Our University policy states that all business should be conducted on compliant devices and/or on managed services.

If a member of staff or PGR colleague is impacted by these changes you can make a request for an alternative managed Windows or Linux device or a replacement managed Mac device based on the suitability of the device to the demands of the role.

The IT purchasing policy (last updated March 2023) allows the core budget to provide "one device (a laptop or desktop) per member of staff or PGR", and this includes Mac devices "where research and/or teaching demonstrates a need." This would also include professional services staff where there is a business need to use macOS. 

Colleagues will appreciate that Mac devices can be more expensive than Windows or Linux and purchasing decisions should only be based on business need rather than a preference.

If your role qualifies you to have a University-managed computer and you do not have one, you can request one by following the purchasing guidance on the Buying IT pages.

Lecture theatres, study spaces and teaching spaces are catered for within this core (ie. non-school budget) already.  Additional research-only devices normally would come from grants but are still subject to the key principles of IT purchasing and would still be required to meet all Information Security Policy requirements or placed onto a research-only network.

‌‌‌

To ensure that the University can meet the Cyber Essentials requirements it is necessary for all devices to be under some form of centralised management.

We now need to accommodate some changes for Macs.

The decision was made by the Academic Leadership Board and Operations Board. The Information Security Policy is owned by the University Executive Board and this decision is in line with this policy. 

Much of our research and third-party funding relies upon the University maintaining Cyber Essentials. This was due to a requirement of the Public Procurement Notices (PPN) issued by the Government for any organisation in the Government supply chain - with includes both the research councils and the University taking on grants.

The PPN was changed in September 2023 - after direct lobbying by the University - to allow for alternatives to Cyber Essentials however it is noted it may take many years for existing contracts to complete and for frameworks to change their inclusion of these terms. This is outside the control of the University.

Please move all University data to OneDrive or your departmental filestore.

Any processing or storage of University information using personally owned devices must comply with the University’s Mobile and Remote Working Policy (ISP-14).

No. Those web applications are still in scope for Cyber Essentials and require you to authenticate (log in) using your University ID.  It is at the point of login that a check of the device is made no matter whether the service is located on campus (for example, MyERP) or in the cloud (for example, Outlook or Blackboard).

‌No. Whilst the virtual machine (including Engineering and Open Access Virtual Desktops) may be compliant with CE, the underlying operating system must also be compatible and the University cannot make a technical check for that Mac compatibility at the point of login. Further investigation into whether there is a method for making this form of access compliant.

Yes, you can. 

1. Sign in to Company Portal for macOS.
2. Go to Devices and select the device you want to unenroll.
3. From the app toolbar, select the Devices menu > Remove.
4. When asked to confirm the removal, select Remove. The device is immediately removed from Intune.

‌No. ‌‌You will register your wish to be enrolled and will be contacted with a time window in which you can enrol your device using the instructions provided. This can be done away from Bristol. Support will also be available from the IT Service Desk. 

• The management DOES NOT ALLOW the University to see: personal files, browsing history, open emails or contacts, personal passwords nor what applications are installed (other than those provided by the University).
• The management DOES ALLOW the University to see: operating system version and whether you have a device password set
• The management DOES ALLOW the University to wipe your computer remotely if needed. However, by policy, this would only happen after you directly and in writing request that action (for example it were stolen).

No, Mac devices can only be managed by one organisation. If your device is already managed by another organisation, it cannot be enrolled for management by the University of Bristol unless you de-register from the other organisation (preventing you from accessing data from that organisation) and register with Bristol.

No. Enrolment checks that the operating system of your device meets the latest available version and security patch and where they are not in place the device will be blocked from access until it is updated.

If you are running software that is not compatible with supported operating systems then the device should not be used to access University services (as per Information Security policy) as it presents a very real cyber risk.

You should not be saving or using University data on a personal device if you have not enrolled your device (see guidance above). This also means you should not be moving data from University systems onto a portable device to access from your personal device.

If you find you still need to move University data from your personal device back to University services please ensure you follow the Information Handling Policy (ISP-07) and only use portable media (USB memory stick or drive) that has been purchased through IT Services.

No. The Mozilla Thunderbird email client is not supported on macOS devices and will not work. There is a configuration made by Mozilla which is currently incompatible with the University systems, and until it is resolved by Mozilla, it will continue not to work.

The University's supported email client is Microsoft Outlook.

‌‌‌

Those with Self Service installed

1. For those with 'Self Service', please use the 'Company Portal' (also installed) to check that you are 'enrolled with Jamf Device Compliance'.

You will need to update to the Jamf management platform

The process involves a few steps which includes removing content from your device, setting up the new operating system, and registering for compliance. 

1. Follow guidance on the page migrate your macOS device to the current management platform for instructions on how to erase the content on your device and upgrade. Please read the Important Notes section at the top of the page and make sure you back up data to OneDrive.

2. Once you have completed step 1, you must set up your device as if it were a new device. Follow the instructions on setting up a new device. We advise printing a copy of this or having another device available to view the guidance.

3. You will then need to register your device to be checked for compliance. See the instructions on registering for compliance.  

Please read through all the documentation in advance. 

If you require any assistance, please contact IT Service Desk or visit the IT Counter.

If you have a University Mac computer with Self Service installed

1. Please restart your computer. 

2. Re-register your University provided Mac computer for compliance by following the instructions at How to register your macOS device to check compliance. 

3. To allow compliance checking applications and browsers will ask you to allow access. Examples of these popups can be seen below. Please approve these requests. Submit your device password and select Always Allow. If you have any issues with the password for these requests please contact the IT Service Desk.

Please be aware that compliance checking for main staff and PGRs is done on an individual basis.  This means that if main staff and PGRs use an open access Mac computer in teaching spaces or have a shared device in an office, each person will need to register when they login.

To register, simply follow the instructions on this page.

If you have a University Mac computer with Service Center installed

Please follow the instructions on this page.

If you have a personal Mac computer that you have registered for compliance

Please contact the IT Service Desk for guidance.

If you have a personal Mac that you have not registered

Please follow the guidance above.

If you have a University Mac computer with Self Service installed

1 Please restart your computer. 
2 Re-register your University provided Mac computer for compliance by following the instructions at How to register your macOS device to check compliance.  
3 Applications and browsers will ask you to approve access for compliance checking. Approve these popups ‌to Always Allow.

Please try an alternate browser or clear the browsing history and try again on the browser that is not allowing access. We recommend using Edge or Safari to access corporate resources as they support compliance checking.