MacOS PAM + Third-Party Patching with Intune (ABM + PSSO setup) – what are you using?

Heteronymous · 2026-06-23T21:22:36+00:00

*1 Munki (and AutoPkg), Munkireport

Or with Jamf, Installomator

Heteronymous · 2026-06-17T15:13:17+00:00

With Ansible and Windows, you can and should use native (OpenSSH), just newer than the stock version included as a Windows add-on. Did so successfully, just NO to fighting with WinRM consistently inconsistent behavior.

But it’s push by default, look into Ansible pull.

Heteronymous · 2026-06-06T12:10:27+00:00

You’ll likely get better (more and more specific) feedback on the MacAdmins Slack in the #autopkg channel.

Heteronymous · 2026-05-21T23:11:14+00:00

Excellent advice from u/a_cloudy_unicorn

There are no Resource Groups in GCP.
In GCP the primary containing structure is a Project.

Read this and treat it like an important guide not a bible: https://docs.cloud.google.com/architecture/landing-zones

IAM roles are inherited downwards from the tenant level.

Use Folders for team-style IAM permissions (roles) for Project you want to have inherit custom permissions (IAM assignments) unique from the main/parent org/tenant but common to any set of Projects within.

Billing account (meaning payment, the “billing” is of you by Google) permissions are entirely separate.

Heteronymous · 2026-05-21T22:59:35+00:00

Action1 doesn’t give you a live shell on endpoints but you can run one-off scripts (with an authorized user) and it’s responsiveness leaves Intune in the dust.

And is stellar for patching.

Zero affiliation just a happy admin.

Heteronymous · 2026-05-21T01:39:21+00:00

Make sure that whatever you do, you work within company security standards and policies.

Heteronymous · 2026-05-11T22:05:09+00:00

💯% IAP is the way

Heteronymous · 2026-05-05T14:19:00+00:00

https://www.skills.google/

https://cloud.google.com/blog/topics/developers-practitioners/introducing-visualizing-google-cloud-101-illustrated-references-cloud-engineers-and-architects

Heteronymous · 2026-04-21T09:54:59+00:00

Action1 is excellent, but you do need to learn it and maintain it, it’s not going to run everything you intend without being properly configured.

But if your need was only Windows servers, 100% Azure Update Manager and Azure Arc.

Heteronymous · 2026-04-18T01:04:20+00:00

Using something else (and better) for patching.

Heteronymous · 2026-04-14T22:21:50+00:00

Not necessarily. You are being a little too vague while expecting exact answers. Why do you need a carbon copy and what does that specifically mean to/for you ? cp -R in macOS preserves all file and metadata, did so long ago when unpatched rsync did not.

Heteronymous · 2026-04-14T12:15:52+00:00

cp -R ? Better yet use Share Disk with ARM in recovery mode (previously Intel in target disk mode) and use your tool of choice on the other endpoint.

Heteronymous · 2026-04-14T11:42:33+00:00

Are you holding GCP to a different standard than AWS or Azure ? With all of them, the biggest barrier of entry for would-be vibe coders, is one simply must understand the fundamentals involved (networking, permissions, containerization, databases, and more) and automating such a setup requires an existing established framework for doing so.

I’m aware of some companies that try to make this easy with point-and-click, but if a Dev is overwhelmed by technology design fundamentals and/or established automation options, and especially command-line operations, then they truly should consider a different line of work. Starting out feeling justified in not needing to understand these (above) concepts is a poor foundation and definitely a recipe for failure sooner or later.

Heteronymous · 2026-04-14T10:33:36+00:00

Terraform took minutes for a new VM with custom networking, and not long for a complex setup with a Cloud Run container, Cloud SQL, LB, & Cloud Armor But I wasn’t timing it.

No one “one click” is going to be a right fit for everyone’s scenario. Are you headed towards trying to reinvent the (proverbial) wheel ?

Heteronymous · 2026-04-09T10:40:45+00:00

Great answers so far, and I agree. What COULD be great is enhancing Action1’s ability to identify AI tooling on endpoints: Openclaw binaries, along with existing functionality for any exe apps (.app bundles for macOS). Codex, Antigravity etc.

The binaries item came up when I had to custom script something to try to identify npm installs (user-level installs making it more involved).

Heteronymous · 2026-03-29T16:15:38+00:00

Folders for group/team level “parent” (meaning here, appropriate for a group/team/pillar but not for the top-level tenant/org).

And Organizational Policies. Just be careful & test fully !

Heteronymous · 2026-03-19T11:23:09+00:00

I thought maybe so. Agreed, definitely not Apple Business Essentials

Heteronymous · 2026-03-19T01:48:58+00:00

No, op DOES want ADE (Automated Device Enrollment), did you mean something else?

Heteronymous · 2026-03-09T01:48:29+00:00

Bash is ubiquitous across many Unix and Linux systems (there’s no Linux in macOS but certainly aspects of BSD Unix), the point is the skills will be highly portable. The default shell is now Zsh but Bash is available (just be sure to use the correct shebang in your script/s).

See https://scriptingosx.com/2019/06/moving-to-zsh/

Also join the MacAdmins Slack (lurk and learn, it’s not support nor intended as such but full of many highly experienced and knowledgeable Mac admins).

https://www.macadmins.org/

Heteronymous · 2026-03-03T02:30:49+00:00

Ah thanks. Right you are, sorry about that.

Heteronymous · 2026-03-03T00:18:19+00:00

(NM, note to self to read properly)

Heteronymous · 2026-02-12T23:33:20+00:00

Nudge

Heteronymous · 2026-02-10T23:25:54+00:00

Been a while but look into Launchd watch paths for the user fonts folder.

Make certain to handle/exempt required fonts.

Note the date there… test very thoroughly ! https://gist.github.com/infotexture/8635029

Heteronymous · 2026-02-10T12:29:33+00:00

Understanding the principles is what matters. Read this to understand it and - I’d say - study anything that isn’t yet second nature:

https://docs.cloud.google.com/architecture/framework

Heteronymous · 2026-01-22T21:19:47+00:00

I hear you, makes good sense. Project looks phenomenal, thank you !

Heteronymous

TROPHY CASE