#mac management

This is a common refrain from Iru/Kandji. They always talk about how much overhead there is to Jamf setups and one of the big sources, they point to, is Smart Groups.

"It’s realizing how much logic they’ve been carrying in their heads just to keep device scoping working."

Smart Groups are the overly burdensome thing that requires too much from an admin–basic boolean logic–well I guess complex when compared to Assignment Maps.

Let me rephrase the basic message in this post: you can get rid of Jamf a platform where you define your operations and come to Iru where we will define your IT operations for you.

If that sounds good, accepting how Iru thinks you should do things, then you might be a customer. I suspect that in most enterprise contexts with lots of Macs that is just not tenable given how rigid and uncustomizable Kandji and I assume Iru are.

"They’re just tired of maintaining it."

I just don't understand this sentence. I have run large scale Jamf environments and once you build your automations, and if you do it in a sustainable way, there isn't that much to maintain. This idea from Iru is an exaggeration, and/or comes from admins who don't know how to build sustainable automation. To be clear it is hard to build sustainable automation–if it wasn't then Kandji/Iru wouldn't have much to offer given the lack of feature depth they bring to the table.

Also I just need to poke this, but Kandji and I assume Iru have Assignment Maps that allow you to use logic to control scope. The difference is that Jamf has a deep set of attributes built-in and custom ones user create to use with the boolean logic. Kandji and I assume Iru have a simplistic conditional system with few options to choose from, and at least historically no automated way to have user defined attributes on which to scope.

The bottom line here is that Iru/Kandji sell you ease at the expense of features and at the expense of tailored solutions. These are not equal choices; there are very defined tradeoffs. Iru won't do what Jamf does, and may not do things how you would do them, but you are just stuck with it. Jamf doesn't give you a solution–just tools. However, if you know how to build, then you can build a tailored solution to your environment–with customization and flexibility from the start.

Just going to pick some bits that I want to comment on.

"Many a Jamf Nation believe that Kandji copies them. This year will be the other way around. A transition to where the services aren’t separate but indivisible. Abandoning customers that don’t a fit a specific profile or story. Whether that is on-prem, specific size, use case, etc."

I am sure this is the case. I am sure that they will be closing down on-prem, or at least announcing its end. This is a long time coming. I am sure they will do what Kandji has done–which is to pick a method and people can use it or not. To be fair Jamf shouldn't do this, but they will. This to me is all part of the tools can solve all problems mentality in technology today–which is only getting worse.

"AI: Jamf will show AI helping do work around areas that really should have better UX. AI isn’t a replacement for good UX. They will show it writing a smart group, but won’t actually fix the issues with Smart Groups that make them annoying to use. Things like you cannot re-order the criteria or insert an extra value. They will show “AI” in nearly every product. They will ignore that their AI right now is often telling people to do things that would break their deployments or buttons that don’t exist."

The classic issue for AI anything these days, and something obvious to say about Jamf and their "AI" efforts. I am sure the product will reek of it.

"While the rumors are flying that Vista wants out of Jamf. I doubt an announcement is formally made. I am on team Cisco acquisition and have spent the last near decade saying Jamf is basically Splunk but as different product. Same customers, largely same reasons. Wildcard on that is it sounds like Jamf is ending its partnership with Splunk as a shared customers."

What? Scratches head...what? How this came out as sentence I am not sure. Splunk and Jamf aren't really all that close. Splunk isn't a management tool in any sense of the term. Jamf is only loosely speaking an insights tool. Really its credibility comes from integrations more than anything it has natively–to my mind.

"Self Service+ will continue to take obligations from Recon that make running It with Connect required. I bet modernization will be locked behind SelfService+ with a security sku. Which is also very Kandji-esk."

This to me is the real yawn of this whole affair. I suspect that it's true, but I also suspect that it was inevitable given the de-techifcation of IT.

This kinda blows my mind. Why would you be deploying something where this is revelatory? Also why would you be triggering an install based on a link? To me this is just wild. Also this has been how Nessus has done things as long as I can remember. Obtaining the installer got more annoying, but my recollection is that it has always been this dumb design.

I looked at this and did a double take. Seven minutes is a really fast setup time. I then looked at the video and realized why. They install almost nothing. No Office no development tools basically nothing is actually installed. I didn’t even see a security tool. Maybe they are using Jamf Protect or something.

I always wonder where some of these numbers come from. The post says:

“Results speak: customers report a 25% reduction in IT burden and faster, better protection against malware all without complex setup.”

How did they arrive at this? Better protection than what? How does this make sense? Complexity is inherent to security. Anyone who says otherwise hasn’t done security. We can try to make it simple, but there is no avoiding that good security is hard and complex.

“Coming by late summer: more advanced detection capabilities solidifying Kandji’s lead.”

Lead over what? Who are they leading? They don’t lead in MDM market share. They don’t lead on EDR—what lead?

I hate these kind of posts so much. Please if you are a vendor don’t let your sales people write this stuff. Seriously, this damages your brand and makes your company look incompetent.

In case anyone had doubts that Jamf is dumping on prem at some point. Here is the proof. Another feature that could be available on prem but won’t be for the arbitrary reason of steering people off on prem.

This post asks the wrong question. The question isn’t do we always need extension attributes, but rather why do people think that it should be one size fits all? Kandji has an approach that works well in some cases. Jamf has an approach that works well in other cases. We then have plenty of overlap.

Jamf and Kandji in competition is a good thing for everyone. This is not a binary question. If Kandji wants to drastically expand, then they need to be more customizable like Jamf. If Jamf wants to eat into the low effort management market, then they need to be more like Kandji. Here is the real story: it’s already happening. Jamf and Kandji are becoming more similar every year. Just look at how both companies are growing their managed apps, or Jamf using blueprints in their Pro product. Look at the assignment maps in Kandji sort of like a weaker smart group.

So let’s put these stupid discussions to bed. Let’s be grateful for the competition and spend more time understanding what the right solution for a given need is and less time worrying about if some feature gives some product a global edge.

I have to say after watching about 80% of the presentations this was a mixed bag year for MacADUK. The content was not up to the standards I would have hoped for out of a professional conference. A lot of the presentations I was left scratching my head wondering why they needed to be presented. It had a bit of the feel of a conference that got insufficient submissions to be sufficiently selective.

However, to my mind the trend is a broader one in the Mac Admin conference scene. I have seen this with PSU MacAdmins and JNUC etc. The presentations get less and less technical, and the topics get more and more repetitive.

To give some examples from MacADUK:

Workbrew - this is an interesting product with some interesting applications, but the presentation felt like something a Sales Engineer would give. Not what I would have hoped for.

AI Adventures - I am not sure what the point of this presentation was, but it was a mess. I don't know what the adventure was, and I really am not sure what part of it was interesting or something I should care about.

Apple Silicon Virtualization - I feel like this has been done to death. Apple Silicon and virtualization is an oft discussed topic, and I was sad to see really nothing new added to the discussion.

Tokens - this was a bewildering meander through various tokens with some loose FileVault history. I am not sure what point was supposed to be taken away.

MacStadium AI - This is one of those presentations that would have been so much cooler as a technical presentation–rather than an overview.

Packaging - I feel like this is a topic that shows up at almost every Mac conference in some form. I just keep wondering when we will get a year without this same rehash?

Data Corruption - This was one of the strangest vendor presentations that tired to mix data corruption with product placement with I am not sure what. I honestly couldn't watch it all.

Vendor presentations as always: Jamf, Omnissa, OWC and AWS–may have been more. I tend to ignore these unless they are talking about something I am interested in.