Jamf School local account management

[inayarens]

Hello y'all.

I was just recently hired by a small (less than 500 k-12) students to manage their new 1:1 technology program. They had purchased 255 MacBooks, 180 iPads, and 60 Apple TVs. They also purchased Jamf School "at the recommendation of Apple."

We finished deploying devices to students and teachers today, and after the 7th phone call about a student forgetting their local account password, I realized that Jamf School was extremely limited in comparison to Jamf Pro with regards to MacBooks.

So, my questions.

1: Is it possible to upgrade from jamf School to Jamf Pro without re-enrolling devices?

2: If not, is there a 3rd party software we can deploy on top of Jamf School that will allow us to manage user accounts?

I'm the first IT staff to be hired, so I tried explaining the limitations to the superintendent, and they are open to discussions about upgrading should it be available. I'm just realizing how insecure and unmanageable our MacBooks are at this point.

[Ecco_Luke]

1. You cannot move from one MDM to another without erasing all of your devices and starting afresh. This is partly an Apple thing, in fairness, but does make sense as it's always best to start from a box-fresh state in a new MDM.

2. You should be able to deploy scripts for whatever it is you're trying to do. I would think that third-party apps would have very limited access to such areas given modern macOS security protocols. Can you elaborate on what specifically you'd like to do, as I may be able to help.

I'd recommend using Jamf Connect to integrate with an Azure AD or Google Workspace tenant, as this will allow you to automatically create Standard (i.e. non-Admin) accounts when the students log-in. You could then create the first Admin account (the all-important 501 user) during the setup of each Mac. In Jamf Pro, you can automatically create the Admin user via MDM completely hands-free within a Computer PreStage (Jamf's name for the automated setup process), meaning Macs could be unboxed and set-up by students as they won't be prompted for local account credentials and would simply log-in with M365 or Google accounts straight out of the box.