Mac management - SCCM or ?

[KRIECCO]

Hi,

Don´t know if this is the right forum to use, but I try

MAC computers are comming more and more in our company and instead of going for an JAMF solution that is fully MAC supported, our Microsoft team want mac´s to be managed by SCCM(as according to them this is the one and only tool, as are not fan of adding a third party tool in for management of mac)

But as I can read it is not a full blown supporting thing - correct me if i am wrong

What I request from a mangement solution for Mac

Patch management - control software installed on mac and push out updates of both OS and application
Central management of Filevault (so actually like bitlocker is for windows, where keys are centrally stored in AD)
Control of admin rights on Mac, so User necessarily don´t have full rights

Can anyone confirm if this are possible with a SCCM client for mac ? or any other thoughts from people who maybe have had any experience from going to SCCM etc

[tthurman]

I'd use Jamf Pro...

[Look]

My 2 cents.
It's pretty much a cop out (or an accountant making technical decisions) to pretend Macs are just like Windows and try and manage them with the same tool. We looked at it a year or so ago but given almost nothing internal to macOS is directly compatible with it's equivalent in Windows it's just a compicated mess to do (as if SCCM wasn't already complicated enough all on it's own).
Basically macOS ≠ Windows.

[Josh_Smith]

Check out the following discussion, MS hasn't been adding to the Mac features so it is still relevant. There is a bit you can do with Intune, but very very little. Use Jamf Pro if you can, use the Jamf Pro SCCM plugin so they can make pretty reports in SQL to appease the single pane of glass-ers.
https://www.jamf.com/jamf-nation/discussions/11982/sccm-vs-casper-suite

[mm2270]

You're not going to get your requirements list from SCCM, or from many other tools out there I'm sorry to say, other than Jamf's. Especially patch management, which Jamf is now offering in Jamf Pro v10.x. I'm not sure on FileVault management. It's possible SCCM enables built in encryption on endpoints, similar to how McAfee does it with their MNE (McAfee Native Encryption) which basically just means, "we can't really encrypt the devices, so we're just relying on whatever the OS offers and naming it something fancy-sounding" But Jamf does the same thing, very well I might add, and doesn't pretend they are doing anything special or unique.

As for control over admin rights, it's easy to take admin rights away, assuming you have some facility to do that, like running a script. But the question then becomes, how do you allow your users some level of autonomy, like installing sanctioned software on their own timeline instead of it being pushed to them when it may not be convenient? Jamf's Self Service offers this, as does things like Munki's Managed Software Center (not sure if that's still the name for it). Some other products also offer something along those lines, but usually are pretty weak in comparison. Not sure on SCCM, but I don't think they offer it on Macs, just Windows. OTOH, allowing end users some control of when to install things may not even register as a requirement for you... now. But it may at some point, and you may be disappointed when you realize you can't do this with other products.

All this is to say, you're not in a unique situation. Many IT environments run by Windows admins are loath to bring in something they don't understand or can't have all under one roof, and so they cling to the fallacy of single pane of glass for management. The problem always is that you cede a lot of functionality by going with a jack of all trades, master of none product. These always land into the mediocre realm since no product can possibly do a stellar job at managing all endpoints and OSes. Hence why Jamf specializes in Apple device management and are the leaders in it. If all you needed was basic inventory and some Config Profile deployment to your Macs and nothing else, you could fudge your way through with SCCM or a half dozen other products. OTOH, if you want real comprehensive management, it's not going to get you there.
BTW, have your IT folks looked at Jamf's SCCM connector, that sucks in inventory data from Jamf into SCCM? From the Jamf website:

In addition to comprehensive Mac inventory, Jamf Pro seamlessly pairs with Microsoft System Center Configuration Manager (SCCM) to combine Windows and Mac inventory data into a single pane of glass – allowing you to report on all of your assets from SCCM.

Sometimes all they want is one console to work in for reporting purposes, and that may be enough to help push them toward something better for the Macs.

[csanback]

We use SCCM which I am an Admin in, and I would not want to Admin the Macs in it. Really it would come down to CAN you versus SHOULD you. There would just be a lot of things that would take a lot of time to figure out how to do them. Which would not even be an easy/efficient way to do it. There is less blogs and support on how to use it, because not a lot of people are doing it. Microsoft is slow to update when new OS versions come out. SCCM would not do third party patching, granted it doesn't have that for Windows either. All the short falls in SCCM would then have to be taken care of by using third party software like Parallels Mac Mgmt. Figure in man hours, for troubleshooting, configuring, updating, paying for third party software, the cost of a JAMF sever that does this already seems like a no brainier.

[KRIECCO]

Can see Microsoft more support Parallels for SCCM build in. But as I can see it is the exact same product as Jamf - at least main things
Anyone know this product ?

[mconners]

The other thought I have on this topic @rossoneris is what about VPP and DEP from Apple? What I mean is being able to support natively the future of Apple products. Apple is moving towards VPP, volume purchase program to deploy apps such as Pages, Numbers and so forth. Jamf Pro integrates this magically and it works really well. Also, to take a Mac out of the box and deploy apps, policies and configuration profiles to it, we are starting to see more and more places moving to a DEP, device enrollment program, workflow. This means as new equipment appears in our inventory, we will scope it, name it and provide management.

SCCM and Microsoft I really doubt will EVER do this. I have been a firm believer that best of breed for your devices. If you try and piece meal it together, all players involved will not be happy in the end. I originally was on the team to setup SCCM here when migrated to Win 7 back in the day.

Hopefully this helps a bit. Jamf also has documents to help provide some arguments. The SCCM plugin will provide a nice reporting mechanism, but we don't use it. If we want to manage our Macs, which we do, then we use Jamf Pro. It is the best thing around and we love it.

[SDamianoINWK]

I come from a company that attempted to manage our macs via SCCM using the Configuration Manager plugin from Microsoft, as well as Parallels Mac Management for SCCM. It wasn't until we had no real success with compliance and implementation with these products that we then bought Jamf.

In terms of your specific needs

Patch management - control software installed on mac and push out updates of both OS and application - There is no real way to do this with SCCM's built in tool. - You can do this with Parallels Mac Management, however it requires reliance on SCCM distribution points, and an SCCM heavy workflow which Jamf will make very easy with Composer and Jamf Admin.

Central management of Filevault (so actually like bitlocker is for windows, where keys are centrally stored in AD) - You cannot do this with SCCM's built in tool - You can do this with Parallels Mac Management to varying degrees. When it encrypts the computer and troubleshooting when policies fail or do not work for you is very cumbersome with this tool. It will escrow the key for any computer it encrypts into SCCM, however, you cannot re-escrow keys into PMM or SCCM. You can do this with Jamf.

Control of admin rights on Mac, so User necessarily don´t have full rights - Theres no direct way to do this with SCCM or PMM. If the payload exists for a configuration profile, PMM only supports very outdated payloads and you would have to create your own config file in macOS server. - There are better ways of doing this in Jamf.

If you're going to be the one managing the macs, push for a 2 week evaluation. I was able to do this in my organization, and I was able to accomplish more in our JSS in 2 weeks of our evaluation than our engineering team did with a year of PMM and a year of SCCM.

[KRIECCO]

A bit old post, but just adding a bit.

Managing software form SCCM - saying deploying software packages like chrome, firefox or similar is that working fine ? or does it have limitations ? Patch management from SCCM is as far I can read now an option

We want to install antivirus client through SCCM(just like windows computers), so a system configuration client is needed on the Mac

[easyedc]

IMHO it is a poor experience (both as the admin and trying to actually manage) using SCCM instead of JAMF. My team admins all client management tools (I'm the JAMF guy, I have a windows counterpart). There are too many holes that don't line up with SCCM alone. SCCM is the driver for windows (65,000 workstations) so they tried to force it, but it was painful. JAMF all the way.

I looked at parallels for Mac and it tried to do the same things JAMF does, but at the time, much more complicated.

[Jens_Mansson]

Parallels hold a huge advantage and those who claim that it is complicated is 1st line techs, not engineers in client environment. I have used both and Jamf is not really moving and just holds basic features imo and community may be large but not educated. Parallels has the availability to use a client very much like VMWare where you can run single applications and OS as virtual. Into schools and only Apple environment? Jamf is easy to manage but i think Parallels is going very strong in terms of options for virtual hosted Windows apps.

[Look]

Unless I am missing something I can't see any mention of VPP on the Parallels Mac Management site and I don't think SCCM supports it, so wouldn't this mean purchasing or at least deploying another product on top of SCCM to manage this.
Also I just can't imagine having to go through the SCCM process every time I wanted to package something up... I currently have to support both platforms and JAMF (or any mac based packaging process) is much easier than what SCCM puts you through to package anything!
Likewise macOS configuration profiles through Baseline sounds way more complicated than it needs to be!

[seisin]

Parallels hold a huge advantage and those who claim that it is complicated is 1st line techs, not engineers in client environment. I have used both and Jamf is not really moving and just holds basic features imo and community may be large but not educated. Parallels has the availability to use a client very much like VMWare where you can run single applications and OS as virtual. Into schools and only Apple environment? Jamf is easy to manage but i think Parallels is going very strong in terms of options for virtual hosted Windows apps.

What does the virtualization piece have to do with the management piece? Parallels VM options do look nice but this is primarily about managing devices, either via SCCM (Parallels for Mac Management) or jamf and which works better.

I would very much like to see more information on Parallels as most seems to be outdated and/or very sparse but right now jamf seems overwhelmingly better for the management piece.