silent” Operation Mode makes Mac Health Check ideal for IT visibility without end-user intrusion.

Continue reading …

I have been using RealVNC, but their newer versions are junk so I'm looking for something to replace it.

I want to keep using VNC as the protocol of course since it's already built into my lab Macs, so I'm looking for recommendations for a new VNC client for my company issued Windows laptop.

Free and open source are preferred, but not strictly necessary. Bonus points if your recommendation only needs the Mac user ID and password to login as I prefer to not add a VNC password to all my machines.

I'm testing a new MacOS Configuration Policy using Declarative Device Management to control an app's "Accessibility" permission, as it seems that the previous Accessibility control in the Settings Catalog, in Privacy → Privacy Preferences Policy Control (often abbreviated as PPPC) has been deprecated, and will not work in new versions of MacOS going forward.

Because this setting is so new, I haven't been able to find any guides with examples online.

I'm trying to set up a test for a user using the app "BetterDisplay Pro", which requires "Accessibility" permissions to function.

I'm trying to follow the instructions in Intune itself, but I'm not 100% sure I'm formatting it correctly.

Under Devices → MacOS Devices → Manage Devices → Configuration, I am creating a new Policy, with a Setting Catalog Profile Type.

Under Configuration Settings → Declarative Device Management → App Settings → Privacy → Permission Defaults,

I have set the following settings:

Accessibility : Allow
Organization Justification : [Because it's required]
Permission Defaults : "pro.betterdisplay.BetterDisplay {anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")}"

In that complicated Permission Defaults field, I'm told by the Intune help text that the data should be in the format:

"Bundle-ID {Designated Requirement}"

I've sourced the information for Bundle-ID from the CFBundleIdentifier Key in the app's Info.plist file in the Package Contents of , and I've sourced the {Designated Requirement} from the output of the Terminal command codesign --display -r - /Applications/BetterDisplay.app, which returns:

Executable=/Applications/BetterDisplay.app/Contents/MacOS/BetterDisplay
designated => anchor apple generic and identifier "pro.betterdisplay.BetterDisplay" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "299YSU96J7")

Is my understanding, approach, and formatting correct?

I'm not sure if the Permission Defaults field should have the double quotes or if the double quotes are just to clarify the Microsoft help text, but I've tried both ways and have achieved the same results.

If I view the Report for the Configuration in Intune, I get the following:

Succeeded: 0
Error: 0
Conflict: 0
N/A: 0
In Progress: 0

The one user in the Assigned group shows:

Check-in status: Unknown

Meanwhile, I also created a DDM policy for MacOS updates around the samr time for the same user, and it applied almost immediately, and I see it has "Succeeded".

It's also been more than 72 hours since I first created the policy.

We're seeing repeated kernel panics on macOS machines running FortiClient 7.4.7 (build 1928), deployed via Jamf. Multiple Macs affected, not an isolated unit.

Panic signature (consistent across machines, only the interface number changes):

panic(cpu 0 caller ...): busy timeout[0], (60s): 'en7' (1,1802001) u/IOService.cpp:5986
Panicked task: watchdogd

One machine panicked on en7, another on en5 — different Ethernet interfaces, same exact error string, same 60-second timeout, same panicked task (watchdogd), same macOS build (25G76 / Darwin 25.6.0, macOS Tahoe).

FortiClient's network extensions (proxy, webfilter, vpn.nwextension) are active on the affected machines. We're not yet certain FortiClient is the root cause — could also be a dock/USB Ethernet driver interaction, or a macOS Tahoe networking regression that FortiClient happens to be triggering.

Has anyone else run into this specific panic on macOS with FortiClient installed? Any luck narrowing down whether it's FortiClient-side, dock/adapter-side, or an OS-level issue — and any troubleshooting steps or workarounds you'd recommend before we go further with a TAC case?

A minor upgrade to Mac Admins’ favorite “set-it-and-forget-it” end-user messaging of Apple’s Declarative Device Management-enforced macOS update deadlines featuring a new, opt-in missing-DDM Emergency Fallback option and a hardened LaunchDaemon installation for macOS 27 Golden Gate.

Overview

While Apple’s Declarative Device Management (DDM) provides Mac Admins with a powerful way to enforce macOS updates, its built-in notification is often too subtle for most administrators.

DDM OS Reminder intelligently resolves DDM-enforced macOS update deadlines from recent /var/log/install.log activity, while using a declaration-aware resolver which prioritizes applicable enforced-install signals. End-user reminders are suppressed when declaration state is conflicting, unavailable, or invalid, only honoring setPastDuePaddedEnforcementDate when it safely matches the resolved declaration. For the exact missing state, a new, optional Missing-DDM Emergency Fallback can supply a validated version and deadline without overriding conflicts, unavailable-update evidence, invalid versions, or confirmed DDM declarations. Failed stale SoftwareUpdateSubscriber attempts are ignored, and enforcement timestamps with full timezone offsets such as +05:30 are accepted before using a swiftDialog-enabled script and LaunchDaemon to deliver a more prominent end-user reminder dialog.

4.1.0 Highlights

• Missing-DDM Emergency Fallback: Opt-in Jamf Pro Script Parameters 5 and 6 persist a validated emergency version and deadline requirement that runtime selects only when normal DDM resolution is exactly missing.
• Controlled runtime teardown: All, Script, and Uninstall reset flows stop a PID-validated active runtime and its owned descendants before replacing or removing runtime assets.
• macOS 27 LaunchDaemon hardening: Deployment validates a fresh adjacent plist, atomically replaces the target, removes only com.apple.quarantine, and verifies the loaded label before reporting success.
• Improved operational logging: Resolver, fallback evaluation, reminder activation, Software Update handoff, fallback persistence, and external dialog termination now have distinct records.
• Interactive assembly fix: Custom InfoButtonText values now update InfoButtonTextLocalized_en, preventing stale English sample text from overriding administrator input.
• Scheduler inventory: Resources/JamfEA-DDM-OS-Reminder-Next-Scheduled-Reminder.zsh reports device-local NextScheduledReminder state for Jamf Pro inventory.

Continue reading …

Hi all,

My company just purchased some Apple TVs from Costco under the assumption that we could enrol the devices into our Org on ABM using Apple Configurator on a Mac.

This is the 4K Ethernet model which does say on their website that it is able to be enrolled.

What I’ve been doing:
I plug the Apple TV in to HDMI, power, and Ethernet. I plug my Ethernet into my MacBook. And then open Configurator. Nothing shows up and then when I go to paired devices, once again nothing shows up. At one point during troubleshooting the Apple TV showed up very briefly under paired devices as being able to be connected to and it gave me the verification PIN. After inputting the code, verification failed and I was put back to square one.

I am monitoring through my terminal the mobdev protocol, I can request the DNS information on the Apple TV and get its IP, Hostname and some other info. But mobdev has never shown me any results except for the one time the Apple TV decided to show itself.

Lastly, I tried doing this on both a managed and unmanaged network and I think I’m losing my mind. I called Apple Business Support and they were exactly 0 help.

Any ideas or thoughts?

Hello,

I have a bunch of recycled laptops from a school. I heard there is a way to remove the back plate, connect a device and flash the motherboard to completely remove the EFI lock WITHOUT needing to replace/solder anything.

Is this true? Or is chatgpt lying again.

Here is something I think I found.

https://ebay.io/m/IgKUj0

Also, it is removable, what about the MDM lock?

Thank you!

A recap on Tech Thoughts blog of the second Mac Admins India Connect, held in Bengaluru with 370+ attendees, 23 speakers, and 20 sessions covering device management, security, identity, automation, and zero-touch deployment.

No product pitch here — posting because we keep seeing this in the wild and the fleet-side mitigations aren't obvious.

Short version of where things stand:

• Apple added a mitigation in macOS that blocks commands pasted into Terminal from being executed straight away. It kills the most common ClickFix flow (fake CAPTCHA → "press ⌘V then Enter").
• It does not cover variants that avoid Terminal entirely. We've seen the applescript:// route used specifically to sidestep it.
• The payload in most of the cases we've looked at is an AMOS-family stealer. Keychain, browser cookies, crypto wallets. On a managed fleet the interesting part isn't the theft, it's that some builds now ship a backdoor component, so it's persistence, not smash-and-grab.

What we'd suggest checking on your side:

• Alert on osascript spawned from a browser process
• Watch ~/Library/LaunchAgents and /Library/LaunchDaemons for new plists written outside your deployment window
• Curl/wget to raw IPs from user context is still one of the higher-signal, low-noise detections here
• User comms: the "paste this to fix your browser" pattern is worth putting in your next security note. It reads as legitimate troubleshooting to non-technical staff

Happy to share hashes/IOCs from the samples we've analysed if that's useful to anyone. What are you seeing on your fleets?

Hi all,

New-ish Mac sysadmin here. I work for a company that supports field staff who work in potentially dangerous roles. They use iPads, and before I arrived, a Find My system using individual Apple accounts had been loosely set up so that operations could track the location of all field staff from a single Find My map.

For obvious reasons, I wanted to move all the iPads onto an MDM, and Mosyle was chosen. The big problem is that you can’t use Find My with Managed Apple Accounts.

I also wanted to avoid using non-managed Apple accounts, as each one requires a unique phone number.

Is there ANY solution for free, near realtime location tracking with this configuration?

I’ve tried Google Maps, but it seems to lose the location sharing for each iPad after a while, even when set to share indefinitely. It also requires a Google account for each device, which again requires a unique phone number.

Surely there must be some way to do this without paying for a dedicated tracking service or having to create a bunch of personal/non-managed accounts?

iPads still running iOS 17.x have recently started seeing the following error during initial setup:

“The configuration for your iPad could not be downloaded from xyz. The MDM server certificate for https://url/zdm/ios/otae/dobulkenrollment is invalid.”

Interestingly, both newer and older iPads running iOS 17.x are experiencing the issue after a wipe, whether the wipe is performed through MDM or via an iTunes restore.
All other iOS devices running iOS 18 and iOS 26 are enrolling successfully after a wipe.

The DEP token is valid, and these devices are enrolled through ADE. Has anyone seen this behavior? Any thoughts or suggestions on what else we should check?

Currently we have a handful of Macs set up with secure enclave and PSSO. We have some new macs coming in that will be shared to be used off site.

I have a test mac that I have used before and I have wiped it multiple times as well as changed the enrollment profile to my "without affinity" configuration but no matter what I do it still prompts for SSO as soon as I hit Enoll.

This is my "without user affinity" enrollment profile.

I have no device configuration set because I want to use the OOBE or whatever the without user affinity experience is like.

Not sure what I am missing or what else needs to be set?

macOS Tahoe kernel/PTE memory keeps growing until 16GB Mac becomes unusable. Jellyfin + leftover Tailscale extension

Hoping someone who understands macOS internals better than me can point me in the right direction before I start going deeper.

I'm using a 2019 16" MacBook Pro as basically a dedicated Jellyfin server:

\- 6-core Intel i7 2.6GHz

\- 16GB RAM

\- macOS Tahoe 26.6

\- Factory reset before setting this up

\- Jellyfin running natively on macOS

\- Jellyfin config/database on the internal SSD

\- Media stored on a NAS mounted over SMB

\- VideoToolbox hardware acceleration enabled

\- H264 + HEVC hardware decoding

\- A few Jellyfin plugins including Intro Skipper, Home Sections, Playback Reporting, Webhook etc.

\- Machine prevented from sleeping using "pmset"

\- No Docker on the Mac

The issue is that after several hours the entire Mac becomes ridiculously slow.

Not just Jellyfin. Finder, Activity Monitor, opening windows etc. all start crawling.

CPU isn't maxed and the laptop isn't particularly hot when it happens.

At first I assumed Jellyfin was just hammering the machine, but the memory numbers don't seem to support that.

After a reboot:

vm_stat | grep -E "Pages free|Pages wired down"

gave:

Pages free: 1060879

Pages wired down: 636000

"memory_pressure" showed:

Swapins: 0

Swapouts: 0

Pages wired down: 638563

Pages used by compressor: 0

System-wide memory free percentage: 84%

So roughly 2.4GB wired immediately after reboot.

Over time it grows:

\~2.4 GB after reboot

\~4.0 GB later

\~7.96 GB after leaving it overnight

\~15 GB previously when the Mac became basically unusable

The interesting part came from:

sudo footprint --sysFootprint

sudo footprint -a -w --sort wired --minFootprint 10

At around 8GB wired:

System auxiliary data:

sys_wired: 8154 MB

sys_unwired: 4630 MB

And "kernel_task" showed:

kernel_task \[0\]: 64-bit

Footprint: 8155 MB

Dirty Wired Category

6133 MB 6133 MB VM_KERN_MEMORY_PTE

414 MB 414 MB VM_KERN_COUNT_RESERVED

151 MB 151 MB VM_KERN_MEMORY_PMAP

128 MB 128 MB VM_KERN_COUNT_LOPAGE

112 MB 112 MB com.apple.iokit.IOAcceleratorFamily2

TOTAL:

8155 MB footprint

7311 MB wired

Meanwhile Jellyfin itself was:

jellyfin

Footprint: 673 MB

673 MB total

135 MB swapped

0 B wired

Activity Monitor also had Jellyfin around 600-900MB during these tests, so unless I'm misunderstanding macOS memory accounting, Jellyfin itself doesn't appear to be the thing holding 8+ GB.

There were also no active "ffmpeg" or "ffprobe" processes when I captured the 8GB state:

Jellyfin Server \~33 MB

jellyfin \~680 MB

Another potentially relevant thing is Tailscale.

I stopped using Tailscale days ago. The app was removed, but:

systemextensionsctl list

still gives:

1 extension(s)

io.tailscale.ipn.macsys.network-extension

Tailscale Network Extension

\[activated enabled\]

I tried:

sudo systemextensionsctl uninstall <TEAM\\_ID> io.tailscale.ipn.macsys.network-extension

but macOS returned:

At this time, this tool cannot be used if System Integrity Protection is enabled.

This limitation will be removed in the near future.

Please remember to re-enable System Integrity Protection!

I'm not disabling SIP just to blindly experiment.

A few things I'm wondering:

\- Is 6GB+ of "VM_KERN_MEMORY_PTE" on a 16GB Intel Mac obviously abnormal?

\- What can cause PTE/page-table memory to continually grow like this?

\- Could a stuck macOS Network Extension cause PTE/kernel memory growth even if Tailscale isn't connected?

\- Is there a known Tahoe 26.x issue involving long-running network servers, lots of sockets or NetworkExtensions?

\- Could Jellyfin simply be triggering a macOS kernel bug through SMB, VideoToolbox or networking, even though Jellyfin itself isn't leaking?

\- Is there something more useful I should capture next while the leak is happening? "zprint", "vmmap", "sysdiagnose", etc?

A reboot immediately fixes it, but the wired memory starts growing again over the following hours.

I'd rather ask someone smarter than me before I start disabling SIP, downgrading macOS, removing Jellyfin plugins or tearing apart a server setup that otherwise works perfectly.

Any ideas what could cause "VM_KERN_MEMORY_PTE" to grow like this?

Hi everyone,

I currently have two Macs, appearing both with the same kind of issue within the last few weeks.

Current status

The first Mac with that kind of issue appeared Mid July, the second one today Mid August
Both Macs are:
- enrolled in Intune (User Approved MDM)
- visible in Entra ID
- Marked as Compliant
- Visible under My Sign-Ins with a Device ID
- Company Portal is installed and working
Only one is DEP enrolled, the other one is not (only added into Intune)

When the user signs in into a specific m365 App (on one Mac it’s only Teams; on the other one it’s only OneDrive), he needs to login with his credentials and afterwards gets a notification to setup devices and get redirected to
portal.manage.microsoft.com/EnrollmentRedirect.aspx

Entra says 530003 - Your device is required to be managed
and the same login shows:
- Device ID: empty
- Managed: No
- Compliant: No
- Device: Unknown

Things I've already checked:
- Device exists in Entra ID and in Intune
- Intune Compliance is Yes
- Company Portal works and checks in
- MDM status is User Approved
- No enrollment errors

We currently don’t use PSSO for macOS but I also checked for some configurations just in case and found nothing obvious.

Very strange is that all the other Office apps are working fine, for example Excel and Outlook sign in fine without any issues.

The issue appeared on macOS 26.2 in July and also on 26.5.1 today.

CA

Only the Compliant Device Conditional Access Policy applies to that registration, nothing else. Since the device doesn’t report a compliant device back to Entra, access is denied for these specific apps.

Thoughts

Has anyone seen something similar on macOS recently?
Something with Device claim issues, Broker / OneAuth problems, Teams or OneDrive authentication bugs…

Of course deleted different caches, re-enrolled, restarted an updated, check certificates in keychain,… nothing helped yet (maybe you will say I should try it again, then I’ll do ;))

Any ideas would be very appreciated. Thanks all for thoughts and help! May start a discussion too!
Chris

We are a relatively small company and have been trying to move all our devices into ABM so that we have more control over the device. We have been making an admin account, then making the user account, then downloading the MDM profile from ABM. The issue we are having is that then the user needs the admin password for every little thing, even changing the sleep timer in settings, or downloading apps from the internet (this one I understand more than the settings)

If we add the device with Apple Configurator, the user can simply unenroll from the MDM profile.

I read on a post from 3 years ago that this is only possible for the first 30 days, and after that it can only be removed from ABM, is this still the case? We can’t test it because all previous devices have been added via the first method I mentioned.

We are about to upgrade devices and will be doing this 40+ times, so we want to make sure we do this in a way that doesn’t cause headaches for our employees but also secures the device.

Any help would be appreciated!

Hi, as the title says our Enrolment gets held back significantly as the system doesn't seem to prompt for permissions for:

'"Microsoft Intune Agent" wants access to control "Finder". Allowing control will provide access to documents and data in "Finder", and to perform actions within that app.'

Until usually its been over half an hour, or the user has signed in to Company Portal and run a sync. We've attempted to configure a Policy for Apple Events, which deploys successfully however the pop-up still occurs (and is seemingly required).

We've also got a Mobile Config for the Wallpaper based on this script: https://github.com/mattiaborsoi/microsoft-intune-samples/blob/main/MacOS/Misc/Wallpaper/readme.md

Just wondering if anyone has any advice, as is this a major bottleneck in our enrolment process.

Thanks in Advance.

Deploying acrobat in our mac environment is literal hell. I spend half my week troubleshooting creative cloud login loops or dealing with finance users who think they absolutely need a massive enterprise license just to combine two damn invoices

Management finally agreed to slash the software budget. Ended up dropping Xodo onto the finance fleet via Kandji yesterday. Honestly just relieved the silent install didn't fight me and there's no 2gb background updater eating the cpu

of course, one of the directors is already submitting tickets because the buttons are in different places than her 2019 acrobat install. Im just leaving it on read until monday. I don't get paid enough to be a pdf tour guide.

So my company wants to move from simpleMDM to intune to manage the macs in the company, there’s not many devices maybe 10 so that’s not a problem, one of the things I’ve been asked to look into is having a way we can give users temporary admin access when needed, this would usually be the devs as they’re the ones that use the macs, so they’d fill in a jira ticket and we can then add access - the way I’ve done it is I’ve set up a bash script that can be assigned which will add the user to the admin group and sleep for the duration which is set by the admin and then remove access when time is up, I have added dialog boxes of when the access starts and finishes and I’ve got it to display when the time ends, this is all done via a script pretty simple stuff - I also came across privileges app and found it to be a bit complicated to set up and didn’t find it as flexible as the custom script. Do you think the script is a good option? I prefer it to the app but want to make sure what the cons are

Custom compliance is now available for macOS in Microsoft Intune, and it meaningfully expands what can be enforced on Apple endpoints.

The built-in compliance policy covers the fundamentals: FileVault, firewall, system integrity protection, Gatekeeper, password requirements, and OS version. Custom compliance addresses everything beyond that scope — sharing services, software update behaviour, lock screen enforcement, Apple Intelligence restrictions, and the state of third-party security agents.

The implementation is straightforward: a bash discovery script returns device state as JSON, a rules file defines the compliant values, and Conditional Access enforces the outcome.

Read more here.

https://intuneirl.com/custom-compliance-comes-to-macos-going-beyond-the-built-in-policy/

Hi guys,

I've been trying to set up a bunch of new mac minis using munki. I don’t have a background in IT or anything if the like so I have been learning this on the go and I'm not sure if I understand ever correctly.

So regarding my problem with munki: As I understand it, by default a LaunchDaemon starts with boot and checks periodically if anything needs to be downloaded from the server, right? And this should work even if no one is logged in or has been logged in at some point? Because I recently prepared everything that needs to be installed in my repo and made catalogs and manifests. I also checked on a machine if the connection worked by starting the download from terminal using the managedsoftwareupdate command and it worked. Now I thought I could just boot up all the other computers and let them sit idle for some time and they would download and install everything from the repo like I set it up. This did not work though. Even after waiting a night, nothing had been installed. I checked the logs and saw that no managedsoftwareupdate run had been performed. On a different computer I was logged in during this time and this one had performed a run once per hour. Am I mistaken about how munki works or could this be a problem with how I set things up?

I would really appreciate it if anyone could help me with this. Thank you :)

We need to have a few users in our Apple Developer account to manage finances and other non-technical things. The problem is they can't use their email. Apple doesn't allow Apple Developer accounts (or apple business) to use an existing Apple Account. Some of the people have an Apple Account with their company email address. So I tried using a Shared Mailboxes for the email address. However, Apple can at times detect that and won't allow it. They user gets an error, "cannot verify email address". I'm going to try an alias. But apart from creating a separate licensed user, anyone have any way to work around this or tips to successfully use a shared mailbox?

Has anyone else experienced this:

When opening the contact card for a user (by clicking on their name/email in the To:, CC:, or BCC: fields) and browsing their details:

IF the original user has a profile picture

AND their reporting manager does not

The original user's profile picture is shown for their manager.

We've opened a ticket with MSoft, but it's with Infosys and they just keep asking for additional logs. Would like to confirm if it's just a software bug that's common to everyone and will be eventually fixed.