4 ms·

I'm curious do any HN readers manage their personal devices through MDM with their own profiles, and what benefits are you seeing from that?

by urda 8y ago

ecesena 8y ago
I just learned from a colleague that you can install a MDM if you have a Google Apps account. Of course now I want to try MicroMDM first. I think the major benefit is that this way you control the MDM, and you don't risk that a MDM gets installed on your phone unexpectedly, sort of like a rootkit.
zalmoxes 8y ago
The server is only meant for enterprise deployments. It would be pretty hard to do this on a personal level because you need to apply for an enterprise account with Apple, and request a very specific push certificate option.
- metabeard 8y ago
  You can't even sign up for the Enterprise program if your Apple ID is associated with the Apple Developer Program. You'll get the following error when signing up: > Your Apple ID is already associated with a Team Agent enrolled in this program
  - no_wizard 8y ago
    You should contact developer relations they can get you hooked up with the same account
- hsk0823 8y ago
  Anyone can get a push certificate, it's not just businesses, https://identity.apple.com/pushcert/ https://identity.apple.com/pushcert/
  - zalmoxes 8y ago
    MDM push notifications require to be signed by a special certificate, which is only available upon request.
  - kiallmacinnes 8y ago
    While that is true, anyone can get a push notification cert, this is a different cert..
- ghostly_s 8y ago
  Setting up Mobile Device Management itself is not particularly onerous, it's definitely best practice to create a new Apple ID for that purpose, however. A technical individual can already do this easily enough with the freely-available Meraki MDM. The Device Enrollment Program I believe is more complicated and inaccessible to individuals (haven't dealt with this personally), and is quickly becoming a prerequisite for many of the more invasive and useful capabilities, like the kext signing and deployment mentioned on the MicroMDM homepage.
  - robinwassen 8y ago
    Meraki MDM is not free anymore AFAIK. But if you signed up while they offered the 100 free devices plan it's still valid.
    - ghostly_s 8y ago
      Hm, guess I missed that...and their offering has a long way to go before I'd consider it worth paying for. An alternative then might be Jamf, they recently started offering a free tier with a handful of devices for their hosted 'Jamf Now' MDM (or at least it's free via their promotions on sites like Daring Fireball).
hsk0823 8y ago
There are HN readers who are Directors of IT at their place of employment
- ghostly_s 8y ago
  That wasn't the question.
robinwassen 8y ago
I manage our devices at work but not my personal devices. If you have a lot of devices (think 10+) I guess it could be useful to keep them aligned. It could also be useful as training on how to centrally manage devices. But I would not recommend using a MDM unless you have a specific reason. Personal devices that you have physical control over are easy to manage locally on the device. Adding a MDM also adds another attack vector, if the MDM is compromised all your devices are at risk.
kiallmacinnes 8y ago
Do I do it for my personal devices? No. Do I see any benefits? Nope! But ... when have I let that stop me from running something wildly inappropriate for a single user "enterprise"! I don't own anything apple, so I'm unlikely to ever run this MDM, but, if a good Android one came to my attention.. maybe? I'm geeky enough to enjoy doing it, even if it comes with no real benefits to me.
andrewaylett 8y ago
I'm administrator for GSuite for the school I'm a trustee of, so my personal (Android) device is enrolled by virtue of me wanting to know how it works and also wanting my school email on that device. I'm not sure it would be worthwhile setting up for personal use -- the policies it lets you set aren't doing anything other than ensuring you're following best practices (like setting a screen lock) so you don't gain anything over just doing that, and the direct management tools aren't any finer-grained than you can get from Google's Find My Device. I'm not sure you're able to set up a linked "for work" profile without MDM; that might be a benefit if you want compartmentalisation.
- pmh 8y ago
  If you don't care about the managed Google Play store, you could always use Google's TestDPC app (or create your own) to create a work profile ("do-not-use-in-production" warnings notwithstanding): https://play.google.com/store/apps/details?id=com.afwsamples.testdpc https://play.google.com/store/apps/details?id=com.afwsamples... That said, it might be more straightforward to just use another user on your device
walterbell 8y ago
Apple Configurator 2 can be used locally to set some policies which are only available on "supervised" devices, e.g. prevent USB pairing with unknown computers.
nicoburns 8y ago
I don't, but I absolutely would for my children's devices (when I have children). Limiting time using certain apps, etc would be great.
- giobox 8y ago
  I think the new parental controls iOS and Android have recently introduced are far more effective for this than using MDM, personally. These features are specifically designed for this use case.
cynix 8y ago
I manage the personal devices of my family members (wife, parents, in-laws) through MDM. My parents and in-laws are quite tech-illiterate, so it helps to be able to enforce some restrictions via profiles to prevent them from doing stupid things to their own devices, and thus reduce the time I have to spend on providing tech support (across the ocean no less). It's also useful for distributing Wi-Fi/VPN configs so I can enforce that VPN must be used on untrusted Wi-Fi, for example.
stephenr 8y ago
I don't use an MDM server/service specifically, but I use a profile (built and installed via Apple Configurator 2 over USB) to install certificates+keys for S/MIME. The nice part is I can use the same profile on a Mac too.

I'm curious do any HN readers manage their personal devices through MDM with their own profiles, and what benefits are you seeing from that?

by urda 8y ago

I'm curious do any HN readers manage their personal devices through MDM with their own profiles, and what benefits are you seeing from that?

ecesena 8y ago

I just learned from a colleague that you can install a MDM if you have a Google Apps account. Of course now I want to try MicroMDM first. I think the major benefit is that this way you control the MDM, and you don't risk that a MDM gets installed on your phone unexpectedly, sort of like a rootkit.

zalmoxes 8y ago

The server is only meant for enterprise deployments. It would be pretty hard to do this on a personal level because you need to apply for an enterprise account with Apple, and request a very specific push certificate option.

metabeard 8y ago
You can't even sign up for the Enterprise program if your Apple ID is associated with the Apple Developer Program. You'll get the following error when signing up: > Your Apple ID is already associated with a Team Agent enrolled in this program
- no_wizard 8y ago
  You should contact developer relations they can get you hooked up with the same account
hsk0823 8y ago
Anyone can get a push certificate, it's not just businesses, https://identity.apple.com/pushcert/ https://identity.apple.com/pushcert/
- zalmoxes 8y ago
  MDM push notifications require to be signed by a special certificate, which is only available upon request.
- kiallmacinnes 8y ago
  While that is true, anyone can get a push notification cert, this is a different cert..
ghostly_s 8y ago
Setting up Mobile Device Management itself is not particularly onerous, it's definitely best practice to create a new Apple ID for that purpose, however. A technical individual can already do this easily enough with the freely-available Meraki MDM. The Device Enrollment Program I believe is more complicated and inaccessible to individuals (haven't dealt with this personally), and is quickly becoming a prerequisite for many of the more invasive and useful capabilities, like the kext signing and deployment mentioned on the MicroMDM homepage.
- robinwassen 8y ago
  Meraki MDM is not free anymore AFAIK. But if you signed up while they offered the 100 free devices plan it's still valid.
  - ghostly_s 8y ago
    Hm, guess I missed that...and their offering has a long way to go before I'd consider it worth paying for. An alternative then might be Jamf, they recently started offering a free tier with a handful of devices for their hosted 'Jamf Now' MDM (or at least it's free via their promotions on sites like Daring Fireball).

hsk0823 8y ago

There are HN readers who are Directors of IT at their place of employment

ghostly_s 8y ago
That wasn't the question.

robinwassen 8y ago

I manage our devices at work but not my personal devices. If you have a lot of devices (think 10+) I guess it could be useful to keep them aligned. It could also be useful as training on how to centrally manage devices. But I would not recommend using a MDM unless you have a specific reason. Personal devices that you have physical control over are easy to manage locally on the device. Adding a MDM also adds another attack vector, if the MDM is compromised all your devices are at risk.

kiallmacinnes 8y ago

Do I do it for my personal devices? No. Do I see any benefits? Nope! But ... when have I let that stop me from running something wildly inappropriate for a single user "enterprise"! I don't own anything apple, so I'm unlikely to ever run this MDM, but, if a good Android one came to my attention.. maybe? I'm geeky enough to enjoy doing it, even if it comes with no real benefits to me.

andrewaylett 8y ago

I'm administrator for GSuite for the school I'm a trustee of, so my personal (Android) device is enrolled by virtue of me wanting to know how it works and also wanting my school email on that device. I'm not sure it would be worthwhile setting up for personal use -- the policies it lets you set aren't doing anything other than ensuring you're following best practices (like setting a screen lock) so you don't gain anything over just doing that, and the direct management tools aren't any finer-grained than you can get from Google's Find My Device. I'm not sure you're able to set up a linked "for work" profile without MDM; that might be a benefit if you want compartmentalisation.

pmh 8y ago
If you don't care about the managed Google Play store, you could always use Google's TestDPC app (or create your own) to create a work profile ("do-not-use-in-production" warnings notwithstanding): https://play.google.com/store/apps/details?id=com.afwsamples.testdpc https://play.google.com/store/apps/details?id=com.afwsamples... That said, it might be more straightforward to just use another user on your device

walterbell 8y ago

Apple Configurator 2 can be used locally to set some policies which are only available on "supervised" devices, e.g. prevent USB pairing with unknown computers.

nicoburns 8y ago

I don't, but I absolutely would for my children's devices (when I have children). Limiting time using certain apps, etc would be great.

giobox 8y ago
I think the new parental controls iOS and Android have recently introduced are far more effective for this than using MDM, personally. These features are specifically designed for this use case.

cynix 8y ago

I manage the personal devices of my family members (wife, parents, in-laws) through MDM. My parents and in-laws are quite tech-illiterate, so it helps to be able to enforce some restrictions via profiles to prevent them from doing stupid things to their own devices, and thus reduce the time I have to spend on providing tech support (across the ocean no less). It's also useful for distributing Wi-Fi/VPN configs so I can enforce that VPN must be used on untrusted Wi-Fi, for example.

stephenr 8y ago

I don't use an MDM server/service specifically, but I use a profile (built and installed via Apple Configurator 2 over USB) to install certificates+keys for S/MIME. The nice part is I can use the same profile on a Mac too.