Development Environment

[Bob_from_Reno]

Hi Nation, I hope everyone is well today. I am wondering what you guys do with Dev environments? I need to look at a way to control a dev environment, separating daily work like emails and chats against a development environment. I need to introduce the latter in a way that is still controlled but allows the developer to run code and install tools. I was thinking if introducing a Parallels VM with macOS and forcing isolation. Then giving the developer access to tools through Self Service and allow them to make themselves an admin for a limited time, following a helpdesk request. 

I know this will not go down well, but its what is needed. I am wondering what strategies you guys have implemented around this bearing in mind it needs to pass external security audits and certifications.

Thanks

Bob from Reno

[AJPinto]

We are in a similar boat.

MacOS VM's would work. However no MDM platform officially supports macOS VM's. JAMF generally manages macOS VM's well, but again they are not supported. MacOS VM's have limitations like many network security tools don't like them due to NAT/Bridge network routing and you cannot toggle between the two on Apple Silicon. In addition you cannot use many Apple services on MacOS VM's

I am still fleshing out how VM's should work and would work. In the interim I setup an environment of Mac Minis in our datacenter that developers remote on to. Because they are physical Macs they behave just like any other Mac, including all the MDM goodness. Because they are in our datacenter, we can perform all kinds of network isolation on them. Not a cheap solution, but it works. You can also look in to having this kind of function hosted with vendors like Mac Stadium and Amazon.