Apple’s event came and left us with new phones, new watches, new AirPods, and a release date for the 27 platform upgrades. Also, we learn about Keychain files in Tahoe, migrating password managers, and safe mode.
This issue of MacAdmins.news is brought to you by iMazing Business: tools and automations to backup, supervise, enroll, and configure fleets of Apple devices from both Mac and PC.
The iMazing Business software suite includes: iMazing Configurator - apply blueprints for supervision, MDM enrollment, app management and backups; iMazing CLI - automate every function available in the UI; iMazing Profile Editor - author and sign profiles using the largest catalog of settings for Apple platforms and ecosystem apps.
Apple had their September event earlier this week. Most of the announcements had been leaked (or spoiled) before, but it is always interesting to finally get the details.
iPhone Duo, with a foldable screen, was announced at an eye-watering price. (Exaggerated for us Europeans by Apple holding on to a very generous (for them) Euro-Dollar exchange rate.) iPhone Pro 18 comes with some new camera tech and other improvements. Apple Watch Series 12 and Ultra 4 have an new SoC with new health features. And the new AirPods (no moniker) are bucking the trend and actually got cheaper, or at least same price with more features.
Back when iPhone Air was released last year, I speculated this could be like the releases of PowerMac G4 Cube or the 12” retina MacBook. These products were introduced at high prices, because they were pushing at the boundaries of what was technically possible. Neither lasted very long, but some of the technologies used in them made their way into other product lines. We are certainly seeing some design elements and tech of iPhone Air in iPhone Duo.
But this could also be like the introduction of MacBook Air, which started out expensive, but then dropped in price over time as the components became more common. One the other hand, the iPhone X and Mac Studio were able to establish an entirely new product category at a new price range. The Mac mini did this on the low end of the price spectrum, as might the MacBook Neo.
The jury is still out on iPhone Air (and Apple Vision Pro, for that matter...) and it will be interesting to see which path iPhone Duo takes.
For the price of an iPhone Duo, you can easily get an iPhone Pro and an iPad. You will have the advantage of more powerful devices and larger screens, but then you have to charge, carry, and switch between two devices.
Also, when closed, iPhone Duo is smaller than the other iPhone models, even though it is thicker. (But even folded, it is still thinner than the original iPhone!) I still miss iPhone mini, but am not convinced that I would like to pay three times as much to get that form factor back.
Overall, iPhone Duo is intriguing and I will definitely head to an Apple Store to see and hold one. I wasn’t planning to upgrade my phone this year, anyway (my iPhone 15 Pro is good for another year) but I will start watching the real-world experiences with the foldable and maybe start to put some funds on the side for next year.
We also got the release date for macOS 27 Golden Gate, iOS 27 and all the other 27 upgrades: September 14, which is… checks notes… next Monday! Are you ready?
Sponsorships available!
There is one opening left for sponsoring this year. If you are interested, please reply to get in touch.
Historically, you could copy the login keychain file from one Mac to another and be able to open it on the destination Mac by providing the password to that keychain. As of macOS Tahoe, this does not appear to work for Macs which use Secure Enclave.
can be used to diagnose the cause of almost any problem caused by third-party software, and may make some tasks such as obtaining and installing macOS software updates possible, when they fail in normal user mode.
Because these patterns can’t be standardized, full compatibility isn’t feasible. We have decided not to move forward with this feature. We apologize for the inconvenience.
This is one more sad step away from accessible, personal automation.
Sam and Joe discuss being short-staffed while covering client onboarding and ticket work, and how client relationships shift when a different technician becomes the main contact.
we speak with Sutherland about loyalty points theft— how it happens, what companies are doing to protect customers, and what people can do to stay safe.
So fast that most installs never get reviewed until after they have consequences.
Workbrew closes that gap: instant visibility, zero-touch deployment via MDM, built-in user support, and fleet-wide default packages. All with SOC 2 and ISO 27001 compliance.
This week marks the first turnover of an Apple CEO in over 15 years. Tim Cook “retires” to the board of directors, while John Ternus takes over as the new CEO.
Ternus has been at Apple since 2001 and a vice president since 2013. He has worked with Cook and the other leaders at Apple for a long time. No-one expects radical changes. Even so, several other leadership roles have changed this year. The Apple story will certainly remain interesting.
The beta phase for the 27 system updates continued with weekly updates, we are now at the eighth beta. Somewhat of a surprise, Apple also announced a new Mac mini and Mac Studio models, with M6 and M5 Pro, Max, and Ultra chips. This updates are not insignificant, as are the price increases, so it comes as a surprise that Apple would announce them without an event of their own.
The event next week will likely focus on the iPhone and its satellite plarforms. This is now tradition for the September event.
The new Macs will start shipping on September 22 and require macOS 27 Golden Gate. So, if you were wondering when the 27 updates would be released, that would be the last date. From previous release cycles, we can expect a release candidate next week around the event and full release in the week after.
Hope you are prepared!
Looking for Sponsor!
There is one opening left for sponsoring this news summary this year. If you are interested, please reply to get in touch.
Ternus has inherited that Apple. Regardless of how much he gives off the vibe of a cool Californian […] who just cares about the best stuff, he is also selling ad space and making sure more people upgrade to Apple One.
Congrats to Tim Cook on his 15-year anniversary as CEO of Apple! Here are some balloons and a gift card to the Olive Garden. There will be cake in the break room.
Reflecting on my time as a Mac Admins Slack admin, I look back on community stewardship, the challenges of AI and data scraping, and why human conversations remain the heart of the community.
macOS 27: Final release to support Rosetta — Intel-only apps will no longer run on Mac computers with Apple silicon after this update.
Not really news when you have been reading this or other Mac management related news. But, this official notice from Apple might be good to have around when talking with developers who are dragging their feet.
At the same time as the release of Golden Gate, we should get Tahoe 26.7 and Sequoia 15.8, but it looks increasingly likely that the final version of Sonoma has been 14.8.9, released on 6 August.
we’ll first highlight examples of attackers abusing dylibs for persistence, payloads, and even exploits. Then, we’ll show how we can programmatically enumerate dylibs statically on disk, at runtime in a remote process, and as they are being loaded.
From the arm64 sample we documented the on-disk characteristics of the Mach-O, the LaunchAgent persistence chain, and the collection target map, with observed and inferred paths distinguished.
In late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years.
finding problems worth solving isn’t separate from the rest of the job. It comes from staying engaged with people’s work long enough to see what no single request can show you.
For many organisations, their current macOS provisioning process doesn't make the user MDM-enabled. Here's an example of how you can activate that for your already enrolled devices.
I manage an environment where all computers are shared, and none of the users have a local account (we are still AD-bound). In this situation, managing macOS updates is very tricky.
swiftpkg works with your existing munkipkg projects, and the command-line tool has the same core feature set that munkipkg has, so you should be able to switch tools easily.
uses the Jamf Pro API to take a list of Jamf Pro computer IDs from a plaintext file, retrieve the associated Macs’ Recovery Lock passwords (if one is set) and generate a report in TSV format.
If you spent part of last weekend fielding Slack messages about hdiutil, you're not alone. Jeff Johnson's lapcatsoftware.com blog flagged that the man page for hdiutil in the macOS 27 Golden Gate beta now carries a deprecation notice
Deploying an application is only half the battle. If macOS continues opening files and links with the wrong application, users still experience friction—and your deployment may not achieve the behavior you intended.
how to reset an Apple AirTag by inserting and removing the battery five times until a different sound plays, noting newer AirTags may require pressing down. They share issues seen on iOS 27 and macOS betas
Security updates for iOS, macOS, and visionOS, with more in beta. Also 27 beta 5 and beta 6 releases,.
Sponsor
Manual patching is slow, inconsistent, and leaves security gaps. Alectrona Patch automates updates for 800+ Mac applications, so every device stays protected with the latest security fixes—without interrupting your users. Trusted by security teams and IT administrators alike, Alectrona Patch helps you:
Reduce time to patch critical applications
Reduce end-user support tickets with clear, customizable guidance
Deliver silent, automated updates
Keep users both secure and productive
Spend less time patching. Spend more time securing your environment. Start your free trial at alectrona.com/patch
All Summer Long
The fifth and sixth betas for the 27 platforms came out with just a week between them. It has actually been quite common for Apple to switch to weekly beta release some time in August, so this is progressing normally.
There is a notion that now is too late for providing feedback to Apple, since the chance is low for a fix or change to be included in the .0 release in September. While it is true that the likelihood is greatest early in the beta phase, getting something fixed or adjusted now is not impossible, when Apple deems it important enough. Also, there will be later updates, the .1 update usually arrives about six weeks after the .0 in late October or early November and the .2 release in December. These updates will have improvements for your feedback, but only if you tell Apple about your problems.
So, keep testing those betas and creating the feedback. Also, document issues you might find. If Apple doesn't fix and we can’t solve them, we can at least document them and warn users when 27.0 inevitably drops in September.
Before Richard Glaser was a Solutions Architect, he was a math major working the library's computer lab by day, and living a whole other life by night: playing guitar in punk and alternative bands,
Here’s where I’m coming from, where I’ve seen the personal programming world evolve, and where I see AI development taking us with the kinds of apps and systems we use on our Apple devices today.
Agent assisted coding satisfies the need to build very customized workflows for your personal needs. As Adam recounts in this article, there have been several solutions in this regard over the past few decades, some of which were quite successful, but all seem to have fallen by the wayside for some reason or other.
I don’t want to dismiss the desire to build your own custom solutions and workflows, but I feel sad that the “magic wand” here is based on something so riddled with ethical, economical and social concerns. What could we have had, if Apple continued to improve Hypercard or AppleScript over the last two or three decades? What could be, if Apple or another company had invested a fraction of the investment of AI development into personal, simple automation?
Apple has just released a security update to macOS Tahoe, bringing it to version 26.6.2. There don’t appear to any matching security updates to Sequoia or Sonoma, though.
Apple has released security updates for more than two dozen security vulnerabilities across iPhone, iPad, and macOS Tahoe,including yetanother image parsing vulnerability that could compromise your device.
Every fall, Apple’s newest operating systems arrive everywhere at once. That’s great for users, but it puts IT teams on the clock: they need to validate the release, find blockers, prepare their support teams, and decide when the business is ready to move.
Apple's Threat Notifications signal mercenary spyware targeting; learn verification steps, response actions, and layered mobile security defenses for high-risk users.
Jamf Threat Labs discovers and investigates AmnesiaStealer, a multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page that captures the login password, reaches for macOS bypasses Apple has already patched, and can hand the operator live, hidden control of the victim's Chromium browser to steal authenticated sessions.
For MacAdmins, the Dock has always been a deceptively small thing with a big operational footprint. It is the first place many users look for the tools they need, and it is one of the first places they notice when a Mac does not feel ready for work.
Activation Predicates are a powerful way of controlling which devices in your fleet are applied with which controls, without having to create and maintain endless blueprints and scoping groups.
Historically, Adobe has not always aligned cleanly with Apple’s preferred installation and removal workflows, so MacAdmins have often had to adapt their processes around Adobe’s packaging, licensing, and uninstall behavior.
if a device is added or deleted while you’re fetching pages, rows can shift across the offset boundary, potentially causing a record to be skipped entirely or to show up twice across two different page requests.
a practical conversation on the 2026 macOS beta cycle: what’s actually working, what’s still rough, and what IT teams should be paying attention to as the fall release gets closer.
Summer goes on, but even though many of us seem to get a break, the IT world goes on. Apple released, right on the expected schedule, the 26.6 updates and the security notes show a record number of CVEs. Yet they released the first patch for macOS, a bit more than a week later.
That also means it is a bit more than a month before the release of macOS Golden Gate 27 and the other 27 platforms. There was no beta release this week, which is a bit out of schedule. Probably next week. I am planning a lot more testing on my test devices and if that goes well, it might be time to upgrade my production Mac.
Apple also reported their third quarter results — guess what, they are record setting — and hit the five trillion dollar market cap. They are anticipating “headwinds” in the quarter to come. The various tech supply constraints are also affecting Apple and possibly the roll-out of new devices in the Fall.
The Mac Admins community unexpectedly lost a valued member of the community earlier in July with Dave Shepp. A page has been set up to support the family he left behind.
This is the fourth Summer Camp issue. Next issue is in two weeks, August 21. MacAdmins.news will remain on a two-weekly schedule until September 4.
People buy Apple’s products because they are nice and work well and are not lousy in a lot of ways the cheaper competition is. Apple’s revenue-grubbing approach to the user experience in its products and services threatens to erode the Apple brand, and once lost, it can be hard to recover. No amount of incremental revenue from lousy ads and nagging upsells can counteract long-term brand damage.
Using AI to generate a customer service response that replaces a human worker is not the same as using AI to write a config profile. Using AI to approximate a working illustrator’s style without their consent is not the same as using AI to help debug infrastructure.
We can slowly start to change this by fostering a culture where asking questions is a sign of intelligence, and those just starting out know it's okay to not have all the answers.
We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic directly from the device, which exposes the user’s real network.
a macOS campaign using a fake Zoom installer to deploy Overlord RAT. Built with .NET, this cross-platform technique simultaneously targets Windows, joining Go- and Rust-based cross-platform malware.
A vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges.
This is post authentication, the target Mac must have Screen Sharing or Remote Management enabled, the option "VNC viewers may control screen with password" must be configured, and the attacker must know that VNC password.
Most everyday problems with LaunchServices should be fixed using the GUI. For those that can’t, two command tools, lsregister and lsappinfo, are available to help.
Okta Device Trust issues a certificate to enrolled devices to prove they’re managed by your MDM. That same certificate can authenticate the device to a Meraki wireless network over 802.1X, giving you certificate-based Wi-Fi with no RADIUS server to stand up and no per-device licensing to buy.
Declarative Device Management and the MDM workflow still define the required macOS version, the deadline, and the enforcement behavior; DDM OS Reminder turns that deadline into a visible, scheduled user reminder.
provides a focused workflow to discover Intel-only executable components before deployment, then generate clear remediation feedback for application developers and support teams.
This guide explains how to enable and configure passkeys in Microsoft Entra ID, then register passkeys using Microsoft Authenticator or iCloud Keychain.
When removing a computer from Jamf Pro, you also need to manually remove it from Jamf Protect. Because this isn’t automated, the two platforms can easily get out of sync
Luke Wescott from Sublime Security joins the show to discuss the recent surge in callback phishing attacks abusing auto notifications, verifications, alerts, receipts, and more.
26.6 RC. 27 public beta, as well as fourth dev beta
Sponsor
Manual patching is slow, inconsistent, and leaves security gaps. Alectrona Patch automates updates for 800+ Mac applications, so every device stays protected with the latest security fixes—without interrupting your users.
Trusted by security teams and IT administrators alike, Alectrona Patch helps you:
- Reduce time to patch critical applications - Reduce end-user support tickets with clear, customizable guidance - Deliver silent, automated updates - Keep users both secure and productive
Spend less time patching. Spend more time securing your environment. Start your free trial at alectrona.com/patch.
In the Summertime
26.6 went RC this week, so a release is likely early next week. This is also very probably the last significant update to 26.
Apple also released public betas for the 27 platforms. So, if you have super enthusitastic users, you are likely to encounter devices with those betas, but you surely have been using the five week head start to have tested before them, right?
This is the third Summer Camp issue. Next issue is in two weeks, August 7. MacAdmins.news will remain on a two-weekly schedule until September 4.
macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the com.apple.macl protection that has always guarded sandboxed apps’ Data folders to a hand-picked set of non-sandboxed apps’ Application Support folders too.
a new modular macOS stealer that is likely distributed via ClickFix pages and relies on compromised WordPress domains and Telegram infrastructure, with a strong focus on Europe where more than 50% of identified victims are located. It is also worth noting that the current malware doesn’t even need any elevated privileges or rely on exploits for the successful execution.
CrashStealer, a C++ macOS infostealer that impersonates Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets and keychain data, encrypting stolen files with AES-GCM before exfiltrating them to a remote command-and-control server.
Apple is urging users to treat any suspicious FaceTime call or message as untrusted, especially if it involves payments, refunds, password resets, or requests for personal information.
The Apple Watch, at least with data that’s stored in the Health app, is the only popular fitness wearable that supports end-to-end encryption, and it’s enabled by default for all users (you are required to have two-factor authentication enabled as well, but that is also on by default for most accounts). However, Apple Watch owners should remember that this protection is only for data stored in the Apple Health app.
Apple says it has fixed a vulnerability in its Hide My Email feature which let essentially anyone figure out a user’s real email address which was supposed to be protected by the feature.
Installomator is very good at downloading, verifying, and installing Mac apps, but one uncomfortable problem remains: what if the app is open while you are trying to update it?
When creating a custom role, you can base it on an existing role and add extra permissions on top. That gave me an idea: check whether starting from an existing role plus a small tweak would get me what I needed, instead of building something from scratch.
This script isn’t intended to tell you what should be deleted. It’s intended to help answer a simpler question: do I understand every API client that currently has access to my Jamf environment?
Anna Brading, editor-in-chief of Malwarebytes Labs and director of content and, perhaps most importantly, mother of three. With a long career in cybersecurity—and an equally long time spent reading, writing, and assigning some of the cybersecurity world’s most pressing headlines—Brading has a unique perspective on what is most dangerous to her children online.
Summer and the heat seem to have much of the Northen Hemisphere in a firm grip. But this doesn’t seem to slow down Apple or the Mac Admin community. Security updates and beta releases for both 26.6 and 27.0, as well as Creator Studio app updates from Apple, and lots of tool and app updates from the Mac Admin community.
Doug Brooks, senior product manager of Apple silicon, discussed how Apple's long-term investments in neural processing, unified memory, power-efficient computing, and hardware-software integration have positioned its devices for the AI era.
With more heatwaves expected across Europe and North America, this summer is already proving a challenge for those who can’t use their Macs in rooms that have effective air conditioning.
I do not try to build the entire deployment in one sitting. That usually leads to troubleshooting three different problems at the same time. Instead, I build the workflow in layers.
Before it reaches production, I want to understand what it’s installing, how Jamf is going to deliver it, what other configuration the application depends on, and how I’ll verify that everything worked after the policy runs.
a step-by-step guide to configuring Okta Platform Single Sign-On (SSO) with simplified setup on macOS using Jamf Pro, including certificate management and device access integration.
Since the release of Jamf Setup Manager, it's not been possible to install App Store Applications through VPP whilst running Setup Manager....until now!
Third Party Patcher (TPP) is a macOS MDM agnostic, MDM managed, daemon-based patching and software distribution system for IT administrators. It automatically discovers installed third-party applications, checks for available updates, downloads installers in the background, and applies them.
early impressions of iOS 27 on an iPhone 15 Pro Max and interest in Siri AI on newer iPhone hardware, plus Apple’s macOS 27 compatibility list ending Intel support while continuing support for 2020 M1 Macs, which they estimate could extend security updates to roughly 2029.
we speak with Dubal—professor of law at the UC Irvine School of Law—about how algorithmic wage discrimination works, what data it consumes to function, and the threat it poses as it creeps from gig work into many more industries.
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision.
Summer has arrived with force with a massive heatwave in western Europe. But you can also tell that summer is here by a general “slowing down” of news. To compensate—and to give me a bit of a break—MacAdmins.news will switch to “Summer Camp” issues every two weeks (or fortnightly).
Next issue will be July 10. MacAdmins.news will resume the normal, weekly schedule on September 4, just in time for the big 27 platform upgrades.
Hope you get some break of the summer, too!
Sidenote: there are a few sponsor slots open for the rest of the year. Let me know if you or your org are interested!
Nice table showing the price comparisons from Stephen Hackett, 512 Pixels.
I understand that the overall component price increases kinda forced Apple into this. If anyone could afford lower profit margins, it would be Apple, but… well…
Still, the MacBook Neo price increase feels like a betrayal, as it was only introduced a few months ago and its price point was kind of its most relevant “feature.” The new price point is still competitive, since everyone else in the industry is also dealing with the shortages. Nevertheless, You would have thought Apple could have avoided this pricing see-saw.
I guess that Apple believed until just recently that they would be able to weather out the shortages and price increases, but now felt pressure to act quickly to maintain their profit margin.
Some time pressure probably stems from Apple’s standard yearly schedule. They may not want price increases to overshadow the new iPhone and iOS 27 releases with Siri AI in September. Price increases now, will make higher prices later this year “expected.”
Now the second developer beta-release of Golden Gate is available, Apple’s release notes are giving further details of features that are being deprecated or removed.
The attack exploits a fundamental flaw in how macOS XPC services establish trust boundaries by chaining CDHash kernel cache exploitation with NIB payload injection to impersonate trusted application components. Consequently, any non-root user can invoke arbitrary privileged XPC methods with zero authentication.
Not really a fundamental flaw, as macOS provides APIs to verify the app for these kinds of injections, but still important that developer actually use the verifications.
a Rust macOS implant that embeds a 3.5 KB prompt-injection payload of 38 fabricated “system” messages, built to steer an LLM-assisted triage pipeline into aborting or refusing its analysis.
With much of Europe wilting in the heat this week, it’s time to remind ourselves of the warning signs that our Macs are getting too hot. As Macs don’t sweat in the heat as we do, it’s also vital to understand what we can do to help cool them down.
The hosts discuss Jerry installing iOS 27 beta on an iPhone 15 Pro Max and watch, reporting strong stability, snappy performance, and minor reported edge-case crashes, while noting Siri AI requires newer hardware due to RAM constraints and that others find the new Siri improved.
When end users are requesting new tools that will lead them to the promised lands, how can we as IT teams ensure that the tools are actually what they say they are, and how can we measure their risk in our environments?
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision.
I haven’t had much time to process the news from WWDC and neither been able to really experiment with the betas yet. Main reason is that I was at Jamf Nation Live in London earlier this week. We got to show some cool enrollment workflows with Setup Manager, Platform SSO, and Setup Checklist.
Thanks to all who came with questions or comments or just to say “hi!” It was great to see you all!
I will also be at Jamf Nation Live in Berlin next week. Registration is still open. It’d be great to see you there!
The moment it stops feeling like work is the moment you have outsourced not just the synthesis but the judgment. The friction is the difference between actual productivity and abdication.
As part of the release of Jamf Pro 11.29.0, the ability to run software updates using DDM is available for folks using on-premise installations of Jamf Pro.
If your fleet runs any Intel-only Mac apps, find them now.
This is a good article, but there are more ways to determine Intel only apps and binaries, which I posted a while back, but—sadly—that issue has been lost with the provider switch, so I will repeat them here:
Replace the ._name at the end with .path to get the path to the app instead of the name.
However, command line tools, i.e. binaries that are not apps, can also be Intel-only. These are a bit harder to track down, as they could be installed pretty much anywhere. You can use find to look through a specific folder:
Mac admins are often asked to remove software that was originally deployed by a vendor .pkg or .mpkg, and the uncomfortable answer is usually: “It depends what the installer put on disk.”
The use of the Suspicious Package command line tool here is intriguing. I am wondering why they assemble instructions for an LLM to build the final script, rather than just assembling a script from template pieces?
you can run iructl directly on your Mac to interface with your Iru tenant. Pull down current state, create new resources, push changes, review sync status: all from the command line.
I’ve been tinkering with Apple’s container tool on and off since it was first announced a year ago and with the new features in the 1.0 release, I ended up building a GUI frontend for it and it’s called ContainerManager.
David Starr (Workbrew) hosted Selina Ali, Kitzy, Arek Dreyer, and myself to discuss the device management news from WWDC. (YouTube) We had a lot of fun discussing the news and I really enjoyed the perspectives and opinions of my co-panelists. Thanks a lot for having me!
we learned a lot about the 2027 series of releases from Apple. We’ve been testing and exploring since the events of the Keynote, and here’s everything we’ve got so far…
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision. Check our website for more details!
WWDC previews Apple next major platform updates
In the Keynote, Apple, somewhat surprisingly, backtracked quite a few unpopular user interface choices. They also promised a year of general improvements, big and small. Then they introduced (again) the new Siri AI.
Overall, the keynote felt a less exuberant than keynotes past, which I consider a good thing. Apple's platforms and services have generally reached a level of maturity and sophistication that announcing new superlatives each year seemed quite unserious. I prefer Apple refining and improving existing features. Even so, there are lot of new things in the announcements that will easily take users and admins the next few months to learn and explore.
Apple also released the "What's new in managing Apple devices" session, the most important sessions for Mac Admins. If you haven't seen it yet, go on, watch it now. The rest will make more sense after you have seen it.
(Sidenote: Cyrus Daboo does a great job and I want to hear more device management news narrated by him.)
The session re-iterates that Declarative Device Management (DDM) is now the standard for Apple device management, a strong signal for device management service developers. If your solution is not yet all on board for DDM, it is high time to start looking for alternatives.
Apple announced that organizations will be able to purchase and deploy volume subscriptions for apps! DDM mechanisms to manage and deploy apps are coming from iOS to macOS. Platform SSO is getting improvements.
Not only do these improvement fix some real pain points, some of which have been around for a long time, but they also show Apple's commitment to device management and that the Enterprise team is receptive to feedback.
This year's beta phase and roll-out should be very interesting. Test early, provide lots of feedback.
This year's announcements at WWDC26 carry more operational weight than most. OS 27 offers a structural shift in how Apple devices are configured, secured and managed.
However, as now happens regularly, building a Golden Gate VM isn’t so easy in Tahoe, and is likely to fail without some magic components that we’re not provided with.
There's been some talk about building macOS 27 virtual machines on a macOS 26 host. The solutions so far include creating a macOS 26.5.1 vm and upgrading it or creating the VM image on a macOS 27 host and then moving it to a 26 host. I guess this will be sorted out in future beta releases.
Apple is trying to give the impression that it did all this extra work to meet the DMA’s requirements, and yet the EC rejected its proposals, so it’s their fault Siri AI isn’t shipping in the EU.
It will obviously take some time for vendors to implement all of the new features, but it’s exciting to see Apple “raise the floor“ of what’s possible across the platform.
Apple has carried through on this and announced publicly that legacy software update management no longer functions in all Apple 27.0 operating systems.
iOS 27 introduces a new device recovery mode. This is a Mac-like recovery feature where the iPhone is able to boot into an alternative UI that doesn’t involve loading the entirety of the main operating system.
The MacAdmins community holds a vast amount of information and resources, however, due to the sheer volume and the fact that there is so much spread around the web, it can become quite intimidating, especially for newbies.
One of the customization options called out in the release notes for Self Service+ 2.23.0 is whether or not the Self Service+ menubar icon is visible in the menubar.
Notifications for Jamf's Self Service+ application were only managed for devices enrolled after Jamf Pro 11.18, or via a custom profile. Jamf Pro 11.28.x version fixes this across your fleet
I thought the animated sequence was pretty delightful, so I captured four of my favourite frames, upscaled them, and posted them here for everyone to enjoy.
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision. Check our website for more details!
Last Friday before WWDC
Against all expectations, this week had no major Apple announcements, unless you count some nice WWDC wallpapers and the winners of the 2026 Apple Design Awards. The tag lines for the WWDC announcements contain wordplays on "bright" and "glow," which does make one wonder if these are hints on more user interface changes (I don't dare say "improvements") or some thing else entirely?
a cluster of Go binaries with a shared deployment identifier and a C2 domain whose naming overlaps with a malware family researchers have been tracking. The samples call themselves "SStar agent"
the apps you open are only the visible layer. Beneath them is a second, larger world of embedded Intel code: audio plug-ins, printer drivers, video effects, screen savers, browser plug-ins and background helpers that nobody double-clicks and nobody audits.
We really should set aside an hour each month to explore lesser-known features in macOS. In today’s exploration I bring you Get Info’s sibling Inspector, exact duplication, a free slideshow, and an Easter Egg.
Unlike most of the other items in Privacy & Security settings, Location Services aren’t managed using TCC and tccutil, but by their own service locationd.
Jamf Setup Checklist is a great tool for getting your users ready to go from the moment they're logged in, however sometimes organisations need to populate Jamf Pro inventory fields to ensure device configuration is complete. This post covers an example of how to do just that.
The hosts discuss Apple TV shows they were late to, including The Morning Show and For All Mankind, and talk about Hail Mary Project, comparing the film’s “E.T.-esque” choices to Andy Weir’s book.
We all have a brand, whether it’s literally a company that we own or a company we represent, or figuratively as one we put out in the world. And if you’re like me, someone who hasn’t put much thought into what having a brand means, and why you should care about protecting it – this episode is for you.
we speak with Reitman—who is also the president and a co-founder of the Freedom of the Press Foundation—about the real stories of those who have been financially censored, why financial companies cut off customers for legal speech, and how a single company’s decision can create cascading consequences that feel impossible to fight.
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision.
WWDC starts a week from Monday. Apple traditionally releases products and news they could not or did not want to show in the Keynote the week before, so next week might be interesting. Even a lack of such releases would be of note. Will Apple release the much anticipated M5 versions of the Mac mini and Mac Studio, or is even Apple's legendary supply chain challenged by the industry's parts constraints?
I want to approach LLMs from the perspective of the community we share, as people involved in technology.
There is "usefulness" in LLMs as tools, but I remain reluctant to embrace them in their current state while the companies that build and endorse them, demonstrate a continued disregard for the ethical, environmental, societal, educational, and economical consequences. This post does an excellent deep dive into the effects of LLM use on tech communities.
A Mac Admin's recap of NIST's mSCP Mac Admins Day 2026: the 2.0 launch timeline, what changed under the hood, new community tools, and what you need to review before June 23.
ClickFix is a social-engineering technique, […] in which a malicious web page presents a fake verification or support prompt […], silently copies an obfuscated shell command to the victim's clipboard, and instructs the victim to paste it into the Windows Run dialog or macOS Terminal. The victim runs the command themselves; no software vulnerability is exploited.
Vulnerability management is the broader discipline of finding, prioritizing, and remediating risk across your environment. Patch management is the operational practice of deploying software updates. Patching is one remediation option that comes out of vulnerability management. It is not the same thing.
How many external monitors can your Mac actually drive? Pick your exact Apple Silicon Mac — we'll show the maximum external display count, per-port resolution and refresh caps, valid configurations, and the gotchas that burn people.
for auditing purposes, it’s useful to know which API clients are using which API roles as API roles determine the permissions that the API clients have.
But looking back on me as a kid just starting out, I really had no idea what I was doing, so if I were able to build a time machine today there are eight things I would tell a younger version of myself.
This is great advice for learning in general. It is application, even if you are just planning to learn some shell scripting on the side.
Most teams don’t. brew is already installed on developer Macs. The challenge is visibility: what packages are installed, which versions are running, and where vulnerabilities exist.
Workbrew Free gives you a complete real-time inventory of Homebrew across your fleet. Deploy through any MDM and within minutes you can see every package, dependency, and CVE with zero disruption to developers or existing workflows.
Like a young child coming home from kindergarten with their latest crayon scrawls, the internet is currently awash with people sharing their AI-generated work. And just like the young child’s drawings, much of that work should be proudly put up on the walls within the artist’s house—and no further.
What is worth examining is what happens when this wave reaches software operating at a deeper level of a user's system. Free, open-source Mac utilities are appearing on GitHub many positioning themselves as a CleanMyMac alternative or as replacements for other established Mac tools.
MacAD.UK gave me a lot of firsts: my first visit to Brighton, my first professional conference talk, my first experience working so closely with a mentor on a presentation, and a reminder of how open and supportive the Mac Admins community can be. I met wonderful people, had great conversations, and left with the strong feeling that I would love to come back.
Apple today previewed a suite of accessibility updates that use Apple Intelligence to bring new capabilities to features users rely on every day, including VoiceOver, Magnifier, Voice Control, and Accessibility Reader.
Until macOS 26.4, Archive Utility had nearly unrestricted filesystem access. Combined with a drag-and-drop sandbox quirk, this let an attacker bypass App Sandbox data containers, Transparency, Consent, and Control (TCC) protections, and hijack third-party apps
Offering a supported managed migration may help ease some friction with users who have still not moved from Intel-based Macs to Macs with Apple silicon.
if your network is equipped with Mac(s) running the Apple Content Caching Service, this same content is downloaded one time from the Internet, and then shared from the local network storage.
If you point an AI coding agent at a vanilla MDM repo and prompt it to add a profile, you’ll get something back. It might even apply cleanly. It also might quietly overwrite an existing profile because it reused the identifier from the file it copied.
And Archiware have been great to entertain my feature requests and ideas for making P5 do what I wanted. Mostly extending the cli (and API) to help monitor the system with MunkiReport and a variety of shell scripts.
XCreds includes Xpsso, an innovative micro-service to enable Apple’s built-in Platform Single Sign-On (PSSO) to work with Identity Providers (IdP) that have not been extended to support cloud binding of Mac systems.
This episode is not that – it has many guests- who will introduce themselves, a hazy plotline, and was recorded with a stolen microphone, unofficially, guerilla style at the first ever MacAdmins Europe conference. Follow me throughout the day as I [Selina] accost victims- I mean guests- on the spot and ask questions about the conference, their perspectives, and what they’ve enjoyed most.
Adam Angst of TidBITS reflects on Apple’s 50 years through the lens of early tech idealism, arguing that what mattered most wasn’t Apple itself but the community around it, which was weakened by shifts like the end of Macworld keynotes, Apple’s vertical integration, and the decline of user groups and independent resellers.
Geoffrey Cain, author of Steve Jobs in Exile: The Untold Story of NeXT and the Remaking of an American Visionary. We talk about the book, how Steve became a leader at NeXT, and how the foundation that was built during this period led to Apple's enterprise success in 2026.
Clara Mansfeld, a historian working on digital communications at one of the institutions signed onto the open letter—the Foundation of Hamburg Memorials and Learning Centers Commemorating the Victims of Nazi Crimes.
🚨 Your workforce is saving time by connecting AI agents to email, file shares, and business workflows, with or without security's sign-off.
This free guide by Nudge Security breaks down the risks and gives you four practical steps to build visibility, enforce least privilege, and extend the controls you already have.
So this week I built a munki-pkg replacement app PKGBuilder. And next week I’ll have 3-4 other apps built too.
I do not want to curb Mat's enthusiasm and creativity in any way. I have always believed that creating a tool for a specific task is one of the best learning experiences, even (sometimes especially) when you are "re-inventing the wheel." Wielded properly, LLMs are a great tool to support and enhance learning. All the power to Mat X for solving problems, building useful tools, and sharing them.
Sharing your solutions can be another great step forward in learning and building experience. (Not to mention your resumé.) When your shared tool gets attention, you learn a lot about code maintenance and versioning, debugging, documentation, communication, and more. Building, using, and maintaining a tool for yourself is very different than doing so for a wider audience. Those are also important skills for a Mac Admin, not just for shared code.
But it does seem to me that we are replacing an "army of shell scripts" from various git repos with an army of Swift apps. That's not necessarily bad, but it's not really an improvement, either. You have even more tools to sift through when looking for solution. The app might be easier to use than a command line tool, but the code is harder to review and understand.
Mac Admins have to take responsibility for all code and tools they take from a repo, forum, website, or Slack message. Before deploying it to your fleet, you have to review and understand what it does and how it does it. There are no shortcuts. LLMs can be of great use to analyze and review any piece of code, but the built-in predisposition to please you and provide positive and confirming responses can lead to misleading results. The ultimate responsibility remains with you. The "AI" cannot and will not be responsible. You have to understand what you are deploying.
It's great and flattering when someone says "this is a popular tool from a well-known member of the MacAdmins community, so I can trust it." Even "well-known" admins make mistakes or their repo can be hi-jacked. Their tools may be tested for their particular use case, but it is surprisingly likely that your deployment reveals one or more unconsidered edge cases.
Most Mac Admins have more experience with shell scripts, so those are more understandable, readable, and easier to review than Swift code. Tools built with Swift get orders of magnitude less code contributions than shell scripts. Apps with a user interface are by necessity more complex than scripts or tools built for the command line. LLM generated code without refactoring and refinement, tends to be quite elaborate, redundant, and difficult to untangle.
It can be nice to have a drag and drop tool for a common task, but you don't really need to create a full-blown app to get that. You have always been able to simply add drag'n drop to a command line tool with an AppleScript applet, and Finder integration with a Quick Action.
Making certain tasks more accessible is a laudable goal. It lowers the barrier for people new to the job and community to achieve certain tasks. Automation saves time and errors for admins of every skill level. Building installer packages is a tedious and error prone task and we can certainly use more and improved tooling here.
But, understanding the structure of installation packages and how they work and how they can fail is also a crucial skill for people managing and deploying Macs. There are so many jagged and dangerous edge cases here, that automation cannot cover them all.
AutoPkg achieves great flexibility by providing the option to extend functionality with programmable processors. Installomator labels can contain custom logic. You need to learn and understand the simple use cases, so you can move on to tackle the difficult edge cases. You need to build experience, to be able to tell the difference.
I consider some other skills, like reading and editing XML plists (and knowing how to deal with binary plists or recognizing a legacy ASCII plist output and not trying to feed it into something that expects JSON) important, as well. Other knowledge, such as directory service architecture or MCX may seem useless, but is often useful when you dig further into the innards of macOS.
I am also wondering whether my perspective on these skills is skewed and biased by literally decades of experience and maybe, going forward, these new tools just might be able to abstract these things away, in a more user/admin friendly way.
Nevertheless, these "legacy" skills make me more effective when wielding an LLM. I know to formulate more precise prompts and recognize when the output is erroneous. I can tell the assistance of an LLM is more effective than in areas where I have less or no expertise, where I am "flying blind" and have to trust the output. It is generally accepted that LLMs are more effective when wielded by subject matter experts.
But how is the next generation supposed to build that expertise, when everything is automated, abstracted, and filtered through a chat bot? How will we be able to evaluate and pick the good and trustworthy tool, when we don't understand the code ourselves, but evaluate them using the same tools that built everything?
Again, this is no criticism of Mat's tools or creativity, nor the use of LLMs in general. But, as a community, we will have to figure out the generation and transfer of experience in this new era. I cannot pretend I have good answers or, honestly, any answers. I am afraid we are way past the point where we can outright reject LLMs and work generated with LLMs, despite the massive concerns regarding their ecological, ethical, economical, educational, and social impact. But the issues need to be identified, the questions have to be asked.
Ultimately, the Macalope would like to see Apple be a little less stodgy and a little more willing to experiment, even if it means failing from time to time. Is that too much to ask?
The anxiety is real and valid. But I've watched this movie before, and the ending is always the same: the tools change, the work evolves, and the people who adapt become more valuable than ever.
the sea change is coming regardless of whether it’s good, and that understanding what’s happening - clearly, without either catastrophizing or cheerleading - is the only way to navigate it.
One of the features included with macOS Tahoe 26.5.0 is a new option in the Energy preferences in System Settings for automatically starting a Mac when power is connected to it, either following a power failure or when the Mac is plugged in to power.
Starting today, end-to-end encrypted RCS messaging begins rolling out in beta for iPhone users running iOS 26.5 with supported carriers and Android users on the latest version of Google Messages.
This guide covers what the principle of least privilege means for device management, how to enforce it across macOS, Windows, and Linux, and how it maps to the compliance frameworks auditors care about.
This repository is designed to consolidate everything a Jamf Pro admin might need to configure Platform SSO with Microsoft Entra, and to migrate existing Macs.
This week we’re talking about Apple Business and all the changes that Apple’s made of late! We’re deep into the APIs and promises that exist in this critical platform.
Adam Engst (TidBITS) discusses a malware incident in a long-running public “Slack Bits” group where a bad actor impersonated Glenn Fleishman via a duplicate Slack display name, tricking him into downloading an info-stealer, prompting Engst to consider shutting down the 1,400-member community.
Conference season is fully upon us now. MacAD.UK and Mac Admins Europe were in the previous month, ACES, WWDC, MacDevOps and PSU MacAdmins are imminent. Mac Admins India Connect, JNUC, MacSysAdmin and Objective-by-the-Sea are a bit later this year.
🚨 In April, a compromised OAuth token resulted in a breach at Vercel. This is the reality facing security teams: 🥷 An infostealer hits a vendor in your SaaS ecosystem, the attacker works backwards from stolen access, and an old consent becomes the front door. 🚪
If you haven't made OAuth grant reviews a regular part of your on-going security program, you should.
Download Nudge Security’s OAuth & MCP Investigation Checklist to learn the repeatable way to uncover risky OAuth grants and MCP server connections.
If you haven't chosen the conference to go to or to present at yet, registration is still available for those later this year! (MacSysAdmin just opened registration.)
This is our sixth year doing the survey. Over the last few weeks, we took the temperature of about a hundred admins, half of whom report that they manage more than a thousand devices.
With six years of history, some interesting trends are emerging. There are some great gems in the full commentary, even though that is quite a wall of text to read through.
If you're on the fence, don't be. Everyone in this space started where you are, and I promise most of them are a lot nicer than your grumpy old IT boss.
Managed Brew Access closes that gap. It moves brew access management into Workbrew itself, so the Console state and the device state are describing the same thing.
deploying the managed preferences for Keynote, Numbers, and Pages will reduce confusion for users of these apps until such time that Apple figure out a way of organisations purchasing subscriptions for their app services.
If you want to restore just part of a snapshot, you can mount it as a volume in the Finder and copy the folders and files you need from there, as if it was a backup. This article considers how you can address a bigger problem, where your best choice is to return the whole of your Mac’s Data volume to how it was when a snapshot was made.
[I] didn’t consider minimum specifications for a usable VM. Given current interest in running a VM on a MacBook Neo, I thought it would be worth examining these afresh, from macOS Tahoe.
This article explains the differences between certificates and tokens in Apple ecosystems, including how each is used to secure communication, authenticate services, and manage access.
Everything is “AI” now, which means the word no longer tells you anything useful about how the system actually works. In software development, the shift isn’t happening in the models. The shift is in how we use them.
users could schedule the update for whenever made sense for them. 2am on a tuesday. lunchtime. tonight after work. they were in control of the timing. Apple handled the nudging.
The goal is to give you an in depth but approachable understanding of LLMs, how they work, and how they are trained. We will ignore some details, and provide simplified explanations where appropriate.
Jamf Icon Uploader is a utility that streamlines the bulk upload of icons to Jamf Pro, eliminating the tedious process of uploading them one at a time.
host Joe and guests discuss standards, policies, certification, and compliance with Michael Thomsen of Origin 84 in Sydney, continuing an ISO 27001 deep dive.
Velasquez about cybercrime’s impact on small businesses, the new threats being deployed because of AI, and what is necessary to protect business owners and their consumers.
Shadow AI is quietly accessing sensitive data across your SaaS environment. Learn how to close AI blind spots and get ahead of data exposure risks with this new guide.
Whether you're just starting to think about AI governance or looking to close gaps in your current approach, this guide gives you a clear, practical comparison of what works, what doesn't, and why.
The Mac Admins Europe team, led by Mischa van der Bent, with Rob Potvin, Jordy Thery, Anthony Darlow, and myself, put up a full day of amazing speakers, sponsors, and, most of all, the community. The host city Leiden, showed off with the most gorgeous sunshine.
Everyone, sponsors, speakers, and attendees, brought lots of enthusiasm and ideas. Many sessions had to start with a delay, because we had a hard time of herding everyone back in from all the socializing in the break area. It was a real community event.
We'd been talking about doing this for years, and we finally did it. Thank you to all who helped, sponsored, spoke, and attended.
It looks like this won't be the last time. No promises or details yet, but at the team's celebration/debrief breakfast this morning and the most used words were "next year…"
The Mac Admins Foundation is pleased to open applications for the 2026 Community and Conference Grant supporting attendance at the MacAdmins Conference at Penn State University.
An agent can translate a script from Python to Swift in fifteen minutes, a task that might take a human hours. On paper, that is a massive gain. But this speed creates a hidden tax. If you do not spend the time to refactor and document that code, you are just inheriting cognitive debt.
Kitzy wrote a response to Samuel's post. Dan Snelson published his updated AI Guiding Principles, which refers to Samuel's and my post. (Which the AI misinterpreted, twice.) I was asked about my thoughts on LLMs several times at Mac Admins Europe. (Likely provoked by me wearing a "rage against the machine learning" t-shirt.)
This discussion is very timely, valuable, and necessary. The concept and concerns around "cognitive debt" are fairly new. "AI burnout" describes a feeling many of us experience. I also believe the other impacts of this technology, and the behavior, choices, and marketing/hype of the venture capital infused AI industry raise significant ethical, social, economical, and ecological concerns, which are often left aside while focussing on the more immediate effects of how well the models may or may not perform. It is a complex, multi-layered challenge on so many levels.
As part of its engineering preparations for the switch to using Arm processors, Apple decided that the only practical way to support virtualisation on its new Mac hardware was to build it into macOS.
you've already solved the "how do devices get enrolled" problem. But there's a separate question worth asking: how do you know the device that enrolled is actually the device it claims to be?
every generation of Time Capsule actually runs NetBSD, and that it’s trivially easy to add support for Samba 4 and SMB3 authentication to your Time Capsule, thereby extending its life expectancy considerably?
Mac Devops YVR becomes MacDevOps YUL this year as the popular conference makes a move to a new city thanks to the World Cup. We’re here with conference founder Mat X to talk about what to expect, what’s on tap, and who should make the trek to Montreal
Shadow AI is quietly accessing sensitive data across your SaaS environment. Learn how to close AI blind spots and get ahead of data exposure risks with this new guide.
Whether you're just starting to think about AI governance or looking to close gaps in your current approach, this guide gives you a clear, practical comparison of what works, what doesn't, and why.
Apple is generally conservative and careful when it comes to these kinds of decisions, so none of this comes as a huge surprise. Tim Cook may be stepping back from the CEO role, but certainly not from Apple in general. John Ternus has been successfully running the hardware division and John Srouji the chip design and development and the general consensus is that those are where Apple is currently the strongest.
Will Srouji be able to continue that success to the wider hardware and will Ternus be able and willing to improve the parts of Apple that are struggling to get as much enthusiasm? We will have to see. I believe some change and new vision could be good for Apple.
The only report of its kind to focus specifically on the needs of people who are blind, DeafBlind, or who have low vision, the Apple Vision Accessibility Report Card provides valuable insights into the lived experiences and opinions of people who rely on VoiceOver, braille, and/or low vision accessibility features on Apple products.
the JNUC Diversity Sponsorship awards 10 individuals a full conference registration, a meet-and-greet with Jamf leaders, a networking happy hour and a $500 stipend to help cover expenses. We're looking for passionate people eager to learn and bring fresh perspectives to the tightest community in high tech.
We take something that makes sense to humans and rewrite it into something a tool can execute. That translation step has always been the real work, even if we’ve treated the abstraction itself as the hard part.
Apple has released a software update that deals with an issue that could allow deleted notifications to be retrieved. Something that, in at least one reported case, was used by law enforcement during forensic analysis.
Open source projects need honest feedback loops. They need users who are willing to say: here is what I am seeing, here is what is missing, here is why it matters. Without that, maintainers are left building against incomplete information. Your environment, your use case, your edge case, that is data they do not have until someone speaks up.
Xattrs are extensions to those that contain almost any other type of metadata, the first notable xattr coming in Mac OS X 10.5, named com.apple.quarantine.
The firmware on M4 and M5 Macs supports USB 3 speeds during DFU restores! This will make a huge difference for restoring multiple Mac systems at the same time.
I work in a space that loves reporting. If it can go on a chart, someone wants it. And while Jamf Pro can generate and email CSV reports based on searches, those reports rarely have the polish that makes leadership actually pay attention.
You need to capture (ingest) camera footage on a lot of different camera cards after a film shoot, and you need to do a lot of it, and copy it everywhere safely and securely. That takes a special kind of software.
A native macOS dashboard for Jamf Pro, Jamf Protect, and Jamf School. Browse your fleet, review security posture, inspect configuration and analytics, and export reports
Jamf have now opened the Public Beta of the Plaform API Gateway (1). This provides a new method of interacting with Jamf Pro Cloud instances, Jamf Protect, Jamf School, and Platform Services such as blueprints, compliance benchmarks, declaration services and more.
Starting as early as the next major OS release, Apple devices will refuse to connect to any device management service, Mobile Device Management (MDM) server, enrollment endpoint, or app distribution infrastructure that does not meet tightened TLS standards.
Ulrik Aabye-Hansen has made a career by teaching people in the Mac Admins Community, and his conference talks are both education and culture. This week, we’re talking with him about learning philosophy and how he approaches this critical topic, so we can all learn just a bit more from him as well.
DeLiema about who is really susceptible to financial fraud, why victims often describe a scam as a form of betrayal trauma, and why the companies best positioned to stop scam messages from reaching consumers may be the ones least motivated to do so.
The teams that respond fastest already do. They have a complete, real-time inventory of what's installed across their fleet, every device, every user, before an incident ever hits. That's what Workbrew Free gives you.
Get instant visibility across all your devices. When something goes wrong, you'll have answers in minutes, not hours of manual digging.
P.S. Heading to MacAD.UK? Come say hi at our Happy Hour
New Digs
This week we got the announced change or update from Apple Business Manager to just "Apple Business" with the management service formerly known as "Apple Business Essentials" now included worldwide. We got some first reviews and posts this week, but it will probably take a while for the community to fully explore the strengths and limitations of this new service.
We also got the 15.2 updates for Keynote, Numbers, and Pages, and the former, pre-Apple Creator Studio versions seem to be gone or at least hidden from the App Store. Apparently, you can now suppress the prompts to subscribe with a configuration profile on macOS! I have not been able to verify this yet, but if that is correct, many thanks to whomever at Apple who was listening.
We look forward to honoring Anthony’s contributions to a grateful community, and encourage all who can attend to do so, virtually or in Calgary.
Anthony is the editor of many of my books, which is quite the task, considering they are not written in my first language. He is also always so generous with advice and friendship.
📰 News and Opinion
Six Colors 2026 Apple Enterprise Report Card open for input: Form
Jason Snell is once again asking for the feedback of professionals managing Apple devices for their yearly report card. (2025 report) Anyone can provide their ratings. The detailed comments are optional and you can choose to remain anonymous.
With this upcoming increased volume of sales in the traditional computer market, i.e. not phones or tablets, and with these millions of users new to the Mac platform, what can this mean for MacOS and the ecosystem?
Apple is still extraordinarily good at making hardware I want to pick up and use, and still more coherent than most of the industry in the broad strokes, but it also feels increasingly prone to sanding off the wrong edges, reinventing the UX wheel, and constantly adding paper cuts to their software.
Apple’s app-vetting procedures are in the spotlight this week, as not one but two news stories demonstrate the grave consequences of what appears to be a troublingly lackadaisical approach at the Cupertino-based company.
After spending time with the latest Apple Business, my first reaction is that Apple is building a more complete business platform — one that brings identity, services, communications, support, storage, and payments closer together under a single administrative surface.
jamf-cli is a new, standalone, golang-based command-line tool developed by my colleagues Keaton Svoma and Neil Martin at Jamf. It provides convenient, abstracted access to the various Jamf APIs
One binary, multiple tools for Apple device config — profiles, DDM, Santa, PPPC, mSCP, osquery, BTM, notifications. Prepare them for MDM migration and GitOps work from the terminal, from CI, or via an AI agent.
The ACES conference enters its 12th year this spring with a May event in Minneapolis. Targeted at those people who manage Macs as consultants and at managed service providers, this year’s conference has a bunch of new events. Here to tell us all about it is conference founder and longtime Mac Admin Justin Esgar.
The hosts revisit early Apple and Mac experiences and discuss first keyboard shortcuts, focusing on “Command Control Power” after a photographer client referenced it while troubleshooting a MacBook Pro that died on location from a drained battery.
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision. Check our website for more details!
Moving Time x2
This should be the first regularly scheduled issue of MacAdmins.news on the new service. My apologies if this ended up in your spam folder or bypassed your meticulously configured mail filters. Unfortunately, the foundering of the previous service forced a quick move. So, update your filters to match the new sender (noreply@macadmins.news) and update the RSS feed in your readers.
Nevertheless, I am looking forward to using and exploring the new service (Ghost on MagicPages) and have some ideas on improving things going forward.
On top of that, we are also moving houses physically next week. Just as a warning that next week's issue might be delayed, too.
Jason Snell is once again asking for the feedback of professionals managing Apple devices for their yearly report card. (2025 report) Anyone can provide their ratings. The detailed comments are optional and you can choose to remain anonymous.
Capable browsers, and the PWAs they support, hold the power to grow an ecosystem of applications that no gatekeeper can own or tax, based on standardised APIs that resist enclosure. Apple goes to extreme lengths to prevent the emergence of browser engine choice to obstruct the app store's most credible disruptor.
'Bug fixes.' Though it looks like the updates fix some iCloud syncing issues. The enterprise release notes for macOS also mention fixing Wifi connection issues on the new MacBooks Pro with M5.
Apple, would it kill you to acknowledge what the bug affected in the release notes? Something like, “Fixes an issue where data synced by iCloud may not appear immediately.”
Jamf Threat Labs discovered a ClickFix-style macOS attack that abuses the applescript:// URL scheme to launch Script Editor and deliver an Atomic Stealer infostealer payload — bypassing Terminal entirely.
The script is a Jamf Self Service script that lets users automatically rename files that OneDrive for Mac is not syncing properly because of illegal characters.
iOS security is an important topic that we don’t talk about nearly enough. The current moment is driving a lot of people to understand it better, though!
The hosts celebrate Apple’s 50th anniversary (recorded April 1) and recommend David Pogue’s book “Apple at 50,” including his Computer History Museum interview.
Tom Bridge joins the show to talk about all of Apple's recent enterprise announcements, including enterprise email, ads in Apple Maps, and the new Apple Business program.
Peter Asaro, chair of the Campaign to Stop Killer Robots, about what a killer robot actually is, how close we are to seeing them deployed, and what some of the hidden consequences are to rolling out impossibly-quick, decision-making technology into a landscape where deescalation requires time, space, and human judgment.
This email should have gone out last week Friday, but the service I had been using for the last 100 (exactly) issues chose to not cooperate. There had been issues with their backend for weeks, and their support has not really been responsive, so I moved services. I haven't yet been able to salvage the back issues and don't know if I will be able to import them here if I do.
I understand the "tell me when you don't get this" doesn't work. I hope you receive this and it doesn't just end up in everybody's spam folders...
Let's hope this one lasts for more than 100 issues!
Apple celebrates 50 and all we get is 26.5 betas 😉
After helping thousands of organizations to migrate from other solutions to Mosyle, we've gained a unique perspective of all the concerns companies face when evaluating the migration of their Apple Management & Security solution. Based on this extensive knowledge, we've created the most comprehensive Migration Program in the Apple’s Management & Security market, addressing the most critical technical, financial, and strategic considerations involved in this pivotal decision. Check our website for more details!
50!
This week Apple marks their 50th anniverssary. Congratulations!
Last week also saw the discontinuation of the Mac Pro. The Mac Pro can trace its lineage all the way to the Macintosh Quadra 700. In the late 90s and early 2000s the PowerMac G3 and G4 sold into print and publishing and provided the "bread and butter" business that kept Apple afloat while the PowerBook, iPod and Music business were picking up steam. With the PowerMac G5 Apple could briefly claim supercomputing power. Its iconic aluminum alloy enclosure would last for ten years, used for the Intel-transistion Developer Kit and the Mac Pro until the "paint yourself into a thermal corner" black cylindrical Mac Pro in 2013. Apple revived the tower design with lots of expansion slots in 2019 which lasted into the Apple silicon age.
Along the way, Apple has attempted to "improve" on the tower design mutliple times. The PowerMac G4 Cube had many of the same design choices that would later hamper the 2013 cylinder Mac Pro. Only with the Mac Studio, introduced in 2022 did Apple finally seem to figure out the balance of a compact desktop super computer. Apple silicon chips do not support additional graphic cards, which made the PCIe slots in the tower form factor far less useful. The remaining use cases for slot expansion can (mostly) be covered by external Thunderbolt devices. Apple hadn't bothered to update the single generation of Apple silicon Mac Pro with the M2 Ultra chip when they updated the Mac Studio with M3 Max/Ultra and later M4 Max chips. The writing has been on the wall.
There are probably some people still holding on to their 2019 Intel Mac Pros for some expansion card that is essential to their workflow who are disappointed. I don't want to invalidate their plight, but I assume Apple has run the numbers and decided they don't justify keeping the product line.
It is ironic that the news of the discontinuation of the Mac Pro hit the week of the 25th anniversary of Mac OS X, since back in 2001, you basically needed a PowerMac G4 to adequately run Mac OS X. It could run on a G3 chip, but only as the G4 chips moved into the PowerBook, and then iMac and iBook, lines did those become performant enough for the new operating system. I have written before on how much Mac OS X was a turning point in Apple's trajectory. The introduction of the iMac, PowerBook G3, iBook proved Apple could still design excellent and beautiful hardware. Mac OS X, which allowed to run productivity software like Microsoft Word, Adobe Photoshop and Final Cut, side by side with Unix tools and software, made it very useful for (web) developers, scientists and other professionals who had so far needed two separate computers. And you could do all this on a PowerBook (or later MacBook Pro) and get about three to four hours of battery life!
Nothing was perfect, obviously, but back then Apple continually confirmed its reputation as being the only tech company who would and could build good software and good hardware. With the iPod and the iTunes Music Store, they also showed that they could combine that hard-/software combination with online services. Apple struggled for while with iTools/.Mac/Mobile Me/iCloud but eventually figured that out, too. Then the iPhone dropped and... well... the rest is, as they say, history.
Not everything was perfect, of course, (see the PowerMac G4 Cube, PowerPC falling behind, the rough path of iTools/.Mac/Mobile Me) but from the acquisition of NextStep to the early/mid 2010s, Apple did have an attention to detail which often put a lot delight into the use of their products. Even when Apple zeroed in on aluminum and glass as their main materials, they rounded the edges and corners to make them feel good and friendly.
Apple used to be good at bulding software that makes simple things easy to do, and complex things possible. The iLife suite did a great job of providing the basic functionality for workflows that you used to have to get expensive professional software for, and making it accessible. With AppleScript (and scripting support in the apps), Automator, and Terminal, as well as pre-installed scripting languages, like Python, Ruby and Perl, Mac OS X/macOS provided a platform suitable for basic, as well as professional users. Since even the most professional in a field will also be a beginner in a different field, this combination works really well.
Now the user interface is hiding everything but the most basic functionality to "put the content front and center" and everything else is hidden and often needs to be revealed by inscrutable gestures. Workflow and automation tools are restricted and neglected.
When Apple introduced the iPad in 2010, Steve Jobs showing versions of Keynote, Pages and Numbers, optimized for the touch screen, proving that this was device for creation not just consumption. However, while current iPads have the same powerful chips as the MacBook Air, the creative software is still lacking. All that is available on iPad are reduced versions of the software. Shortcuts is the only automation solution. Apps can only come from the App Store.
The iPhone transformed Apple from a beleagured boutique tech company to a Tera-corp. Today, they are continually among the top companies globally. It has been an amazing success story.
The iPhone also unlocked the mobile internet, and with that came social media. While most of us enjoyed and initially embraced social media, now it should be clear that the companies are willing to poison our minds and societies for the sake of "engagement," merely to improve their profits. Despite their claim that the curated App Store is a requirement to protect users from harm, apps which allow generation of CSAM and other harmful and explicit content, remain on the App Store. Apps and social media that are used to spread hateful and dangerous speech remain, too. Tim Cook may claim he is "not a political," but tolerating the status quo supports the status quo, and is a political stance, too.
With several billions of profit and bash reserves, and their history and reputation of quality products and attention to detail, one would expect them to resist the "enshittification" prevalent to the tech industry. Despite astoundingly high profit margins, Apple still finds it necessary to sell and place ads in their App Stores and, soon, for Apple Maps. While they restrict what third party apps can track about their users, they track and use a lot of data for themselves. Their app guidelines forbid using notifications for advertising, but that is enforced only inconsistently and Apple regulary send notifications for their own promotions. They try upsell their subscriptions all over. All of this cheapens the platform.
Apple is defending their share of App Store revenues tooth and nail, against regulation efforts world wide. Scammy apps are so common, that there are regular reports, while you also see similarly regular reports of legit independent developers getting inconsistent rejections from App Store reviews, often threatening their livelihood. If Apple wants to be the curator of what software we can run on the devices we purchase from them, they must get much better at it.
For a large part of the last five decades, Apple has been on a wild roller coaster ride between amazing success and beleagured to the brink of extinction. Next year the iPhone will celebrate its twentieth anniversary. While nothing was certain about the iPhone for the first few years, all but one of the major phone manufacturers of 2007 are gone or irrelevant. Remember Blackberry? Only a handful of the major computer companies from thirty years ago remain.
Despite all my criticism, I still believe the Apple is the "least worst" choice among major tech companies. But I would very much like them to do better than that. Much better. I wish they put the attention to detail and quality that is still obvious in their hardware into the operating systems and software, as well as the services. I wish they found ways to "surprise and delight" again. I wish they remembered the strengths and purpose of each of their platforms and designed the software to use and enhance those, rather than try to make everything the same.
I wish Apple put their users at the center, not their profits. I don't know if it is possible for a company of that size to return to mindset of the scrappy underdog, but I would love to see them try just a little.
400!
This week also marks the 400th issue of this news summary. To be exact, it is the 400th email. Keeping track of those is easier. There were a handful of issues on the website only, before it was an email. The first website issue was published nearly exactly nine years ago.
Many thanks to all of you who are reading this. I am grateful that you find this interesting and worth your attention. Many thanks, also to the sponsors, who ensure that my time spent pays some of my bills, which is nice and necessary. But most of all, many thanks to all of those in the community who write posts, code, and solutions and otherwise share their experience, so that we all can learn from each other!
There are countless small, practical, mostly uncontroversial ways in which Apple could improve the App Store for developers, yet the App Store has changed relatively little in the 18 years since it was hastily cloned from the iTunes Music Store.
Good list for developers. For admins, Apple could finally provide a way to deploy and manage in-App Purchases and subscriptions for App Store apps at scale.
Apple widened its latest iOS 18 security update to cover far more iPhones and iPads, specifically to stop real‑world DarkSword attacks that can compromise a device from a single website visit.
The good news: As of Wednesday April 1, Apple is pushing out iOS 18.7.7 to all devices running iOS 18. This update, released last month for devices that were not capable of running iOS 26, is now available even for compatible devices.
In macOS 26.4, Apple added ClickFix protections. In this post, we reverse macOS to uncover exactly how these protections are implemented, and whether we can replicate the same approach in our own tools.
the IT professionals at the organizations in the above examples were not stupid, quite the contrary. We’ll be so much better off if we accept that everyone makes mistakes
Last week I encountered a macOS stealer sample (probably related to AMOS Stealer). A computer was delivered to me to analyze the impact, the source, and, in general aspects, where did this little sample come from.
Mole is a lightweight, command-line utility built specifically for macOS that gives you clear visibility and control over what’s consuming space—and what can be safely removed.
Instead of building everything from scratch, you’re working with a structured, JAMF-native workflow that lets you deploy a polished enrollment experience using just a package and a configuration profile.
It is rare that I see a dialog that has been around for a long time in macOS that I have never seen. It happened to me yesterday. And the dialog itself was confusing.
In this post, we’ll walk through how to integrate JAMF Pro with SendGrid to automatically send targeted email notifications based on Smart Group membership.
Joe and Jerry discuss Apple’s redesigned online store, noting that Mac configuration choices are now embedded in the URL, making it easier to share exact specs with clients.
Login
