I'm Rafal, a Mac Admin. I design, deploy and run Mac, iPad and iPhone management on Jamf Pro, Microsoft Intune and Omnissa Workspace ONE, so a new device goes from sealed box to secure and ready for work without IT touching it. I also improve and modernise environments that are already running, from tidying up configuration and tightening security to moving to newer Apple features such as DDM and Platform SSO. I support Windows devices too, with Windows Autopilot and update management in Intune.
Macadmin.eu Company can automatically configure your Mac.
By enrolling this Mac in remote management, the administrator can install apps and settings and keep the Mac secure.
Macadmin.eu Company is installing apps and settings.
One person who knows the whole chain, from purchase order and MDM server token to the last login item on a laptop.
Devices bought through Apple or an authorised reseller show up in Apple Business Manager, are assigned to your MDM and configure themselves on first boot. Setup Assistant is trimmed to what matters, accounts come from your identity provider, and the desktop is ready with apps, Wi‑Fi and security already in place.
Move between Jamf Pro, Intune and Workspace ONE without wiping Macs. I use Apple's built-in ABM migration in macOS 26 and later, together with my own migration tool, which carries over every required setting so the switch is smooth and trouble-free. The whole process can be fully automated, or run step by step, as you decide.
FileVault with escrowed keys, mSCP and CIS baselines, EDR rollout, compliance that feeds Conditional Access.
Declarative software update enforcement with sensible deadlines, plus automated third-party patching so Chrome, Zoom and Office never drift.
zsh and Python for the edge cases, plus the Jamf Pro API, Microsoft Graph and Workspace ONE APIs to remove repetitive console work.
L2/L3 support for tricky Apple issues, runbooks your service desk can actually follow, and training so your team can run the setup without me.
Shared iPad, kiosk mode, managed apps and User Enrollment for BYOD.
The first thing a new hire sees after Setup Assistant should look like your company, not an empty desktop. I build full-screen or windowed onboarding flows that show progress while apps install, can ask for details like asset tag or department, and hand the Mac over only when it is ready.
The deepest Apple-only toolset. I build clean, scoped structures that stay readable when the fleet grows.
% sudo jamf policy -event install-office Checking for policies triggered by "install-office"... Executing Policy Microsoft 365 Apps % sudo jamf recon Submitting data to https://macadmin.jamfcloud.com/ <computer_id>1274</computer_id>
For Microsoft 365 shops: Macs and Windows PCs in one console, signing in with Entra ID and meeting the same compliance rules.
GET /deviceManagement/managedDevices ?$filter=operatingSystem eq 'macOS' &$select=deviceName,osVersion,complianceState // 200 OK { "deviceName": "MC-MBP-0412", "osVersion": "27.0.1", "complianceState": "compliant" }
Cross-platform UEM for organisations that manage Apple next to Windows, Android and rugged devices.
% sudo /usr/local/bin/hubcli sync Requesting device sync with Workspace ONE UEM... Sync requested successfully % sudo /usr/local/bin/hubcli profiles --list Wi-Fi · FileVault · Platform SSO · Restrictions
The foundation under every MDM. Set it up right once and every device after that just arrives managed.
% sudo profiles show -type enrollment Device Enrollment configuration: { ConfigurationURL = "https://macadmin.jamfcloud.com/..."; IsMDMUnremovable = 1; OrganizationName = "Macadmin.eu Company"; }
Security tools only protect a Mac when they are deployed silently and fully approved. I package them, push the system extension, Full Disk Access and network filter profiles first, and prove they report healthy.
% mdatp health --field real_time_protection_enabled true % systemextensionsctl list | grep -c "activated enabled" 4 % fdesetup status FileVault is On.
I help organisations roll out Claude safely across their Mac and Windows fleets. In my own work it is an assistant, not a replacement: it speeds up drafting, while the design, testing and final decisions stay with me.
% claude "draft a Jamf extension attribute for FileVault based on my command: fdesetup status" ● Draft saved: ea_filevault.sh # my review: logic, edge cases, security % shellcheck ea_filevault.sh && sudo ./ea_filevault.sh <result>On</result> % git commit -m "EA: FileVault status (reviewed, tested)"
A few recent engagements. Client names stay confidential; the scope and the results are real.
A complete, hands-off Mac experience: from the box to a secured, compliant desktop on the corporate network.
Strict security standards, a premium first-run experience and a controlled rollout of generative AI.
An assessment-led modernisation of Jamf Pro and Intune, ending with a large, low-risk platform migration.
Ongoing ownership of a large mobile estate: kept current, secure and ready for each new Apple release.
A Workspace ONE environment designed and built from the ground up, now running iPads across the brand's dealership network.
A new Jamf Pro environment for an engineering team: every Mac arrives secure and ready to code on day one.
Every engagement follows the same five steps, so you always know what comes next and what you get at the end of each one.
Review your ABM, MDM, identity and current pain points.
→ findings reportPlan enrollment, security baseline, apps and update rules.
→ written designBuild it and run it with a handful of real users and devices.
→ tested configEnroll or migrate the fleet in waves, with clear user comms.
→ fleet managedOngoing support, new OS releases and quarterly health checks.
→ runbooks & reportsWhich devices you manage (Mac, iPad, Windows or a mix), how many, which MDM you use today and what is not working. I'll reply with a short plan and next steps.
contact@macadmin.eu