what does Jamd software log?

[carla11]

I recently started a new job where the company had me install Jamf on a brand new MacBook and I am wondering what exactly hand logs, more precisely, if the websites I go to, how much time I spend on those, what softwares I download (if I download a VPN) and where I log in from

[sdagley]

There are several different Jamf products, and what they can, or do, collect varies. If you are concerned about your employer monitoring your use of a Mac they've issued to you then you might want to review your company's policies regarding work computers. If they don't mention anything try asking your HR department.

[AJPinto]

If this was a company provided MacBook, assume everything is being monitored. Dont do anything that is not directly related to work on any company owned device. If this was/is a personal device, get JAMF off of it and make your employer provide you a laptop.

[jpeters21]

wow .. um if BYOD, the employee agreed to it, and even so in a self enrolled device Jamf merely serves as a compliance check for say OS version, firewall/encryption enabled, ect.  

[AJPinto]

It’s not so much about what JAMF itself can monitor. It’s about what the applications JAMF installs and configures can monitor. 

Myself, I’m also wholly against BYOD in the computer space. Do not mix personal and work on the same OS. Do not give any management over a personal computer to a company.  

[jpeters21]

I get the choosing for separation of work and personal.. but if a person has already agreed to BYOD the company has a right to protect their information. Also when self enrolled BYOD, jamf does not have "supervisor" rights, the end user chooses what's installed. My BYOD policy has only ever included the a couple things.. OS is up to date, must have a authentication method enabled (no auto logon) , firewall and encryption enabled. In return they have access to install business apps on a personal device. 

[AJPinto]

I totally agree a company has every right to protect their intellectual property. However, BYOD is essentially companies putting off the cost of IT equipment to be used for company gain off on to employees to save a buck. Where Apple and Google have many good segregation tools in place for the mobile platform, that division simply does not exist for macOS at this time. Apple is clearly moving in that direction, but they are not there yet.

It is very much possible to monitor what your employees are doing on BYOD macs. I have seen some organizations requiring device enrollment which will grant supervision. Many admins dont fully understand what supervision is, let alone end users.  It sounds like your company is on the up and up, and is just dealing with conditional access for managed apps. I have worked for companies that would not draw the line where yours has.

All opinions, aside. The simple fact is dont ever mix personal and work. Dont do personal stuff on a work device, dont do work on a personal device. If you must furnish a BYOD, it should be dedicated to work.

[sdagley]

I'm in agreement with @AJPinto on BYOD being a bad idea on Macs. Until macOS offers the same separation of user and organizational spaces that iOS does I would not recommend anyone use personal Mac as a BYOD device.

Likewise I would not recommend anyone issued a company computer think it appropriate for anything personal, but I am continually amazed by users who seem to feel that once a device is in their hands it becomes theirs rather than the company's.

[jpeters21]

is this your laptop? if not stop doing what ever it is that is causing concern on your part. 

if it is your laptop, being a self-enrolled (not DEP or supervised) its really serving as either a compliance check or to deploy software to you (which you would still need to authorize the installation. The software installed would be inventoried but likely not much of a concern to a Mac Administrator. Jamf does not log your web sites visited.. but sure they could see if your using a given app. Honestly the chances of IT staring at your browsing history are minimal unless you have done something/or perhaps a lack of productivity that would make your boss request they do so.