Mac MDM
Mac device management for every company Mac
Enroll Macs with zero touch through Apple Business, turn on FileVault, firewall and Gatekeeper, install apps, keep macOS up to date and help users with remote desktop. All in the same console as your Windows PCs and phones.
Macs are often managed last
Built for Windows first
Many IT tools were made for Windows and treat the Mac as an afterthought, with fewer settings to work with.
Setup by hand
Without zero-touch enrollment, every new MacBook waits for someone to install profiles and apps.
No proof of protection
A FileVault profile going out doesn't tell you the disk is actually encrypted.
What it does
What Mac MDM does
Mac mobile device management lets IT set up, secure and support company Macs remotely, through Apple's own management framework. In trio.so that covers:
Enroll
Zero-touch enrollment through Apple Business, or a link, QR code or agent package for Macs you already have.
Configure
47 macOS policy types, from FileVault and Gatekeeper to Wi-Fi, VPN and the login window.
Check security
FileVault, firewall, Gatekeeper, System Integrity Protection and screen lock checked on every Mac.
Install apps
Apps and Books, the trio.so catalog, or your own app uploaded as a DMG.
Update
macOS updates through Auto Patch and fixes for third-party Mac apps through remediation plans.
Support
Remote desktop, terminal and scripts, straight from the Mac's record.
How it works
How Mac management works in trio.so
- Connect Apple BusinessLink Apple Business (formerly Apple Business Manager) once, or Apple School Manager for schools.
- Enroll your MacsNew Macs enroll the first time they're turned on; existing ones with a link or the agent.
- Apply policies and appsAssign by group and see whether each Mac applied them.
- Keep them currentAuto Patch installs macOS updates on the schedule you set.
Enrollment
Zero-touch enrollment for new and existing Macs
Macs your company buys enroll through Automated Device Enrollment the first time they're turned on, supervised and with the trio.so agent installed. Macs you already have can enroll with a link, a QR code or the agent package.
- Automated Device EnrollmentNew Macs arrive managed, with no one touching them.
- Existing MacsAn enrollment link, a profile QR code or the agent package, with no Apple Business needed.
- Personal MacsAccount-driven user enrollment on macOS 14 and later. IT can't erase or lock a personal Mac.
Configuration
47 macOS policy types, with a result for every Mac
Set FileVault, firewall and Gatekeeper, control privacy permissions and system extensions, and push Wi-Fi, VPN and certificates. Every Mac reports whether each policy is applied, pending or failed.
- SecurityFileVault, firewall, Gatekeeper, login window and screen lock.
- Privacy and extensionsPrivacy preferences (PPPC), and system and kernel extensions.
- USB storageBlock or limit USB and other removable storage.
- NetworkWi-Fi with WPA2 or WPA3, VPN, encrypted DNS and PKCS#12, SCEP and root certificates.
- Sign-inSingle sign-on extension, directory binding and smart cards.
Security
Know every Mac is protected
trio.so checks each Mac against your controls and shows the ones that fail, with a risk score from its open vulnerability findings. The managed local admin password for each Mac is stored in the console.
- Disk and firewallFileVault on, firewall and stealth mode enabled.
- System protectionGatekeeper and System Integrity Protection turned on.
- Screen lock and OSScreen lock within 15 minutes, and macOS up to date.
Apps
Install the apps your team needs
Buy and assign apps through Apple Apps and Books, add common apps from the trio.so catalog, or upload your own Mac app as a DMG. Every Mac lists the apps it has installed.
Updates
macOS updates on your schedule
Auto Patch policies use Apple's declarative management to defer or enforce macOS updates, with a deadline and a local install time. Third-party Mac apps get CVE findings and fixes through remediation plans.
- Defer or enforceHold major and minor updates for a set number of days, or require the latest version by a deadline.
- Rapid Security ResponsesAllow Apple's fast security fixes between full updates.
Remote support
Help any Mac user from the browser
Open a remote desktop or terminal session, run bash or sh scripts and collect diagnostics through the trio.so agent, which every enrolled company Mac gets. On company-owned Macs you can also lock with a PIN, restart, shut down or erase.
- Remote desktopSee and control the Mac's screen.
- Terminal and scriptsA shell in the browser, or scripts run on one Mac or many.
- Lock and eraseLock a lost Mac with a PIN, or erase it.
Mixed fleets
Macs and Windows PCs in one console
Windows next to Mac
The same policies, reports and remote tools for your Windows PCs.
iPhone and iPad
One Apple Business connection for Macs, iPhones and iPads.
Android and Linux too
Five platforms in one console, with one record per device.
Mac management at a glance
- 47
- macOS policy types
- Zero touch
- through Apple Business
- 7
- security checks on every Mac
- From $5
- per device, in every plan
Related