10 things to consider when switching MDM providers

As the foremost Apple-first, Apple-best mobile device management (MDM) solution, we at Jamf have seen the competition come and go. Apple device management can be a complex affair, and many MDM startups fail as a result of trying to offer too much. With Apple technology constantly evolving – and organizations’ needs always changing – there’s a good chance you may outgrow your MDM vendor’s capabilities. Switching MDM solutions can be a daunting prospect, but given the headaches your current solution might be causing you, it could very well be worth it.

What are some things to plan for when you switch MDMs? How can you work around limitations between providers? Do you really need to wipe all the devices in your environments?

The best piece of advice we can give you is to plan thoroughly. Use our MDM Migration Guide to start planning. And if you’re still feeling overwhelmed, Jamf offers migration services to help plan and execute this move. Either way, Jamf has your back.

Below are 10 specific questions to ask yourself when you switch MDM vendors. These are critical to consider if you want to save time and guarantee a positive end-user experience.

1. Logistically, how do I enroll user devices into my new solution?

Using Apple Business Manager or Apple School Manager and an MDM solution, end users can automatically enroll and configure new devices without requiring hands-on support from IT.

When using these deployment tools, you will log into the portal and either move your entire token to your new MDM or create a new MDM server entry and move your devices to that new token. The next time your devices are wiped, they will enroll into your new management system.

2. Do I need to wipe my iOS devices?

iOS devices can be “supervised,” which simply means that administrators of an MDM solution control many settings of the device. Apple Configurator or Automated Device Enrollment (ADE) used with an MDM solution enables supervision.

Moving a supervised device between MDM vendors means wiping the device. However, if you follow Jamf’s guide for switching MDMs, you can speed this process by sending a wipe command to your devices after moving your server token in Apple Business Manager or Apple School Manager. Many schools have their students assist with this process.

3. What should I do about iOS devices that are not in Apple Business Manager or Apple School Manager?

It is common for organizations to have iPads that were procured through several routes. While it may be tempting to purchase iPads on clearance from your local big-box store, it can make management tricky. And if you’ve found a way to band-aid this by leveraging user-initiated enrollment, moving to a new MDM is where those band-aids will start to fall off. Fortunately, Apple has provided a way to enroll these devices into your Apple Business Manager or Apple School Manager account. Beginning with Apple Configurator 2.5, you can enroll iOS devices regardless of where they were purchased. Once a device is activated, a 30-day provisional period begins. After the 30 days, these devices will act just like the other devices you have in Apple Business Manager or Apple School Manager. Pro tip for schools: Start this process more than 30 days before the beginning of classes so students can’t remove themselves from management.

4. What about Mac; do I need to wipe those?

There are several ways to enroll a Mac into an MDM, and wiping doesn’t necessarily have to be involved. If the MDM profile is removable (either by the user or the previous management solution), devices can be enrolled to Jamf without requiring a wipe. Users can either self-enroll with a URL or run a small file to bring their device into Jamf. If you are interested in moving MDMs and not wiping your Macs, talk to us and we can help.

5. What about my users’ data; how do I ensure that data moves if I have to move my devices?

Here are several types of data that might be on the device, along with the details you need to consider for each one:

• Mail: If your mail accounts are Microsoft Exchange or IMAP servers, once the new account is pushed to the device with a new configuration profile the devices will resynchronize all data. Depending on how much data and how many devices you have, this could be network-intensive and users may experience a delay while this content returns.
• Photos, Notes, Messages: If your iOS users are either using iCloud sync services or iCloud backup, you can rest easy that their content will sync just as if you’ve recently upgraded iPhones. If you have prohibited iCloud backups as a corporate policy, you may be able to run a local iTunes backup to your machine.
• Apps and App Data: Certain apps use iCloud to sync data, but be wary of apps that only use local storage. If you are using an iCloud restore you may be in the clear, but double-check this if you have business-critical apps.

If you were getting managed app distribution licenses through Apple Business Manager or Apple School manager, don’t fret! Your organization retains ownership of these licenses, and you can easily redistribute them using your new management solution.

6. How do I move my apps over to the new MDM?

As mentioned above, Apple Business Manager or Apple School Manager are keeping track of your license purchases and are tied to a token. You can move this token to your new MDM, reclaim your app licenses and start deploying.

The moment a license is revoked from the device, a few behaviors kick in. Some app vendors have a 30-day grace period for app licenses to be reinstated, and some will remove the app immediately. Keep in mind that any supervised iOS devices will need to be wiped anyway, so this may not be a huge concern, but this does stress the point of having a planned-out deployment. Consult the migration guide linked at the beginning of this blog post for detailed help with this issue.

7. Is there a way to protect my network from increases in traffic volume during re-enrollment?

Depending on what apps and content you are pushing to your devices and the location of your end users during re-enrollment (on-network or off), you may see large amounts of network traffic during this time. Some of this traffic is caused by the iOS devices downloading apps directly from the App Store. As a general best practice, we recommend only pushing required apps and encouraging users to leverage Self Service to get other apps at a time that is best for them (and not during a massive enrollment event). However, a Mac acting as a local caching server may help to relieve some of this network congestion. When properly configured, the caching server will deliver App Store content to devices on your network, without having to reach across the internet to do so. During an enrollment, you may have all your devices receiving a suite of business-critical apps. Serving that same content locally every time may be the difference between a smooth roll-out and users standing around waiting for apps to download.

8. Do I currently integrate with an identity service or have other custom integrations?

Does your server communicate with a directory service like Microsoft’s Active Directory to host credentials and network information? If so, you need to configure that and any other areas of your ecosystem on the new MDM service. Do you have scripts that communicate with an API on an MDM solution? If so, you’ll need to make sure that scripts can be rewritten – and then go ahead and actually rewrite them. Make sure that you aren’t complicating the deployment by scripting native features, and review the most time-intensive aspects of redoing your work for the new environment. This will save you time in the long run.

9. Are there ways to speed up this process?

While Jamf promotes many over-the-air workflows, Apple Configurator can back up devices, restore devices, add manual profiles (such as those that join a wireless network) and add enrollment profiles on devices. For fans of scripting, Apple Configurator 2 supports AppleScript. For large migrations, it is worth considering the efficiencies of a configurator cart.

10. Do I need to tell my users about the switch?

Absolutely. MDM migrations benefit from clear communication to end users for several reasons. During this process, the user may see pop-ups about app licensing, and depending on your path forward, the user’s device may need to be wiped. Instead of instilling fear or worry, take this as an opportunity to empower your users and make them a part of the enrollment process whenever possible. Jamf’s focus on zero-touch deployment makes it easy to involve end users and to educate them in the functionality and value of the MDM . As long as you have been communicating about the above-listed topics (app and data retention, device wipes, etc.), you can provide your users with an amazing and fresh setup experience. Users will return to a managed environment and can use apps like Self Service to quickly re-install business-critical applications. Don’t fear the end user; empower them and use them as a resource. Many organizations have found that when employees are a part of the provisioning process, they demonstrate a more positive attitude toward management and are ultimately more successful on their devices.

Jamf can help you with the migration process

Jamf has years of experience successfully migrating customers to our MDM solutions. Whether your organization needs project orchestration or boots on the ground, Jamf can make this process painless and efficient.

While moving from one MDM provider to another may seem like an overwhelming task, you’re not alone on your journey; let us help! Our helpful MDM Migration Guide is a great place to start, and our teams can take you the rest of the way.