Back to All Cheatsheet Libraries cheatsheets

Mosyle

Apple-only device management with bundled endpoint security, identity and patching — the main lower-cost alternative to Jamf.

Apple-only, and priced to displace Jamf

Mosyle does one thing: manage Apple devices. That focus means same-generation support for new macOS and iOS releases, and a feature set aimed squarely at what Apple admins actually do. Its commercial angle is bundling endpoint security, identity, and app management into one subscription rather than selling them as separate products.

Product What it covers Notes
Mosyle ManagerThe core MDM — enrollment, profiles, app deployment, restrictions, inventory.Free tier historically available for education, which is how Mosyle built its school footprint.
Mosyle FuseThe bundle: MDM + endpoint security + identity (IdP) + encrypted DNS + patching, on one licence.The main commercial pitch — replaces several point products, which is where the cost saving versus Jamf plus add-ons actually comes from.
Mosyle Business / EducationTwo editions with different pricing and feature emphasis.Education adds classroom-oriented features; Business leans toward compliance and security.
Auto-Update / PatchingAutomated updates for macOS itself and a catalogue of common third-party apps.Removes most of the AutoPkg/Munki work an equivalent Jamf setup needs.
Mosyle AuthSyncs the macOS local account password with your cloud IdP (Google Workspace, Entra ID, Okta).Solves the perennial "local Mac password drifts from cloud password" problem without a third-party tool.
Mosyle Hardening / ComplianceCIS-benchmark-aligned hardening templates and compliance reporting.Useful head start, but review each control — blanket-applying CIS breaks real workflows.

How Mosyle organises devices

Device Groups

DynamicStaticCriteria-based

Mosyle's equivalent of Jamf Smart Groups. Build them from criteria (OS version, model, installed app, user attribute) and scope profiles and apps to them rather than to individual devices.

User assignment

IdP syncPer-user scoping

Devices can be tied to a directory user, so scoping follows people rather than hardware — useful when laptops get reassigned.

Profiles

DeclarativeCustom .mobileconfig

Standard Apple configuration profiles with a GUI for the common payloads, plus custom profile upload for anything not surfaced.

Custom Commands & Scripts

ShellScheduledSelf-service

Run shell scripts on schedule, on enrollment, or on demand — the escape hatch for anything profiles can't express.

Zero-touch setup, the same Apple foundations as every other MDM

The ABM/ADE groundwork is identical regardless of vendor — see MDM Fundamentals. What differs is how the console expresses it.

1

Connect Apple Business Manager

Upload the MDM push certificate (APNs) and link ABM. Assign device serials to Mosyle as the MDM server in ABM. Nothing enrolls automatically until this is done.

2

Build the Enrollment Profile

Choose which Setup Assistant screens to skip, whether enrollment is mandatory and non-removable, and whether the first user is admin or standard. Standard, with a separate hidden management account, is the right default.

3

Set the security baseline before apps

FileVault with escrowed recovery key, firewall, screen lock, Gatekeeper, and OS update enforcement. Deliver these as profiles scoped to all devices so a Mac is never briefly non-compliant.

4

Deploy apps via VPP plus Mosyle's catalogue

App Store apps through Apps and Books (device-assigned, so no Apple ID needed on the Mac). Third-party apps from Mosyle's own maintained catalogue, which covers most common titles without manual packaging.

5

Enable Auto-Update and set a deadline

Configure macOS update enforcement with a real deadline and user notification. This is where Mosyle saves the most operational time versus assembling the equivalent yourself.

6

Give users a self-service catalogue

Publish optional apps and remediation actions so routine requests never become tickets — the same principle as Jamf Self Service.

An honest comparison

Both are good products. The decision usually comes down to how much custom automation you need and how much you value a large community versus a lower bill.

Dimension Mosyle Jamf Pro
CostSubstantially lower, especially bundled as Fuse.Premium pricing; security and identity are separate products.
Scripting depthGood — scheduled and on-demand shell scripts.Deeper. Extension attributes feeding Smart Groups is a genuinely more powerful pattern.
Bundled securityIncluded — endpoint protection, encrypted DNS, hardening.Jamf Protect and Jamf Connect are priced separately.
Third-party patchingBuilt-in catalogue, minimal setup.Patch Management for common titles; AutoPkg for the rest.
Community & ecosystemSmaller. Fewer public recipes and integrations.Very large — Jamf Nation, Mac Admins Slack, extensive third-party tooling.
APIAvailable and adequate for common automation.Extensive and widely used; most tooling assumes it.
Best fitSchools, SMBs, and Apple fleets wanting most of the capability for much less.Large or highly customised estates with a dedicated Mac admin.
Choose Mosyle when…
  • Budget is a real constraint and the bundled security/identity features would otherwise be separate purchases.
  • You're an education institution — Mosyle's roots and pricing are strongest there.
  • Nobody on the team wants to own an AutoPkg/Munki pipeline.
  • Your requirements are mainstream: enroll, configure, secure, patch, deploy apps.
Choose Jamf when…
  • You need deep custom automation, complex scoping logic, or heavy API integration with other systems.
  • You already have Jamf expertise on the team — that knowledge is worth real money.
  • You rely on third-party tooling that assumes Jamf (many Mac admin projects target it first).
  • Same-day support for brand-new Apple OS features is business-critical.

Gotchas

The Apple certificates still expire
  • The APNs push certificate expires every 12 months, regardless of MDM vendor. Let it lapse and every device stops responding.
  • Renew with the same Apple ID that created it, or you must re-enroll the entire fleet. Use a shared team account, never someone's personal Apple ID.
  • The ABM/ADE and VPP tokens also expire annually and need re-uploading.
Secure Token and Bootstrap Token on Apple silicon
  • This is an Apple platform constraint, not a Mosyle one — every Apple MDM faces it.
  • A user needs a Secure Token to enable FileVault or install OS updates. The first account created generally holds it.
  • Ensure the Bootstrap Token is escrowed to Mosyle, or MDM-driven FileVault and update operations will fail on accounts without a token.
  • Verify on-device with profiles status -type bootstraptoken and sysadminctl -secureTokenStatus <user>.
PPPC still has to be handled explicitly
  • macOS blocks Full Disk Access, Screen Recording, and Accessibility until approved. Only an MDM-delivered PPPC profile can pre-approve them.
  • You need each app's exact bundle ID and code requirement — get it with codesign -dr - /Applications/App.app.
  • Skipping this is why a deployed monitoring or remote-support tool "installs fine but doesn't work".
Migrating from another MDM is a re-enrollment
  • A Mac can only have one MDM. Moving to Mosyle means unenrolling from the old one and enrolling fresh.
  • Reassign serials to Mosyle in ABM, then re-enroll. Existing devices usually need a wipe or user-driven re-enrollment to pick it up cleanly.
  • Export FileVault recovery keys from the old MDM first — they do not migrate, and losing them means losing recovery capability.
  • Migrate a pilot group before the fleet, and keep the old tenant alive until the last device is confirmed healthy.

Resources