Actually Intune handles MacOS reasonably well, you don’t need Jamf; that’s the way we went, and it’s okay-ish for the most part. By far the annoyingest thing is getting Macs bought before we went down the Business Manager integration route into MDM.

You think there’s a standard way to do that? Just install company portal? That worked in exactly 1/20 cases. It’s an exciting new error on every single device. Awful. Just awful.

Totally agree on the hidden costs. We've seen some great value in going with Mosyle for this. Lots cheaper, and it "just works."

https://mosyle.com/

The only thing you need out of any of those to correctly support the Mac is an MDM, of which there are free ones and expensive ones and everything in between. So long as it can deploy configuration profiles and declarative management configs, you can spin up Munki to be your pkg/script runner and script the rest. Installomator to install and patch applications.

But if you also wanted identity, there are plenty of free selfhostable SSO/ID providers out there. If you're just starting out and not at the scale where a big Microsoft CoPilotM365OfficeWhatever contract makes sense, you probably don't even really have a need for a lot of this stuff. A minimum contract for Jamf Pro is like $5k a year or something. That's two well kitted developer MacBook Pros per year in license costs.