Tag: device management

Deploying Open-Source MDM for a Small Mac Fleet: A MicroMDM Case Study

If you manage under 50 Apple devices and want full control without SaaS lock-in, open-source MDM is a real option. This post examines the architecture and deployment of MicroMDM—an API-driven, self-hosted Mobile Device Management server for Apple devices. We'll compare it to mainstream MDM vendors, walk through a real-world setup, and spotlight lessons learned from running it in production for a small business.

Key Takeaways:

• MicroMDM is a production-capable, open-source MDM server for Apple devices, best suited for technical teams seeking control and cost savings.
• It covers enrollment, configuration profiles, remote commands, and integrates with Apple DEP and VPP.
• For small organizations, MicroMDM enables zero-cost device management—if you can handle the self-hosting and manual workflows.
• Migration to commercial MDM or NanoMDM is straightforward when your needs grow or support ends (MicroMDM v1 is in maintenance mode through 2025).
• Common pitfalls include SSL misconfiguration, Apple Push Certificate management, and missing automations for non-technical admins.

Why MicroMDM for Small Fleets?

The MicroMDM project provides a self-hosted MDM platform targeting Apple devices—primarily macOS, but also iOS and iPadOS. Its focus is DevOps-friendliness, API-first automation, and full ownership of your device data. Unlike SaaS MDMs, you control the source code, data storage, and update policies.

This matters for small organizations that:

• Want to avoid per-device or per-user licensing fees
• Have compliance or data residency requirements that preclude cloud MDM
• Need custom automations or integrations with existing IT infrastructure
• Are comfortable maintaining a Linux server and SSL certificates

MicroMDM's design is minimal: you run the server, connect it to Apple Push Notification Service (APNS), and interact via REST API or command line. There’s no web console by default, but several open-source frontends exist. The core feature set (enrollment, configuration, remote lock/wipe, DEP/VPP support) is suitable for most small business needs.

Importantly, as of the latest v1.13.1 release (October 2025), MicroMDM v1 is in maintenance mode and officially supported until the end of 2025. For new projects, you should evaluate NanoMDM (its successor) for longer-term production use—but MicroMDM remains viable for small, short- to medium-term deployments.

Architecture and Initial Setup

System Architecture

MicroMDM is a single Go binary that can run on any modern Linux or macOS server. For production, you’ll typically deploy it behind a reverse proxy (e.g., Nginx or Caddy) with a valid SSL certificate, and store data on local disk or via a simple database backend.

Quickstart Deployment Example

For a minimal and secure setup:

1. Provision a small VM or bare metal server (Ubuntu, RHEL, or macOS supported)
2. Install micro-mdm binary (see Quickstart docs)
3. Generate or obtain a TLS certificate (Let's Encrypt recommended for test/prod)
4. Request and upload your Apple MDM Push Certificate via Apple Business Manager
5. Run MicroMDM behind your reverse proxy, forwarding HTTPS traffic
6. Test API connectivity

The following code is an illustrative example and has not been verified against official documentation. Please refer to the official docs for production-ready code.

The following code is an illustrative example and has not been verified against official documentation. Please refer to the official docs for production-ready code.

# Example: Launch MicroMDM with environment variables
export MICROMDM_API_KEY=supersecret
export MICROMDM_APNS_CERT=/etc/micromdm/apns-cert.pem
export MICROMDM_APNS_KEY=/etc/micromdm/apns-key.pem

./micromdm serve \
  -api-key $MICROMDM_API_KEY \
  -apns-cert $MICROMDM_APNS_CERT \
  -apns-key $MICROMDM_APNS_KEY \
  -tls-cert /etc/letsencrypt/live/mdm.example.com/fullchain.pem \
  -tls-key /etc/letsencrypt/live/mdm.example.com/privkey.pem

This launches a production-ready MicroMDM instance. For persistent deployments, use a systemd unit or Docker container—see the provided Dockerfile for reference.

You can find more MDM deployment patterns and production security tips in our comprehensive MDM platform guide.

Enrollment Workflows and Core Features

Device Enrollment

MicroMDM supports two main enrollment paths:

• Apple Device Enrollment Program (DEP): Automates initial enrollment for devices purchased through Apple or authorized resellers. Devices receive MDM profiles during setup, enforcing management before first login.
• Manual Profile Installation: Generates a mobileconfig profile for download or email. Users install this to enroll BYOD or legacy hardware.

For a small org, manual enrollment is often sufficient—especially for bring-your-own-device or repurposed Macs. DEP is strongly recommended for full automation and enforcement on new devices.

# Example: Generate and serve enrollment profile
./micromdm create-enrollment-profile \
  --org "ExampleOrg" \
  --output /var/www/html/ExampleOrg-enrollment.mobileconfig
# Host this .mobileconfig file for users to download and install

Core MDM Features

• Remote lock, wipe, and reboot commands
• Push and update configuration profiles (Wi-Fi, VPN, restrictions, etc.)
• App installation and management (with Apple VPP integration)
• Query and report device inventory (serial, OS version, installed apps)
• API/webhook integration for custom workflows

For organizations under 50 devices, this covers most compliance and operational needs—especially when paired with sensible security policies (password enforcement, disk encryption, auto-update settings).

For larger-scale or cross-OS automation, see our containerization best practices to orchestrate MicroMDM alongside other fleet management tools.

Comparison: MicroMDM vs Commercial MDM

Summary: MicroMDM provides maximum flexibility and zero cost but expects you to be comfortable with CLI, API, and server security. Commercial MDMs win on UX, support, and automation for non-technical teams or environments where “it just works” is more important than total control.

For a deeper dive into feature trade-offs and security policy templates, see our MDM vs MAM and platform comparison.

Production Problems and Pro Tips

Common Pitfalls

• APNS Certificate Renewal: Forgetting to renew your Apple Push Certificate will silently break device communication. Schedule reminders and automate renewal if possible.
• SSL/TLS Misconfiguration: Apple devices require strict HTTPS for enrollment and ongoing management. Self-signed or expired certs will cause profile install failures.
• No Web Console: Out-of-the-box, MicroMDM is API/CLI only. For help desk or non-technical staff, you’ll need to deploy an open-source UI (e.g., MicroMDM WebUI) or develop internal scripts.
• Limited Support and Documentation: Community-driven support can be slow. Review the user guide and contributing docs before production rollout.
• Lifecycle/End of Life: MicroMDM v1 is in official maintenance mode until end of 2025; plan to evaluate NanoMDM or commercial MDMs for future needs.

Pro Tips

• Automate routine tasks (e.g., onboarding, offboarding, compliance reports) using the REST API and webhooks.
• Backup APNS certificates and MDM data securely—loss means re-enrollment of all devices.
• For BYOD scenarios, communicate clearly about what MDM can and cannot see or control on personal devices. See also our privacy-focused deployment analysis.
• Test upgrade and migration paths on a handful of devices before scaling to the entire org.

Conclusion and Next Steps

MicroMDM gives small teams the power to manage Apple device fleets without SaaS lock-in or recurring costs. If you have the technical skillset, it’s a robust, production-ready choice for organizations under 50 users—especially when privacy, cost, and custom workflows matter. However, with official support for MicroMDM v1 ending in 2025, you should plan for eventual migration to NanoMDM or a commercial MDM as your business grows or compliance requirements evolve.

For deeper MDM platform trade-offs, security templates, and enrollment strategies, see our comprehensive MDM and BYOD guide. If you’re interested in embedded device management, check out our analysis of AngstromIO Devboard for embedded intelligence.

For practical Linux and device orchestration tips, see our resources on container lifecycle management and hardware hotplug event handling.

Start with a proof-of-concept on a single device, document your workflows, and keep an eye on the evolving NanoMDM ecosystem for the future of open-source Apple device management.

Sources and References

This article was researched using a combination of primary and supplementary sources:

Primary Source

This is the main subject of the article. The post analyzes and explains concepts from this source.

• GitHub - micromdm/micromdm: Mobile Device Management server · GitHub

Supplementary References

These sources provide additional context, definitions, and background information to help clarify concepts mentioned in the primary source.

• MD&M West | February 3-5, 2026
• Minnesota Department of Health says 'theatre nights' in bars are not exempt from Freedom to Breathe Act - Wikinews, the free news source
• Show Information | MD&M West
• Sectors Overview | MD&M West
• MedTech | MD&M West