Before you make any changes:   Do you already have a restrictions policy applied to devices? I want to make sure that this is the cause of the issue Do you wish to make changes to just your device, or every device? ... View more

  Is what your company likely has set. ... View more

You company has enforce what is called Containerisation (apple call it Managed Open In). You'll be able to see this restriction under Settings > General VPN and Device Management, MDM profile, restrictions   There's no workaround for this: I'd contact your MDM admin and discuss your use case ... View more

Systems Manager supports the ability to prioritize apps with different App Store update policies:     This should get the SM app updated just as quick as possible.   ... View more

So, as each device enrolled through DEP will also be Supervised, you can look for:     You can also, in the device list, hit the + button and choose "Supervised" or "DEP Enrolled" if you want to search between the two enrollment types ... View more

The only way to achieve this is to use managed apple IDs, which is currently only achievable for User Enrollment and Shared iPad enrollment types   Outside of these use cases, you can only BLOCK the ability to Manage account settings, including Apple ID   As @BlakeRichardson mentioned, this is an Apple limitation not Meraki ... View more

Hello all.   So, there's quite a lot to get through here. I'm going to start with web content filtering on the MX...   https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Content_Filtering is a great article showing you how you can configure your MX to do content filtering   So, any devices that connect through the MX will be made to follow these rules. Great!   However.... What if a device is NOT on your network. Given Hybrid working, this is a greater probability than it used to be.   So, there's a couple of options here:   1. Use either: a. Web content filtering for iOS: https://documentation.meraki.com/SM/Profiles_and_Settings/Web_content_filtering_on_iOS_devices_in_Systems_Manager b. Chrome content filtering on Android: https://www.youtube.com/watch?v=Adbh_HMZ2j4   Both of these have their limitations   So, the better option:   2. Use Umbrella provisioned on your end devices. You can use Systems Manager to push the apps and configuration needed to protect your devices when they are both on and OFF your network: https://www.youtube.com/watch?v=y1al5qfVTRA   I hope that this helps answer your question.   Paul   ... View more

On iOS, no.   HOWEVER: iPads do support ethernet so there's a possibility you could plug in a USB-C to Ethernet adapter to get them back online without a reset   For the future, I always suggest that you provision the devices with TWO SSIDs, one of them being a guest SSID. The iPads will naturally default to the most secure security on an SSID, but, if that's not available, should then join the Guest WiFi, allowing for continued connectivity.   Hope that helps ... View more

Hi @CTL    This feature should be with us shortly. I don't have a date, but it's currently in development. ... View more

I received confirmation that a new version of the SM Android app 5.8.2 was released last week and should resolve this Kiosk mode exit issue. It may some time for Google to froll out the app if you cannot find the updated version.... ... View more

Hi Kevin,   that's an interesting use case.....   I'm sure that there's something better we could be doing, which I'll feed back to the team, but, in lieu of this....   We've a couple of steps which will involve the use of Security Policies and Dynamic Tags   1. Security Policy If you navigate to Systems Manager > Policies on your dashboard and click + Add New   Give the Policy a name, such as KioskApps   Tick Mandatory Apps and then type in the names of the Apps you need to have installed before Kiosk Mode is initiated   Click Save         2. Dynamic Tags In you Android Setting for Kiosk Mode, click on Profile Configuration, and under Targets, change the scope to With Any / All of the Following tags (your choice, depending on whether you already have some tags created)   Under Policy tags, start typing the name of the security policy you created in #1 (KioskApps, in my case) and select the option with Compliant     Click Save   The logic is this: when SM detects that all of the apps needed for kiosk mode are installed, it will then mark the device as compliant against the security policy and, therefore, install the Kiosk Mode setting   There may, obviously, be some latency between the apps installing and kiosk mode initiating, as SM has to wait to get an inventory back from the device informing it that the apps are installed.   Let me know how you get on     ... View more

@Hassen    Firstly, what's your device type? If Android, you HAVE to be explicit with regards to restrictions: For a fully managed device, if you haven't put a restriction on the device to ALLOW the installation of apps, then you won't be able to install apps   ... View more

So....   Firstly it's not just a case of dropping your plist into the right directory. Be very mindful of:   ensuring that you do a :     chown root:wheel yourplist.plist and chmod 644 yourplist.plist   on your plist after you've placed it into the right location   Secondly: LOG! If you're not already doing this, then include the following keys and values in your plist   <key>StandardErrorPath</key> <string>/tmp/mylaunchdaemon.err</string> <key>StandardOutPath</key> <string>/tmp/mylaunchdaemon.out</string>  Thirdly: Deployment: Meraki Systems Manager looks for the bundle ID to detect whether or not an "app" has been installed successfully. Make sure you get this right to ensure SM knows that your apps have been installed ... View more

Wasn't aware that the "homepageisnewtabpage" flag was Dev only, so thanks for pointing that out. As the description above is hosted in Google Play (That's where the managed app config descriptions come from), and there's obviously a deficiency in Google's Chrome which doesn't fit your use case (a use case that I fully understand), then you have two options   1) Use a product whose sole purpose is a browser that can be systematically control through managed app config 2) Raise your requirement with Google and have them create a feature request   As per your last point: There are many people who wish to manage Chrome on Android. I felt that giving some context as to why it appears not to be possible would be helpful for them ... View more

There isn't a limit set by Apple   Sounds like a bug to me, although let's not rule out application issues also ... View more

So, there's a fair bit to get through here.   By default, the Systems Manager app, which provides jailbreak detection, location and the ability for users to chose from a list of apps, is installed. Now, if you don't have VPP set up (more of which here: https://documentation.meraki.com/SM/Apps_and_Software/Apple_Volume_Purchase_Program_(VPP) ) then the device will request an iTunes account   To avoid this, there's three things you can do 1. Change the Targets of the systems manager app in the dashboard to No Devices 2. Ensure that VPP is set up 3. Go to the systems manager app in dashboard and set, under Licenses, Purchase method to VPP device assignment:   ... View more

The only way to do this is Home Page layout. It not only allows you to manage folders and apps, but also web clips!   Needs a supervised device, however:   ... View more

I'd use a quota size and temporary session timeout to ensure that data is cleansed. However, due to the way that DEP profiles are installed, you'd need to do a device wipe   ... View more

In the list of settings I found, as you did.   HomepageLocation   Setting the policy sets the default homepage URL in Google Chrome. You open the homepage using the Home button. On desktop, the RestoreOnStartup policies control the pages that open on startup. If the homepage is set to the New Tab Page, by the user or HomepageIsNewTabPage, this policy has no effect. The URL needs a standard scheme, such as http://example.com or https://example.com. When this policy is set, users can't change their homepage URL in Google Chrome. Leaving both HomepageLocation and HomepageIsNewTabPage unset lets users choose their homepage. On Microsoft® Windows®, this functionality is only available on instances that are joined to a Microsoft® Active Directory® domain domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS, this functionality is only available on instances that are managed via MDM, or joined to a domain via MCX.   I've highlighted two bits of the text that appear relevant.   There appears to be more detail here: https://chromeenterprise.google/policies/       ... View more

So, here's a thought: You get both LAN and WAN IP address via the API... It wouldn't take much coding to use the Devices API to get the IP address of every device, and set a tag based on compliancy against IP address.... It would save you having to do this through the UI, and means you could run it several times a day.... Let me know if this is something you'd consider... ... View more

Wanted to add to what @BlakeRichardson said: Don't rely on the Apple Configurator provisioned WiFi profile still being there after enrollment. Ensure that you also provision a WiFi profile through SM too.   Also, SM cannot remove a profile it didn't install. ... View more