Apple-only device management with bundled endpoint security, identity and patching — the main lower-cost alternative to Jamf.
| Product | What it covers | Notes |
|---|---|---|
| Mosyle Manager | The core MDM — enrollment, profiles, app deployment, restrictions, inventory. | Free tier historically available for education, which is how Mosyle built its school footprint. |
| Mosyle Fuse | The bundle: MDM + endpoint security + identity (IdP) + encrypted DNS + patching, on one licence. | The main commercial pitch — replaces several point products, which is where the cost saving versus Jamf plus add-ons actually comes from. |
| Mosyle Business / Education | Two editions with different pricing and feature emphasis. | Education adds classroom-oriented features; Business leans toward compliance and security. |
| Auto-Update / Patching | Automated updates for macOS itself and a catalogue of common third-party apps. | Removes most of the AutoPkg/Munki work an equivalent Jamf setup needs. |
| Mosyle Auth | Syncs the macOS local account password with your cloud IdP (Google Workspace, Entra ID, Okta). | Solves the perennial "local Mac password drifts from cloud password" problem without a third-party tool. |
| Mosyle Hardening / Compliance | CIS-benchmark-aligned hardening templates and compliance reporting. | Useful head start, but review each control — blanket-applying CIS breaks real workflows. |
How Mosyle organises devices
Device Groups
Mosyle's equivalent of Jamf Smart Groups. Build them from criteria (OS version, model, installed app, user attribute) and scope profiles and apps to them rather than to individual devices.
User assignment
Devices can be tied to a directory user, so scoping follows people rather than hardware — useful when laptops get reassigned.
Profiles
Standard Apple configuration profiles with a GUI for the common payloads, plus custom profile upload for anything not surfaced.
Custom Commands & Scripts
Run shell scripts on schedule, on enrollment, or on demand — the escape hatch for anything profiles can't express.
Connect Apple Business Manager
Upload the MDM push certificate (APNs) and link ABM. Assign device serials to Mosyle as the MDM server in ABM. Nothing enrolls automatically until this is done.
Build the Enrollment Profile
Choose which Setup Assistant screens to skip, whether enrollment is mandatory and non-removable, and whether the first user is admin or standard. Standard, with a separate hidden management account, is the right default.
Set the security baseline before apps
FileVault with escrowed recovery key, firewall, screen lock, Gatekeeper, and OS update enforcement. Deliver these as profiles scoped to all devices so a Mac is never briefly non-compliant.
Deploy apps via VPP plus Mosyle's catalogue
App Store apps through Apps and Books (device-assigned, so no Apple ID needed on the Mac). Third-party apps from Mosyle's own maintained catalogue, which covers most common titles without manual packaging.
Enable Auto-Update and set a deadline
Configure macOS update enforcement with a real deadline and user notification. This is where Mosyle saves the most operational time versus assembling the equivalent yourself.
Give users a self-service catalogue
Publish optional apps and remediation actions so routine requests never become tickets — the same principle as Jamf Self Service.
| Dimension | Mosyle | Jamf Pro |
|---|---|---|
| Cost | Substantially lower, especially bundled as Fuse. | Premium pricing; security and identity are separate products. |
| Scripting depth | Good — scheduled and on-demand shell scripts. | Deeper. Extension attributes feeding Smart Groups is a genuinely more powerful pattern. |
| Bundled security | Included — endpoint protection, encrypted DNS, hardening. | Jamf Protect and Jamf Connect are priced separately. |
| Third-party patching | Built-in catalogue, minimal setup. | Patch Management for common titles; AutoPkg for the rest. |
| Community & ecosystem | Smaller. Fewer public recipes and integrations. | Very large — Jamf Nation, Mac Admins Slack, extensive third-party tooling. |
| API | Available and adequate for common automation. | Extensive and widely used; most tooling assumes it. |
| Best fit | Schools, SMBs, and Apple fleets wanting most of the capability for much less. | Large or highly customised estates with a dedicated Mac admin. |
- Budget is a real constraint and the bundled security/identity features would otherwise be separate purchases.
- You're an education institution — Mosyle's roots and pricing are strongest there.
- Nobody on the team wants to own an AutoPkg/Munki pipeline.
- Your requirements are mainstream: enroll, configure, secure, patch, deploy apps.
- You need deep custom automation, complex scoping logic, or heavy API integration with other systems.
- You already have Jamf expertise on the team — that knowledge is worth real money.
- You rely on third-party tooling that assumes Jamf (many Mac admin projects target it first).
- Same-day support for brand-new Apple OS features is business-critical.
Gotchas
- The APNs push certificate expires every 12 months, regardless of MDM vendor. Let it lapse and every device stops responding.
- Renew with the same Apple ID that created it, or you must re-enroll the entire fleet. Use a shared team account, never someone's personal Apple ID.
- The ABM/ADE and VPP tokens also expire annually and need re-uploading.
- This is an Apple platform constraint, not a Mosyle one — every Apple MDM faces it.
- A user needs a Secure Token to enable FileVault or install OS updates. The first account created generally holds it.
- Ensure the Bootstrap Token is escrowed to Mosyle, or MDM-driven FileVault and update operations will fail on accounts without a token.
- Verify on-device with
profiles status -type bootstraptokenandsysadminctl -secureTokenStatus <user>.
- macOS blocks Full Disk Access, Screen Recording, and Accessibility until approved. Only an MDM-delivered PPPC profile can pre-approve them.
- You need each app's exact bundle ID and code requirement — get it with
codesign -dr - /Applications/App.app. - Skipping this is why a deployed monitoring or remote-support tool "installs fine but doesn't work".
- A Mac can only have one MDM. Moving to Mosyle means unenrolling from the old one and enrolling fresh.
- Reassign serials to Mosyle in ABM, then re-enroll. Existing devices usually need a wipe or user-driven re-enrollment to pick it up cleanly.
- Export FileVault recovery keys from the old MDM first — they do not migrate, and losing them means losing recovery capability.
- Migrate a pilot group before the fleet, and keep the old tenant alive until the last device is confirmed healthy.