How does one actually remove an application?

[Richard_W]

In theory removing an application seems fairly straight forward, but I have not managed to successfully do this on any Mac, am I missing something (see the theory below)?

Deployment of applications fine, removal; nada.

Remove Profiles/Apps from a Group of Devices

When one or more profiles/apps must be removed from multiple devices, there are several possible methods:

• Modify the scope of the profile(s)/app(s) to no longer include the devices
  Note: Once a device is out of scope, it will no longer appear under the Clients in scope section of the profile/app page
• Modify tags on devices to remove them from the scope of the profile(s)/app(s)
  Note: Once a device is out of scope, it will no longer appear under the Clients in scope section of the profile/app page
• Force uninstallation of the app from select devices (does not apply to profiles)
  1. From the Systems Manager > Manage > Apps page, select the app to be removed.
  2. Under the Clients in scope section, tick the checkbox next to any devices that should have the app removed.
  3. Select Systems Manager > Manage > Uninstall. 
     Note: For app removal from the device to be permanent, it may be necessary to remove the device from scope as well. Otherwise, the app may be reinstalled later.

[Network-dad]

I've Always added and removed apps via tags ( remove the tag the app will uninstall) .... also I've hide apps using the profile settings 

[Network-dad]

Also in all my apps, I have the Auto-install / auto-uninstall  checked

[Richard_W]

@Network-dad And this would be how I have it set up, I've tried removing TAGs and whole app and yet they stubbornly stay put. I can deploy with no issues. I can see VPP license allocation but when I remove the tag, no revoking nor removal. I do see on the app page under status that the machine has been removed, but the app is still physically on the machine and in the SM Apps list of the machine even after TAG removal. I'm using device assignment.

Have you tested this recently, just so I can get a feel that it actually is working.

I already did a case a while back with no resolution, so here I am looking for feedback to bolster my next case.

[Network-dad]

@Richard_W  are your devices supervised in DEP?

[Richard_W]

I'm looking at Macs in particular, I have a mixture of DEP enrolled and not, all Macs are not supervised.

[Network-dad]

If they are running macOS 10.15 Catalina, then they will need to be supervised to be able to remove applications..

Same with IOS devices, anything thing iOS 13 and higher will require them to be supervised to remove applications...

[Richard_W]

10.14

[Network-dad]

After doing a quick google serch it looks like it still may be an issue to do with the device not being supervised... apple really cracked down on this a little while back and it sounds like other people are having the same issue. 

[Richard_W]

…and how does one actually supervise a Mac, I know you can to an iOS device?

[GrldP]

You basically can’t do this after they were bought, no secret sauce of Configurator trick, and despite claims from AppleCare (Business) we never managed to have a single Mac put into DEP ever. 

Were one to know the magical keywords to have AppleCare do it, please STW! 

[Richard_W]

So therefore my Macs are supervised, given your definition, as they are mostly in DEP. And yet I still can not remove an app.

[Network-dad]

well, it sounds like they are actually not supervised.. here is a great article about Meraki DEP supervised devices... https://documentation.meraki.com/SM/Profiles_and_Settings/iOS_Supervision

We have several supervised and non-supervised devices in our MDM and non-DEP devices... and definitely the non Supervised devices have half the features as the supervised ones...

[GrldP]

Part of the answer for macOS lies here:

https://documentation.meraki.com/SM/Apps_and_Software/Deploying_OS_Updates_with_Systems_Manager

and there:
https://documentation.meraki.com/SM/Device_Enrollment/Systems_Manager_Agent_and_MDM_Profile_Enrollme...

But no specific details about app removal.

[Richard_W]

@GrldP see top of page on how it's supposed to work. Supervised or not it should work (I understand the difference when it comes to iOS devices but then we are really looking at BYOD). Enrolled in DEP or not it should work for macOS too.

What I would like to see is if anyone that has a macOS client is able to add a VPP app and then remove it via SM.

[GrldP]

I have the same interrogation than you have, I never had an app uninstalling by itself on any Mac, not sure what I’m doing wrong… 

[Network-dad]

I just found this interesting Meraki Blog article stating that with the new IOS it requires supervision... this maybe your issue if your devices are not in DEP or supervised. here is the article https://meraki.cisco.com/blog/tag/mdm/

Are you excited about all the new Apple innovation coming in iOS 13 and macOS 10.15 Catalina? Great, so are we! Both iOS 13 and macOS Catalina are introducing significant changes to Apple’s enterprise management capabilities and we are excited to announce that Cisco Meraki Systems Manager will support new settings and features on both platforms. Here are some of the planned changes coming to Meraki Systems Manager to support iOS 13 and macOS Catalina.

Changes to Device Restrictions

Between iOS 13 and macOS Catalina, Meraki Systems Manager will support a grand total of seventeen device restriction settings changes.  The changes include six new restriction settings and eleven settings that are changing supervision requirements.  

New Restrictions

• Allow Find My Device in the Find My app (iOS)
• Allow Find My Friends in the Find My app (iOS)
• Force Wi-Fi power on (iOS)
• Allow Files Network Drive Access (iOS)
• Allow Files USB Drive Access (iOS)
• Allow continuous path keyboard (iOS)
• Allow Handoff (New to macOS)

Supervision Requirement Changes

Now Requires Supervision:

• Allow adding Game Center friends 
• Allow installing apps
• Allow use of camera
• Allow cloud Keychain sync
• Allow document sync 
• Allow explicit music and podcasts
• Allow use of iTunes Store
• Allow use of Safari
• Allow users to use saved passwords in Safari and AutoFill Passwords feature
• Allow Facetime

[jm_peterson]

The easiest way would be to completely bypass Systems Manager and use a Software Management software that actually works like Munki.