A number of our issues seem to stem from trying to perform tasks from the MDM in the context of standard user sessions. In theory this is all supposed to be groovy if all users have secure tokens, bootstrap is supported by the MDM (since Nov 2021 for School), and a bootstrap token is escrowed back to the MDM by one of those admin secure token holders.
Allowing staff to be admin users would be so much easier, and I come across a number of organizations that allow this. From the Windows world I came up in, and as general best practice, policies of least privilege have always made sense. I wonder if this is actually true with supervised and managed MacOS devices though. Is there really so much risk potential that can't be mitigated by supervision and policy? We can prevent MDM profile removal, can limit application install. I supposed malware execution is a thing, but if there's AV and endpoint protection in place, upstream security at the network, etc... I'm just wondering. We really piss off a lot of staff who were used to admin before we started managing devices. We never got calls on them, ever. Now we manage and can't match the experience they had previously, are spending a TON of time trying to do so, and often failing which kills morale for the team and damages the rep between us and the business unit.
Admin on a supervised and managed Mac in an enterprise infrastructure isn't that big a deal. Change my mind. : )
