Glossary
macOS MDM
macOS MDM is the management of Mac desktops and laptops through Apple's native management protocol, the same channel used for iPhone and iPad but with its own payloads, consent rules and escrow mechanics. For an IT team it means a Mac can be enrolled at first boot, encrypted with FileVault and kept up to date from a console, as long as you respect the approvals Apple now requires from the user.
How it works
Enrollment splits into two worlds. A Mac bought through a reseller and assigned in Apple Business Manager enrolls through Automated Device Enrollment during Setup Assistant, comes out supervised, and can be made non-removable. Anything else gets manual enrollment, where the user installs a profile and then has to approve management in System Settings. That step is called user-approved MDM, introduced back in macOS 10.13.2, and without it the MDM is second class: no FileVault key escrow, no system extension approvals.
On Apple silicon, two pieces carry the weight. The bootstrap token, mandatory since macOS 11, lets the MDM grant a SecureToken to managed accounts so they can unlock FileVault and authorize OS updates without a local admin typing a password. And FileVault escrow sends the personal recovery key to the MDM server, which is the only sane way to answer the ticket that starts with "I forgot my password".
The direction of travel is Declarative Device Management. Apple shipped DDM with iOS 15 in 2021, brought it to macOS 13 Ventura in 2022, and made it the real mechanism for software update enforcement from macOS 14 Sonoma onward. Instead of the server polling and pushing commands, the Mac holds declarations and reports status changes itself. Apple has been deprecating the older update commands in favor of it, so a console that still relies only on legacy MDM commands is on borrowed time.
At the same time, the set of profiles Apple accepts keeps shrinking. Payloads that used to configure things silently now need user consent or have been removed outright, and features like Login Items and background task management moved behind their own approval in macOS 13.
Why it matters for a fleet
Most European fleets are mixed: iPhones everywhere, Android in the field, Windows laptops in finance, and a growing stack of MacBooks in engineering and design. Managing the Macs with nothing, or with a Jamf tenant that nobody on the mobile team logs into, is how you end up unable to prove FileVault is on.
The honest comparison: Jamf Pro is deeper on macOS than any generalist tool. Scripts, packaging, Self Service, patch management, Jamf Connect for password sync with the identity provider. If your estate is mostly Macs and you have an engineer whose job is macOS, Jamf will do things a mixed-platform console won't. If you have 60 Macs next to 900 phones, running two consoles and two sets of compliance rules costs more than it buys. Intune sits in between, strong if you are already all in on Entra ID, thinner than Jamf on Mac specifics.
How Appaloosa handles it
Appaloosa manages macOS alongside iOS, iPadOS, Android and Windows from one console: Automated Device Enrollment through Apple Business Manager, configuration profiles, app distribution, compliance rules evaluated continuously, and remote wipe. One inventory, one set of policies, and hosting in France on SecNumCloud-qualified infrastructure. See the mobile device management page for how the platforms line up.
Explore
See the full platform
Enrollment, apps, security, remote support: all in one place.
Explore Appaloosa →See Appaloosa run on your fleet Book a demo