Lesson 2: Security Settings for Apple Devices - Jamf 170 Course

Jamf 170 Course
Solution
Application
Content Type
Training Content
Utilities & Services
ft:locale
en-US

Goal

Understand the security options built into the Settings and System Settings applications. Discover how security settings can be configured and enforced with Jamf Pro.

Video

Key points

  • Setup Assistant provides the first opportunity to configure an Apple device when it is initially turned on.

    • Choices made during Setup Assistant can be changed later in the System Settings app (macOS) or Settings app (iOS, iPadOS).

    • Many of these options can be skipped with a PreStage enrollment.

  • System Settings on macOS and Settings on iOS and iPadOS are apps used to make configuration changes that affect device behavior.

    • Some settings require user authentication or administrator privileges to make changes.

  • iOS and iPadOS devices can be encrypted by enabling a passcode.

    • The passcode must be verified before an encrypted device can be unencrypted.

  • Mac computers can be encrypted by enabling FileVault.

    • A FileVault-encrypted computer can only be unlocked by a FileVault-enabled user or with a recovery key.

    • The recovery key can be escrowed and stored securely in Jamf Pro so it can be accessed later from a computer's inventory record.

  • Jamf Pro can be used to configure device settings remotely via configuration profiles.

Review

To view answers, click arrow next to each question.

  1. With FileVault turned on, what is required to unlock a computer?
    A FileVault-enabled user or a recovery key
  2. When is the first opportunity to configure a device's behavior?
    Setup Assistant
  3. How can administrators use Jamf Pro to enforce security settings on devices?
    Using Jamf Pro, administrators can deploy configuration profiles to enforce security settings.

Practice

  1. Create a configuration profile to encrypt a managed test computer.

    1. Navigate to Computers > Configuration Profiles > New.

    2. Enter a name for the profile.

    3. Select the Security and Privacy payload and click FileVault.

    4. For the Enable FileVault switch, select Include.

    5. For Event to prompt FileVault enablement, select the At Login toggle button.

    6. Enable Escrow Personal Recovery Key and enter a location for the Escrow Location Description.

    7. Scope the profile to a test computer and click Save.

    8. Log in to the test computer and complete the FileVault process.

  2. View the escrowed recovery key in Jamf Pro.

    1. Find the inventory record for the test computer.

    2. Click Disk Encryption.

    3. Click Show Key to the right of Personal Recovery Key.

Resources

Jamf Pro Documentation

Mac User Guide

iPad User Guide

iPhone User Guide