Why Jamf?

[michale65]

What is your opinion of Jamf? Do you like it? Do you hate it? What is its biggest weakness? Where does it excel? Who does Apple like most between Intune, Airwatch, and Tanium? How do end users benefit from Jamf over other support options? Pros and Cons. Who is better than Jamf?

Interviewing for a position at my company and I am tasked with presenting Jamf. Specifically, I had the option to pick between W365, Tanium, and Jamf as my presentation.

Any help would be greatly appreciated. I have enjoyed my research into the company so far and hope to get some real-world feedback from those who live it.

Thanks in advance.

[sayr01]

I think it's amazing when things are working.  I can do so much and more. We had this implemented 4 years ago and to be honest I would be lost without it.  We have 400 iMacs and 600 iPads which we manage through JAMF.  I think it plays really well with apple products.  Has answers to all questions if you know where to look.  JAMF with Jamf community is a powerful collaborative tool. 

[AJPinto]

JAMF has its pros and cons. However unlike your other suggestions JAMF is totally dedicated to Apple platforms. The problem you run in to is most of these other MDM's mainly manage Windows or iOS, and macOS is an after thought. JAMF also has by far the best documentation I have seen for macOS management, even kandji's documentation falls behind JAMFs. That and many vendors have deployment documentation specifically for JAMF. Even Microsoft and Tainum publishes documentation for their non-MDM applications with JAMF specific instructions. JAMF also has a pretty good community over here on JAMF nation (note how you came here), even MacAdmins Slack has many JAMF specific sections.

One of the biggest selling points for us with JAMF, is the JAMF binary. It allows JAMF to manage functions of macOS that fall well outside of the MDM frame work. With most other MDM solutions you are stuck managing Macs like glorified iPhones. JAMFs Framework (the binary) brings macOS management much more inline with Windows management in terms of actually telling the OS to do things directly. If it can be done with CLI, JAMFs binary can do it.

Microsoft could make Intune totally kill JAMF, if Microsoft cared. Microsoft as the resources, development teams and funding to do it. They just don't care about macOS. Microsofts support also generally sucks. You open a case, and it takes a week or two to hear back. You set email as your primary contact, and you get some offshore asset calling you at random hours without notification and adding notes to the ticket that you are dodging their calls, be darned what you are doing when they call you out of the blue. Intune has a lot of gaps, like not being able to adjust device check in intervals (7 day only, JAMF can do every 15 minutes), not being able to deploy packages (added dmg app deployment last year) for custom apps on macOS, leaves a lot to be desired with scripting. The list goes on. Why adjusting device check-in intervals matters is reporting. You are told to do a thing, well you dont know if that thing has been done for a week. Intune is also pretty bad at mass actions, you want to force a check in? You need to do it one device at a time. 

VMWare is enthusiastic about Airwatch, but in the demos I had with it they could not convince me to actually test the product. Its reporting and GUI look nice, but its just skin deep. Like with most any other MDM, iOS management is fine but macOS management is only okay at best.

Tanium, I did not realize they had an MDM that supported macOS so there is that. 

[bwoods]

Apple uses JAMF internally...so I believe they prefer Jamf. Love the product, it's just expensive.

[mm2270]

---

@AJPinto wrote:

One of the biggest selling points for us with JAMF, is the JAMF binary. It allows JAMF to manage functions of macOS that fall well outside of the MDM frame work. With most other MDM solutions you are stuck managing Macs like glorified iPhones. JAMFs Framework (the binary) brings macOS management much more inline with Windows management in terms of actually telling the OS to do things directly. If it can be done with CLI, JAMFs binary can do it.

---

This right here is pretty big. Almost all other companies with Mac management got into the game after Apple introduced MDM to the Mac platform, which was previously only available for the iPhone and iPad. Since many other products had already jumped into MDM, they decided to tack on macOS device management to their offering once Apple brought MDM to the Mac.

Jamf on the other hand, started managing Macs using the unix underpinnings back around the time Apple switched to OS X, so loooong before there was even a twinkle of "MDM" in Steve Jobs' eye. This means they have a large advantage over most of these other products. As @AJPinto mentioned, having the "traditional" jamf binary installed on every Mac gives you the ability to do some stuff other products simply can't, at least not without introducing their own local toolset or integrating some other product into their software (See VMware / Munki integration) to do those traditional things.

Plus, with Jamf dedicated to the Apple platform, it means they aren't distracted or have conflicts of interest when it comes to bringing as much as they can to their management set.

That said, like all other products, Jamf Pro is not without its issues. It has bugs like any software, and has some glaring gaps that to any average observer would make 100% sense to include in the product, but for some reason just isn't there. So there's room for improvement. Still, for Mac management, warts and all, I still think it's the best commercial product out there for this. While I could switch to using something else and would survive, I wouldn't really enjoy it.

--------------------------------------------------------------------

Edit: And I just noticed that you posted your question within the Jamf Now section of this site. If talking about Jamf Now, it's very basic compared to the full Jamf Pro. The cost difference between these is significant though. If all you can choose between is Jamf Now and some of the other products, then that makes the choice a little tougher. Your OP only mentions "Jamf" which is the company, not a specific product.

My only take on this would be, if there's any possibility in the future of moving from Jamf Now to Jamf Pro, it might make more sense to start with Now. Keep in mind there is no migration path between these 2 products that I'm aware of. Devices would need to be unenrolled from Jamf Now and enrolled into Jamf Pro for management. But, getting a relationship going with Jamf with Jamf Now if the plan was to try to introduce the full solution later might be worth it.