By Danny Knox

March 17, 2020

  0

Working from Home Just Became a High Priority – Are Your Mac Devices Ready?

They could be with Parallels® Mac Management for Microsoft SCCM. Mac devices now receive full management in Microsoft Endpoint Manager Configuration Manager (MEMCM).   But what about external or off-premises users? With Parallels Mac Management, Microsoft Internet Based Client Manager (IBCM) can extend that same full Mac-management experience to Mac devices working externally to your secure networks…without a virtual private network (VPN).   

What happens on-premises? Application and package deployment, policy evaluation and remediation, script deployments, Windows Server Update Services (WSUS) based patching, disk encryption enforcement…sounds like typical lights on, door open (LODO) work for endpoint management. But when the need arises to work from home, the corporate lights may not be on and the doors may be shut. But not for the IBCM-based Mac devices under the authority of MEMCM! 

Architecture and Security Overview  

The diagram below illustrates a typical infrastructure for IBCM:  

Parallels IBCM Proxy enables IBCM management with the following: 

• It serves as a transparent proxy that passes requests between Parallels Mac Client and Parallels Configuration Manager Proxy.  

• The connector is technically a plugin to Internet Information Services (IIS), which is also used by SCCM for communications between computers on the internet and MPs/DPs.  
• A single instance of Parallels IBCM Proxy serves a single primary SCCM site. If you have multiple primary sites, then you will need to repeat the hierarchy shown above for each primary SCCM site.  

Parallels Configuration Manager Proxy establishes a permanent Secure Sockets Layer (SSL) link with Parallels IBCM Proxy, which is configured after the components are installed: 

• This link is shown as the green arrow on the diagram above.  
• Trust is established using the certificate pinning mechanism, when each party is configured to stick to a specific certificate of another party.  

Each Mac computer enrolled in SCCM from the intranet automatically obtains the public URL of the Parallels IBCM Proxy. When a computer is enrolled over the iInternet, the user enters the URL manually (the URL is obtained from the system administrator). When Parallels Mac Client needs to communicate with SCCM, it first connects to Parallels IBCM Proxy and obtains the necessary links to MPs/DPs which are accessible from the internet.  

For existing Parallels Mac Management customers, IBCM is already an included, optional component—we can assist you with the install and configuration. For enterprises with 95% Windows devices that are wondering what to do in MEMCM for their Mac devices, you could be closer than you think for full Mac management, including work-from-home capabilities. In a dynamic world of business challenges and global health concerns, you can enable your workforce to be as flexible as possible so they can stay healthy and maintain business priorities and continuity. One less technology headache is always a good thing, right?