Device Management — Solution Proposal

A device management system (known in the industry as MDM, short for Mobile Device Management) is software that gives IT a single place to manage every company-owned computer and phone. It provides a central record of what the company owns, an automated setup system for new devices, and an enforcement layer for the rules in our Computer Use Policy.

With a device management system in place, IT can:

• See every device the company owns, who has it, and what's on it.
• Set up a new starter's laptop automatically — it arrives, the user turns it on, and it's ready, with all the right software, security settings and access already configured.
• Enforce the rules in the policy — passwords, encryption, auto-lock, blocked content — without relying on individual staff to remember them.
• Recover a device when someone leaves, when a laptop is lost or stolen, or when it's been compromised — without needing the user's personal passwords or physical access.

Without this system, all of the above has to be done manually on each device by an IT person physically or remotely logging in with the user's cooperation. That is workable for one or two devices. At 25+ devices across two operating systems, it is not.

Why a combination of products is required

A common question is whether a single product could replace all three — specifically, whether Jamf alone could manage both Macs and Windows devices. The short answer is no, not at this scale and cost. Here is why the combination is optimal:

Jamf Pro (Jamf's enterprise tier, separate from Jamf Now and Jamf for Mac) does include Windows device management, but it is priced significantly above the tiers recommended here and would mean paying for Windows management we already have included in M365. Intune is the right tool for Windows because it is already licensed, has native integration with Microsoft's identity and security stack, and manages Windows at full depth. Jamf exists because Apple does not expose the same management APIs to Microsoft's tools — deep Mac management requires a Mac-native specialist.

Apple Business Manager is not optional. It is the enrollment backbone for all Apple devices — without it, Jamf cannot perform zero-touch setup and devices can still be locked to personal Apple IDs. It is free and must be in place before Jamf can do its job.

Competitive alternatives — how Jamf compares

Five platforms are frequently evaluated alongside Jamf for Apple device management. Pricing reflects published list rates as of mid-2025 — contact vendors for volume quotes. All prices in USD per device per month.

A question that comes up consistently when introducing device management is: what exactly can IT see? The answer depends on whether the device is company-owned or personal (BYOD), and which tier of tooling is in place. The short version: IT can see everything about the device hardware and software state; IT cannot read personal content, keystrokes, or activity in personal apps or browsers.

These boundaries are enforced by Apple and Microsoft at the platform level — they are not a policy decision or a trust statement. The MDM tool technically cannot access personal content even if someone wanted it to.

Single Sign-On means one work account logs a user into every approved work application, rather than a separate password for each. It reduces password fatigue, improves security (one strong account instead of many weak ones), and makes onboarding and offboarding significantly easier — one account enabled or disabled affects every system at once.

Think Renewable already has an SSO platform in place: Microsoft Entra ID, included in the Microsoft 365 Business Premium subscription. Most modern business applications integrate with Entra ID directly, through a "Sign in with Microsoft" option on their login screens.

On Windows devices, Entra ID SSO is native — users sign into their laptop with their Microsoft work account, and that account carries them into Teams, SharePoint, Outlook, and any Entra-connected SaaS application automatically. No additional software required.

On Macs, SSO requires an extra piece of software because macOS does not natively authenticate against cloud identity providers. Jamf Connect (bundled with Jamf for Mac) fills this gap: it replaces the Mac login screen with a cloud identity login, so staff use their Think Renewable Microsoft account to unlock their Mac. When a staff member's Entra ID account is disabled — on their last day, for example — their Mac access is revoked automatically. This closes the offboarding gap that the current situation has highlighted.

A dedicated standalone SSO platform (OneLogin, Okta, JumpCloud) is optional and typically only needed if the application portfolio includes tools that don't connect to Entra ID, or the organisation wants finer-grained conditional access policies. For reference, OneLogin's published pricing is USD $2 per user per month for SSO-only (25-user minimum) and USD $4 per user per month for the Advanced tier with MFA.

The policy commits Think Renewable to certain behaviours and expectations. A device management system is how we actually enforce and evidence those commitments:

Without this system, the policy is a document of good intentions. With it, the policy becomes something we can stand behind if an incident, audit or legal dispute ever requires us to demonstrate how we protect company data.

The default values below reflect the expected scale at Think Renewable. Adjust the inputs to explore alternative scenarios. New spend is what this initiative adds on top of the Microsoft 365 subscription already in place.

Every company-owned device currently set up under an individual's personal account needs to be re-provisioned under Think Renewable's central management. This is done one device at a time, with each user's cooperation, without disrupting daily work. Two decisions are needed before the work can begin:

• Confirm the exact count of company-owned Macs and Windows devices — this determines which Jamf tier applies.
• Approve the Jamf licensing line item — Intune and Apple Business Manager do not require additional spend; Jamf is the only new cost.

1. Set up the central systems (one-off, IT-only)
   • Create the Apple Business Manager account (free; requires an ABN and a D-U-N-S number, which is also free).
   • Activate Microsoft Intune in the existing Microsoft 365 tenancy.
   • Purchase and configure the chosen Jamf tier.
   • Link all three together so Mac and Windows compliance reports into one place.
2. Build a device inventory (one-off)
   • Record serial number, current holder, operating system, and purchase source for every company-owned device.
   • Gather the original Apple purchase invoice for every Mac — a safety net for any future Activation Lock situation.
3. Migrate each existing Mac (per device, with the user)
   • User backs up any personal files off the device. Company data stays on the device.
   • User signs out of their personal Apple ID and disables Find My Mac. This step is critical — missing it will cause the device to become Activation Locked after the wipe.
   • IT wipes the device.
   • IT registers the device in Apple Business Manager using Apple Configurator. This takes around five minutes and requires a brief USB-C connection to a host Mac.
   • On next startup, the device automatically enrols into the Mac MDM.
   • User signs in with their Think Renewable Microsoft account; applications and settings are pushed automatically. The device is back in the user's hands the same day.
4. Migrate each existing Windows laptop (per device, with the user)
   • User signs into the device using their Think Renewable Microsoft account.
   • The device joins Entra ID and Intune enrolment happens automatically in the background.
   • Baseline settings (password policy, encryption, auto-lock, approved applications) are applied.
5. Lock in the new standards going forward
   • All new device purchases go through Apple Business Manager or Windows Autopilot. No more individual setup.
   • Offboarding is tied to Employment Hero: when a staff member is marked as leaving, their device is automatically locked and queued for reset, closing the loop that the recent MacBook incident opened.
   • Onboarding is the mirror image: a new starter in Employment Hero triggers account creation and a pre-configured device shipped to them, ready on day one.

Think Renewable's most sensitive operational data lives in Zoho CRM (customer records, quotes, sales pipeline, contact details) and Xero (financial records, payroll, invoicing). Both are cloud platforms accessed primarily through company laptops. A compromised or unmanaged device is a direct pathway into both.

The AUD $4.26M average cost of a data breach in Australia (IBM, 2024) is driven primarily by customer notification obligations, regulatory investigation, and reputational damage — all of which are directly triggered by the exposure of the kind of data held in Zoho CRM and Xero. This initiative is the foundational layer of preventing that exposure.