TSA Exit Acceleration
Off the seller’s Apple management. Owning its own fleet from Day One.
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
Jamf TSA separation is the work of standing up a dedicated Newco Jamf instance, establishing Newco ownership of the Apple devices in Apple Business Manager, rebuilding the configuration and policies, re enrolling the fleet, and exiting the seller instance before Newco Macs and iPhones keep reporting to the seller management. The work sits inside the broader carve-out advisory program because Apple device management has a unique ownership layer that does not move by copying a console. Treated casually, it leaves Newco Apple devices tied to the seller Apple Business Manager and outside Newco control.
Jamf separation starts with an inventory of the seller Jamf instance, whether Jamf Pro in the cloud or self hosted. The buyer needs the managed Apple device estate, the smart and static groups, the configuration profiles, the policies and scripts, the application deployments, the patch management, and the integrations into identity and other systems. Jamf manages the Apple fleet that runs much of the workforce, so the inventory maps how every Mac and iPhone is configured.
The defining constraint sits below Jamf, in Apple Business Manager. Apple devices purchased into a company are assigned to that company Apple Business Manager, which is what enrolls them automatically into the management server. A carve-out must establish Newco ownership of its Apple devices in a Newco Apple Business Manager, because the management console can be rebuilt but the device ownership record is the layer that actually controls automated enrollment.
The clean end state is a Newco Jamf instance bound to a Newco Apple Business Manager, managing Newco devices under Newco policies. A shared seller instance and Apple Business Manager are acceptable only as a bridge during the TSA, because the seller otherwise owns the device records, controls enrollment, and can wipe Newco devices.
A clean inventory drives the sequence: the Newco Apple Business Manager and Jamf build, the device ownership transfer, the policy rebuild, the re enrollment, and the cutover. Because the ownership transfer is the gating step, the inventory establishes exactly which devices must move in Apple Business Manager.
Jamf is licensed per device, often inside a broader seller agreement. That agreement does not transfer in a carve-out. Newco signs a direct subscription sized to its real Apple device count and the products it needs, whether Jamf Pro for management alone or the protection and connection products alongside it. The risk is that Newco inherits a product set scaled for the seller estate.
Jamf reads a carve-out as a buyer that must manage a defined Apple fleet. Negotiating leverage comes from the device commitment and from a credible alternative Apple management platform. The buyer scopes the Newco subscription from the device inventory before negotiating, and writes onboarding support into the contract so the instance and its Apple Business Manager binding are validated before cutover.
Where the seller continues to manage Newco Apple devices through a TSA period, the pricing is cost-plus or fixed-fee with a defined exit ramp, and the TSA defines who administers Newco devices, how endpoint data is returned, the wipe boundary, and the timeline for the Apple Business Manager device transfer. The Apple ownership transfer is named explicitly because it is the step that actually releases the devices.
Implementation, where a partner is engaged, is fixed fee for defined deliverables under disciplined change control. A Jamf stand up and a fleet re enrollment have a finite scope, contracted against named policies, applications, and a device count rather than open ended consulting time. The engagement model is Fixed Fee plus Portfolio Retainer.
The device ownership transfer in Apple Business Manager is the step that makes a Jamf separation different from any other endpoint move. Devices assigned to the seller Apple Business Manager must be released and reassigned to the Newco Apple Business Manager, either through the reseller or distributor that supplied them or through the device transfer process between organizations. Until a device sits in the Newco Apple Business Manager, automated enrollment still points at the seller.
The transfer is constrained by how the devices were purchased. Devices bought through a reseller linked to the seller account need that reseller to move them, and devices bought directly have their own path. The buyer establishes the Newco Apple Business Manager early, confirms the reseller relationships, and works the transfer of records so the devices land under Newco before re enrollment.
Automated Device Enrollment depends entirely on this ownership. The enrollment profile that auto enrolls a wiped device into Jamf is driven by the Apple Business Manager assignment, so a device reassigned to the Newco Apple Business Manager and given a Newco enrollment profile provisions into the Newco Jamf instance, while a device left in the seller Apple Business Manager keeps provisioning into the seller.
The buyer documents the device transfer so every Newco Apple device is accounted for, and treats any device that cannot be transferred, such as a personally enrolled device, as an explicit exception with its own approach.
Configuration profiles and policies are rebuilt in the Newco Jamf instance. The profiles that set security baselines, restrictions, and certificates, the smart groups that scope policies to the right devices, and the scripts and policies that enforce configuration are recreated so Newco manages its Macs to its own standard. The buyer reviews the seller configuration, keeps what fits, and retires the complexity the standalone business does not need.
Application deployment is rebuilt. The applications Jamf delivered, whether from the App Store through Apple Business Manager, packaged installers, or managed updates, are recreated in the Newco instance with their scoping. An application that deployed automatically in the seller instance does not follow the device, so the deployment is rebuilt and the App Store apps are re purchased or reassigned in the Newco Apple Business Manager.
Identity is reconnected so device enrollment and user accounts authenticate against the Newco identity provider. Jamf Connect or the enrollment customization that tied devices to seller identity is rebuilt against Newco, so users sign in to their Macs with Newco credentials. The work parallels the broader Okta identity separation that the enrollment experience depends on.
Patch management and update enforcement are recreated so Newco keeps the fleet current. The update policies that governed macOS and application versions are rebuilt so devices stay patched under Newco management rather than drifting after the move.
Cutover moves the Apple fleet from seller management to Newco management, gated by the Apple Business Manager transfer and completed through re enrollment. Because device management is a security control, the cutover is sequenced so devices stay managed through the move, and the runbook covers the device transfer, the policy activation, the application deployment, the re enrollment waves, and the support plan for users.
Validation confirms management works on real devices. A re enrolled Mac sits in the Newco Apple Business Manager, reports to the Newco Jamf instance, receives its profiles and applications, and authenticates against Newco identity. The buyer validates a device end to end, from Apple Business Manager assignment through enrollment to policy, before scaling the re enrollment across the fleet.
Stabilization runs while the fleet completes re enrollment. Devices stuck between Apple Business Manager records, missing applications, and identity failures are triaged within agreed service-level commitments, and the buyer tracks the share of the fleet reporting to the Newco instance. Only when the fleet has moved and reports healthy does the buyer certify Apple endpoint management for TSA exit.
Decommissioning the seller management is explicit. Once Newco devices sit in the Newco Apple Business Manager and report to the Newco Jamf instance, and the TSA tail closes, the seller releases any residual device records and confirms it can no longer manage or wipe Newco Apple devices.
Jamf separation cost is driven by the per device subscription and by the labor of the Apple Business Manager transfer and fleet re enrollment. The discipline is to size the subscription and products to Newco real needs, establish the Newco Apple Business Manager and work the device transfer early, and plan the re enrollment logistics because the device count and geography drive the effort.
The common failure mode is rebuilding Jamf but ignoring Apple Business Manager. The console can be recreated quickly, but devices left assigned to the seller Apple Business Manager still auto enroll into the seller, so the separation is not real until ownership transfers. Buyers that establish the Newco Apple Business Manager and work the reseller transfers first avoid devices that cannot cleanly re enroll.
The common timing mistake is starting the Apple Business Manager transfer too late. The transfer depends on resellers and Apple processes that take time, so the fix is to begin it early in the separation. A PMO maintains the dependency map across Jamf, Apple Business Manager, and identity, escalating blocks inside forty eight hours.
A clean Jamf separation produces a Newco that owns its Apple devices in its own Apple Business Manager, manages them in its own Jamf instance, and has a seller that can no longer touch the fleet. The discipline runs through the TSA exit acceleration program under a Fixed Fee plus Portfolio Retainer engagement model.
Because device ownership lives in Apple Business Manager, not in Jamf. Automated enrollment is driven by which Apple Business Manager a device is assigned to, so a device left in the seller Apple Business Manager keeps auto enrolling into the seller even after the Jamf console is rebuilt. The separation is only real once the devices are reassigned to the Newco Apple Business Manager.
Yes. A device managed by the seller Jamf instance must enroll into the Newco instance, and the clean approach pairs the Apple Business Manager reassignment with re enrollment, often through a wipe and Automated Device Enrollment for a clean state. There is no console to console move that carries managed devices across organizations.
The Apple Business Manager device transfer and the fleet re enrollment. The transfer depends on resellers and Apple processes that take time, and re enrollment touches every device, so most buyers plan three to five months and start the Apple Business Manager work early.
While the seller Jamf instance still manages a device, it can wipe it. The TSA defines when seller management rights end so the seller cannot wipe a Newco device after it has moved, and the buyer confirms devices leave seller management on schedule.
Tenant strategy, the device re-enrollment, and the conditional access rebuild.
Read the article →The endpoint strategy, the device estate, and Day-One management for Newco.
Read the article →Tenant strategy, the user and app move, and the federation rebuild for Newco.
Read the article →The 90-day governance, IT, finance, HR and procurement separation plan we run on live carve-outs. Get the playbook plus the bi-weekly Day One Letter — short, signal-heavy, buyer-side.
No spam. Unsubscribe in one click. · Read the overview first →
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
Seven buyer-side moves to exit a Transition Services Agreement on time and below budget. The mark-up, the extension-fee curve, exit sequencing, and the 11-month calendar.
Stand up standalone IT before the TSA meter and the seller's dependencies compound against you.
One tactic, one benchmark, or one pattern from a recent buyer-side engagement. Short. Signal heavy. Free.
Subscribe to The Day One Letter →