Best practices for setting up this Macbook for an employee?

Question

I'm setting up a Macbook for a new hire that requested one (normally we use Windows machines). I plan to add it to the AD domain.

What are some best practices for a work Mac setup?

I made an iCloud-less user account, called just "user". Should I set up an iCloud account for it (with their company email)? Or let the new employee create their own? How can I make sure the previous employees PERSONAL iCloud account cannot access 'Find My Mac'? (I started it in recovery mode, erased the disk, and reinstalled the OS - I think the account is still saved somewhere because it popped up during set up)

Answer 1

Best practice depends a bit on what you need to manage. I would do nothing initially, don't bind, don't do things for people and then make notes what is needed in collaboration with the employee. Wipe the Mac and hand it over.

A super MDM for getting started for free is JAMF Now. https://www.jamf.com/products/jamf-now/

Here is your script for securing the data / software each time it changes hands. Skip the part on the AppleCare since the company owns / manages that Mac in your case. Also, it's fine for the employee to "register" it with Apple for support, you should keep the original receipt or sign up for an MDM to manage activation lock / remote reset.

• https://support.apple.com/en-us/HT201065

So my top 5 best practices are:

1. Find out who your Apple Business rep / support channel is. Make contact with them so they can help you out as a business using Apple.
2. Try an easy MDM and go very, very light on management and enforcement initially - document what you find, what works, what causes issues or is more work than the benefit. Don't just do things on macOS since you do it on Windows. iOS and iPadOS are lighter management idioms than macOS (traditionally) but they are all converging now to the light touch for most small businesses.
3. Do not bind to AD. Leverage an identity provider like Okta / AzureAD and the new SSO extensions rather than binding. You don't need this for fewer than 15 Macs IMO. Just let the employee manage their AD crews manually.
4. Think of how you'll fund apps and then work with your MDM / Apple partners to learn what you need to focus on next after 6 months of the lightest possible management you can start with.
5. Let the employees roll with AppleID of their choosing for the first dozen or so accounts - you can always claim the work email ID later if needed. Forcing people to use two AppleID is a huge hassle for a small team and will drive up support costs, cause confusion, deliver almost no value to you or the business.