macOS Server, Apple Configurator 2, and Active Directory integration.

I'm part of a I.T. staff in a public school district and we are wondering how to manage iPads and Macs and what that whole process looks like. I have purchased macOS Server and we have Apple Configurator 2. We have been a Windows based district for quite some time, with majority Windows and Chromebooks. What are the roles that macOS Server play and apple configurator play in managing Apple Products? And how could we integrate it well with Active Directory?


Any help is appreciated!


-Mark

Posted on Oct 15, 2022 12:53 PM

Reply
Question marked as Top-ranking reply

Posted on Oct 16, 2022 11:25 AM

Mark,


To start, don't use Server.app and only use Configurator as a last resort. Let's get into the details.


To start, Server.app is deprecated (About macOS Server 5.7.1 and later - Apple Support). While it contained Profile Manager, it would be foolish to attempt to manage an environment with it at this time. And, as sad as this may sound, there is no reason for Server.app any longer. Its only visible services are Open Directory, Profile Manager, and Xsan. None of these play a role in modern Apple platform management.


Regarding Apple Configurator, it is a great tool but one ideally used sparingly. For example, if the PTA donates a bunch of Apple products to the school and you cannot prove chain of custody ownership, then use Apple Configurator to side load the hardware assets.


That leads to what should you be doing.


1: First, sign up for Apple School Manager (https://school.apple.com/#/enrollment/form). Since you are an EDU you should only be buying from the Apple EDU Store. If you are still calling and talking to an EDU sales rep, make sure they know you have an Apple School Manager account. This will ensure that all hardware will be automatically assigned to your Apple School Manager (ASM) account. If you want to be able to order on your own, ask your EDU rep to set up and Apple Ecommerce Store for you. This is a custom store your your school, allowing the purchase of hardware and App Store credits.


ASM has three major features: Device Enrollment Program (DEP), Volume Purchase Plan (VPP), and the ability to Federate ASM with Azure or G Suite. Remember, ASM is not a management platform. See 2 below for MDM. Consider ASM as an inventory and store of custody for hard assets (Macs, iPads, Apple TVs, etc) and soft assets (app and books from Apple's App and Book Stores).


2: Once you have ASM setup, the next step is to select an MDM. There are a lot out there. A short list is Jamf (Pro, School, Now), Mosyle, and Intune. However, there are many, many, more, including the one from Meraki. Do some research to determine which best fits your needs. Please note, if you only had iPads, then the selection of an MDM is almost irrelevant as they all basically implement Apple's management framework. However, Macs are infinitely customizable and Jamf Pro continues to have a significant edge on managing Mac fleets. Just about all of the MDM vendors have EDU pricing so make sure that is what you get.


3: Link ASM and your MDM together to benefit from automated enrollment and volume app distribution. Once the two are linked, you will be able to setup a pre-stage policy to handle automated enrollment. Basically, this works by utilizing Apple's Activation Servers to direct the hardware to your MDM. The MDM then directs the hardware to enroll into your MDM. This means you can go from unboxing to enrolled in as few as four steps. (1) Select country. (2) Select language. (3) Join a network. (4) Accept enrollment. Actually, on the latest gear, add a step for Accessibility. On top of the pre-stage, add all your applications (3rd party and App Store), preferences, printers, and data to enrollment policies. This will allow the device to fully "image" itself with no direct actions.


4: Now, the question on Active Directory integration... That is a loaded question. If you have Macs and they are on the same network as your AD domain, you can bind them to AD. But, your iPads will not participate in this. I will assume that you have started the hybrid cloud movement and you also have access to Azure. If so, I encourage you to look into Federation via ASM. This will allow you to explore the use of Managed Apple IDs. Or, if you are not looking for multiple-user iPad, then you can look to Federate your MDM and use solutions for identity provider login. Jamf Connect for example provides a shim into Login Window to direct users to authenticate agains Azure. This is effective in one-to-one situations and shared use devices.


Managing the Apple platform can be a very easy part of your overall management environment. Get ASM setup, license/purchase apps trough VPP, and choose an MDM that satisfies the needs of your fleet.


Hope this brief explanation is helpful.


Reid

1 reply
Question marked as Top-ranking reply

Oct 16, 2022 11:25 AM in response to taylormark1234

Mark,


To start, don't use Server.app and only use Configurator as a last resort. Let's get into the details.


To start, Server.app is deprecated (About macOS Server 5.7.1 and later - Apple Support). While it contained Profile Manager, it would be foolish to attempt to manage an environment with it at this time. And, as sad as this may sound, there is no reason for Server.app any longer. Its only visible services are Open Directory, Profile Manager, and Xsan. None of these play a role in modern Apple platform management.


Regarding Apple Configurator, it is a great tool but one ideally used sparingly. For example, if the PTA donates a bunch of Apple products to the school and you cannot prove chain of custody ownership, then use Apple Configurator to side load the hardware assets.


That leads to what should you be doing.


1: First, sign up for Apple School Manager (https://school.apple.com/#/enrollment/form). Since you are an EDU you should only be buying from the Apple EDU Store. If you are still calling and talking to an EDU sales rep, make sure they know you have an Apple School Manager account. This will ensure that all hardware will be automatically assigned to your Apple School Manager (ASM) account. If you want to be able to order on your own, ask your EDU rep to set up and Apple Ecommerce Store for you. This is a custom store your your school, allowing the purchase of hardware and App Store credits.


ASM has three major features: Device Enrollment Program (DEP), Volume Purchase Plan (VPP), and the ability to Federate ASM with Azure or G Suite. Remember, ASM is not a management platform. See 2 below for MDM. Consider ASM as an inventory and store of custody for hard assets (Macs, iPads, Apple TVs, etc) and soft assets (app and books from Apple's App and Book Stores).


2: Once you have ASM setup, the next step is to select an MDM. There are a lot out there. A short list is Jamf (Pro, School, Now), Mosyle, and Intune. However, there are many, many, more, including the one from Meraki. Do some research to determine which best fits your needs. Please note, if you only had iPads, then the selection of an MDM is almost irrelevant as they all basically implement Apple's management framework. However, Macs are infinitely customizable and Jamf Pro continues to have a significant edge on managing Mac fleets. Just about all of the MDM vendors have EDU pricing so make sure that is what you get.


3: Link ASM and your MDM together to benefit from automated enrollment and volume app distribution. Once the two are linked, you will be able to setup a pre-stage policy to handle automated enrollment. Basically, this works by utilizing Apple's Activation Servers to direct the hardware to your MDM. The MDM then directs the hardware to enroll into your MDM. This means you can go from unboxing to enrolled in as few as four steps. (1) Select country. (2) Select language. (3) Join a network. (4) Accept enrollment. Actually, on the latest gear, add a step for Accessibility. On top of the pre-stage, add all your applications (3rd party and App Store), preferences, printers, and data to enrollment policies. This will allow the device to fully "image" itself with no direct actions.


4: Now, the question on Active Directory integration... That is a loaded question. If you have Macs and they are on the same network as your AD domain, you can bind them to AD. But, your iPads will not participate in this. I will assume that you have started the hybrid cloud movement and you also have access to Azure. If so, I encourage you to look into Federation via ASM. This will allow you to explore the use of Managed Apple IDs. Or, if you are not looking for multiple-user iPad, then you can look to Federate your MDM and use solutions for identity provider login. Jamf Connect for example provides a shim into Login Window to direct users to authenticate agains Azure. This is effective in one-to-one situations and shared use devices.


Managing the Apple platform can be a very easy part of your overall management environment. Get ASM setup, license/purchase apps trough VPP, and choose an MDM that satisfies the needs of your fleet.


Hope this brief explanation is helpful.


Reid

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

macOS Server, Apple Configurator 2, and Active Directory integration.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.