Managing devices across different countries

[misdaiwast]

Hello everyone. I am personally still quite new to Jamf, and IT administration in general, so I have a question that in my understanding falls under the "best practices" category.

The company I work for has started using MacBooks and managing them with Jamf a few years ago (before I joined), and we have recently finished handing out MacBooks to all our employees who still hadn't switched over. So far, so good.

Now, we also have subsidiaries, one of them being in the USA (we're based in Japan), and our CEO is entertaining the thought of handing out MacBooks to the workforce of our US subsidiary and managing those as well. Why exactly he wants them to use MacBooks I'm not sure, and whether or not that is actually of value to their day to day work or ours is an entirely different topic.

What would you think of remotely managing a couple of MacBooks on the other side of the planet? Is that advisable? Is there anything commonly done that makes this easier?

[isaacnelson]

We manage computers in several different countries and it's always worked just fine. The one thing that can be difficult is Automated Device Enrollment support, but since that's available in both Japan and the USA that shouldn't be a problem for you guys.

One thing that can be really useful is to set up network segments (IP ranges) in Jamf so you can easily tell which computers are in which country and scope different policies or configuration profiles to each if need be.

[DBrowning]

I'll echo what @isaacnelson said. I'm managing devices on 6 of the 7 continents all from a single Jamf instance. We have no issues.

[misdaiwast]

Interesting. I could've probably guessed this isn't that uncommon.

Do you handle those devices exclusively remotely, or do you have someone on site with admin access to handle exceptions? I'm asking because I've recently had a case where after coming back from Apple repair, a colleague's MacBook refused to receive any policies from Jamf. It took me weeks to find a time window to fix that issue because I needed the device on hand (as nothing I could do to it remotely would work).