What we do
More people choose Apple at work every year, and every one of those devices needs managing. Whatever the size of your organisation, we set it up so the right apps and policies land on the right devices, automatically, and so nobody has to walk to a desk with a USB stick.
Zero-touch deployment
Zero touch does exactly what the name says. A new device is shipped straight to the person who'll use it. They switch it on, sign in with their work credentials, and the device enrols, installs its apps and applies your security policies on its own, inside Setup Assistant, before they ever reach the desktop. No technician in the loop, no imaging, no courier to the office first.
Pre-staged, per persona
Before a device ships, we've already assigned it in the MDM: the person's role decides which apps, settings and printers it gets. A designer's Mac arrives with the design apps installed; a finance Mac arrives with the finance tools. The software goes on during Setup Assistant, with a progress screen that says what's happening, so when the desktop appears the work can start. We do this on every MDM we run, not just Jamf.
What we set up
Apple Business Manager (or School Manager) linked to your MDM, automated enrolment profiles, persona-based app and settings groups, and the Setup Assistant flow that installs them, with the progress screen rather than a spinner.
What changes
Onboarding stops being an IT ticket. Replacement devices go out the same day. Remote starters get a working Mac on day one, wherever they are.
Automated app patching
Unpatched software is how most estates get into trouble. We set patching up so apps, macOS and iOS stay current without anyone chasing, and so people get a polite deferral window rather than a forced restart mid-presentation.
What we set up
Patch policies for the apps you actually use, OS update enforcement with sensible deadlines, and a report that shows what's out of date and why.
What changes
Your vulnerability scan stops lighting up, and "have you updated Chrome?" stops being a conversation anyone has.
Account provisioning
We join device management to identity management, so the account someone signs into on day one is the same one that gets switched off the day they leave. Entra ID, Google Workspace, Okta: whichever you have.
What we set up
Single sign-on at the Mac login window, passwords that stay in sync, automated group membership, and offboarding that actually removes access rather than just disabling an email.
What changes
Joiners, movers and leavers take minutes instead of a checklist. Contractors and partners get the access they need, for as long as they need it, and no longer.
CIS-level security
The CIS benchmarks are the industry's checklist for a properly locked-down Mac. We enforce them: strong passwords, FileVault disk encryption, firewall, screensaver lock, certificate management, and the rest.
What we set up
Configuration profiles for every benchmark that applies to you, with exceptions documented rather than silently skipped. We generate a security report for each device and attach it to its computer record, so an auditor can see it without asking you.
What changes
Cyber Essentials, ISO 27001 and client security questionnaires get answered with evidence instead of a shrug.
Smart reporting
You can't fix what you can't see. Our smart reports show the health and activity of every endpoint across the organisation, and we build the smart groups that decide which devices get which app, policy, profile or restriction.
What we set up
Dashboards for the questions you actually ask: what's encrypted, what's out of date, what hasn't checked in, who's got what. Smart groups by department, role, hardware and OS version.
What changes
Scoping a new app to the right 40 people takes one group, not a spreadsheet. The monthly security report writes itself.
Seamless MDM migrations
Switching MDM used to mean wiping every device. It doesn't any more. Our migration agent is built to fit your estate, deploys from the MDM you're leaving, and brings each person's part down to a few clicks.
What we set up
A rebuilt configuration in the new MDM (not a copy of the old mess), the migration agent, a pilot group, and a rollout schedule that moves people in waves so nobody loses a day.
What changes
You stop paying for the MDM that doesn't fit, with no re-imaging and no lost data. How a switch works, step by step →
Infrastructure as code
Most Apple estates are configured by hand, in a web console, by whoever was there at the time. Nobody knows why a policy exists, nothing is tested before it goes live, and the only backup is a screenshot. We build estates the way engineers build software: the MDM configuration lives in Terraform, changes go through a CI pipeline, and the whole thing can be rebuilt from a repository.
What we set up
Your Jamf Pro (or other MDM) tenant described in Terraform, using the vendor's own provider. A Git repository with a pull-request workflow, so every change is reviewed. A CI pipeline that validates and plans the change, applies it to a test tenant, runs checks, and only then applies it to production. Secrets in a vault, not a wiki.
What changes
"Who changed that and why?" has an answer: the commit. A new tenant, a dev environment or a disaster-recovery rebuild is a pipeline run, not a fortnight. Your own team can propose changes safely, because the pipeline catches mistakes before a thousand Macs do.
Not ready yet?
Then we don't start there. We'll run the estate the normal way, fix what hurts, and introduce version control one piece at a time, with your help desk and technicians learning each step as it lands. Our tutorials are written in plain language for the person doing the job, not for a vendor exam. By the time the pipeline is live, your team is the one running it.
Also as code
Smart groups, configuration profiles, scripts, patch policies and app catalogues. Apple Business Manager assignments. Identity-provider groups and SSO settings. If it has an API, we'd rather not click it.
Upskilling your team
The best outcome isn't that you need us forever. It's that your own help desk and technicians can run what we built. So training is part of every engagement, not an extra.
Custom tutorials
Step-by-step guides we've written ourselves, in simple language, for the exact setup you have. Not generic vendor docs. Screenshots of your console, your naming, your groups. Kept up to date as the estate changes.
Side-by-side
Your technicians work alongside ours on real tickets and real changes. The first time they do it we drive; the second time they do; the third time we're on the end of a call if needed.
Certifications
If someone on your team wants Jamf 200, Apple Device Support, Microsoft MD-102 or the HashiCorp Terraform exam, we'll map out the path and coach them through it.
Estate health check
One day, fixed price, on whatever you already have. We go through every policy, profile, script and group, check it against the vendor's intended setup and the CIS benchmarks, and give you a written list: what's wrong, what's fine, and what to do first. Lots of clients start here. Some fix it themselves afterwards, and that's fine with us.
Also in the bag
Apple Business Manager and School Manager setup, hardware procurement advice (we don't sell it), end-of-life wipe, buyback and recycling, and training for your own IT team so they can run what we built.