Ops PlaybookDevice Management
A Safer Device Management Operating Model for Jamf Pro
Design, implement and safely recover a bounded Jamf Pro device management workflow with evidence, guardrails and measurable outcomes.
Tier L1 · 15 min setup
BACK TO THE OPS PLAYBOOK
KBY EDITORIALOPS PLAYBOOK
Isla Morgan
PRINCIPAL PLATFORM ENGINEER
Isla Morgan is the macOS Platform Engineering Editor for The Ops Playbook, specialising in the design and day-to-day operation of secure, scalable enterprise Mac fleets. She covers Apple Business Manager, Automated Device Enrolment, declarative device management, Jamf Pro, Microsoft Intune, Platform SSO, FileVault key escrow, application packaging, update enforcement and shell-based support automation. Drawing on practical endpoint engineering and service operations, Isla explains how to turn Apple platform capabilities into dependable workflows for deployment, identity, compliance, observability and recovery. Her guidance balances strong security controls with the Mac user experience, using staged rollouts, measurable verification and tested rollback paths to keep changes safe at scale.
PUBLISHED PLAYBOOKS
17
PUBLICATION
OPS PLAYBOOK
PRIMARY FOCUS AREAS
macOSDevice ManagementApplication LifecycleSecurity & Compliance
PUBLISHED PLAYBOOKS
Ops PlaybookApplication Lifecycle
A Safer Application Lifecycle Operating Model for macOS
Design a safer macOS application lifecycle: verify signed packages, enforce least privilege, validate each stage and recover with tested rollback steps.
Tier L1 · 15 min setup
Ops PlaybookmacOS
A Safer Security & Compliance Operating Model for FileVault
Design, implement and safely roll back a bounded FileVault workflow for macOS Security & Compliance, with evidence-based validation and recovery steps.
Tier L1 · 15 min setup
Ops PlaybookmacOS
Replacing Manual Compliance Work with a Verifiable FileVault Workflow
Replace ad hoc FileVault checks with a validated, auditable macOS encryption workflow featuring rollback, verification steps and measurable compliance outcomes.
Tier L1 · 15 min setup
Ops PlaybookZero-Touch & Automation
From Ticket Rework to Repeatable Windows Autopilot Provisioning
Replace reactive Autopilot ticket rework with a bounded, staged zero-touch provisioning workflow: hash validation, guardrails, ESP checks and a clear rollback path.
Tier L1 · 15 min setup
Ops PlaybookAutomation & Scripting
Silencing Chatty Login Window Errors With launchd Log Triage
Deploy a launchd-scheduled log query that detects macOS login window failures and alerts technicians before users file a ticket.
Tier L2 · 35 min setup
Ops PlaybookDevice Management
Auto-Remediating macOS Time Machine Backup Silent Failures
Stop silent Time Machine failures on managed Macs with a Jamf Pro and Intune remediation pipeline that detects, fixes, and escalates automatically.
Tier L2 · 35 min setup
Ops PlaybookApplication Lifecycle
Stopping App Update Tickets: Automating Background Task Approval
Stop manual login-item approvals for Chrome, Zoom and Slack updaters by pre-authorising Background Task Management via MDM and Jamf smart groups.
Tier L2 · 35 min setup
Ops PlaybookAutomation & Scripting
Self-Healing FileVault Key Escrow for macOS Fleets
Stop FileVault lockout tickets by automating recovery key rotation and Jamf Pro escrow with a launchd-scheduled zsh watcher and API workflow.
Tier L2 · 35 min setup
Ops PlaybookDevice Management
Fixing Stalled Automated Device Enrollment Loops for Good
Stop firefighting stuck Mac enrollments manually — detect and auto-remediate ADE and ABM assignment failures before they ever become a ticket.
Tier L2 · 35 min setup
Ops PlaybookApplication Lifecycle
Retiring Manual App Repackaging With AutoPkg Patch Pipelines
Stop stale-installer support tickets by automating macOS third-party app packaging and patch compliance with AutoPkg, JamfUploader and Jamf Pro.
Tier L2 · 45 min setup
Ops PlaybookAutomation & Scripting
Ending macOS Password Lockout Tickets With Bootstrap Token Audits
Missing bootstrap token escrow silently breaks the native macOS password reset button, forcing manual recovery key resets that automated auditing prevents.
Tier L2 · 45 min setup
Ops PlaybookmacOS
Catching Platform SSO Password Drift Before FileVault Locks Out Users
Detect and remediate Platform SSO password drift on managed Macs automatically, stopping FileVault lockouts before they become password reset tickets.
Tier L2 · 45 min setup
Ops PlaybookDevice Management
Stopping Silent Profile Failures with Declarative Management
Declarative device management status subscriptions let macOS fleets auto-detect and remediate silent profile failures before users open a ticket.
Tier L2 · 40 min setup
Ops PlaybookApplication Lifecycle
Ending Application-In-Use Update Failures on Managed Macs
Stop repetitive helpdesk tickets by automating locked-app detection and force quit before Mac software updates run via Jamf Pro or Intune.
Tier L2 · 35 min setup
Ops PlaybookAutomation & Scripting
Automating macOS Storage Cleanup to Kill Low-Disk Tickets
A production-safe launchd and zsh workflow that self-remediates low disk space on managed Macs before users ever open a support ticket.
Tier L1 · 45 min setup
Ops PlaybookmacOS
Recovery Lock Rotation for Apple Silicon Macs at Scale
A production-safe workflow for rotating and auditing macOS Recovery Lock passwords via Jamf Pro APIs to stop manual unlock escalations.
Tier L2 · 40 min setup