Single big profile vs several smaller profiles?

[vanschip-gerard]

When I first started using Jamf I created a BIG profile with everything configured. But as my pool of machines grew I needed custom profiles for other types of users which meant if I had a small change that applied to all I had to update several profiles so I started splitting them up.

I would like to know if there is a performance impact on having a dozen profiles over 1 profile. Tried to google this but using those words gets me a lot of unrelated results.

[Hugonaut]

no performance issue.

best practice is to create individual configuration profiles for individual panes, ie security, kexts, restrictions, etc.

[kfjamf]

Agree, performance not as issue, but best practice for future troubleshooting is to have payloads as split as possible.

For Restrictions it helps to remember that you can have overlapping settings and the systems should(test!) honor the most restrictive permission set.

[vanschip-gerard]

Awesome, thanks guys. Its nice to know you are doing something right.

[gachowski]

I would recommend that you set a single setting per profile and manually build the profiles outside of your MDM then sign them before you upload them. You can easily sign them with Apple Configurator. This prevents any hidden key changes by Apple effecting the profiles and makes it very easy to troubleshoot.

C

[tlarkin]

The problem is that if you have multiple payloads of the same payload they can conflict. For example, restrictions is notorious for this in jamf. They follow the Profile Manager model of putting every key in a payload, even though you don't need them. Which is something I hope they fix and remove.

This is why these feature requests exist.

Vote them up, email jamf and ask for them, and tell anyone at jamf that you would like to see these features added. Sometimes, having a bigger single one is actually better because of conflicts. Your results may vary as well.

[jared_f]

I split every thing off into its own separate profile will well written titles and notes. Easy to exclude specific users/machines from things. I second @tlarkin, those panes needs to be separated out!

[sdagley]

@vanschip-gerard Take a look at @erikberglund's ProfileCreator tool as an alternative to the Configuration Profile GUI in Jamf Pro. As @gachowski mentions you'll definitely want to sign profiles you create with ProfileCreator otherwise Jamf Pro can mangle them on upload.

[scottb]

I think it's easy from an OCD perspective to look at the Profiles pane in System Preferences and cringe seeing 50 of them there, but I wholeheartedly agree with the above in creating individual Profiles. While "one" might look nicer, it's also just not as smart for updating and troubleshooting - less versatile as well.
Starting with a bunch of them means you can mix and match any given combo to any given user/group.