Meraki

Melissa · ‎Mar 19 2018

That's a good point - I'll talk to the team about updating this! This is the current page - https://documentation.meraki.com/SM/Tags_and_Policies/Security_Policies_in_Systems_Manager I agree it's missing some common uses and basic explanations on how to use this feature. Thanks for flagging this!!

Melissa · ‎Mar 16 2018

@PhilipDAth - also, if you set a Policy that scans for "Antivirus" and call it "Antivirus", you will see the option for "Antivirus Compliant" in your main clients page! (like below) This will also be a dynamic tag you can search by/reference in your Tags management page (if you have this turned on). (like this below)

Melissa · ‎Mar 16 2018

@PhilipDAth - thanks for posting this!! The "Compromised" check currently available in SM Policies scans for rooted or jailbroken mobile devices. That's what we mean by "Compromised" - it's specific to those device types. What were you thinking "Compromised" would entail/mean for Windows devices? I wonder if there is another way to do this.

Melissa · ‎Feb 6 2018

@jared_f Yes! Security Connector is basically an app that combines the Cisco Amp for Endpoints product (called "Clarity") and Umbrella (formerly Open DNS). Systems Manager can be used to manage all products in one interface, as well as automated deployment of Security Connector app itself. Here's some more info and use cases - https://blogs.cisco.com/security/now-available-cisco-security-connector-for-ios Here's a link to our guide - https://documentation.meraki.com/SM/Apps_and_Software/Cisco_Security_Connector_(CSC)

Melissa · ‎Feb 6 2018

@jared_f Good points!! I would always recommend that wifi configuration profiles are made without any other settings applied. The reason being - if you add a long list of settings to a configuration profile and need to change anything that profile, when the profile is refreshed, this could affect connectivity to the wifi networks configured in that profile. It would basically "reset" anything in the given profile. I would also recommend making any configuration profiles with Active Sync separate as well - for the same reason! When refreshed, a configuration with Active Sync or mail (if using App settings instead to configure mail accounts) can prompt the user to re-input their password.

Melissa · ‎Feb 6 2018

@soomeGUy Have you had any luck playing around with this? In reading your post a few things jump out to me: 1 - If you enforce wifi whitelisting without first having installed wifi configuration profiles on devices, this would likely cause problems (as the device can only connect to configured wifi networks, and if not installed...there would not be any). 2 - Does wifi whitelisting solve your DNS issue? 3 - Would using a proxy or content filter help? (Settings>Restrictions>ios restrictions (supervised)) Lastly...if all else fails, have you seen anything about Cisco Security Connector? This is a new product that integrates Umbrella and Clarity for supervised iOS devices. It might be what you are looking for! https://meraki.cisco.com/blog/2017/12/cisco-security-connector-now-available/

Melissa · ‎Feb 6 2018

It looks like the change happened on 11/29/17 - any devices using version 4.0.1 of the SM App should have this automatically disabled.

Melissa · ‎Feb 5 2018

@JoshH Good news! For all new devices enrolling in Android for Work, factory reset protection is automatically disabled. This was a fairly recent change in SM!

Melissa · ‎Feb 2 2018

That's great news!! Happy to help 🙂

Melissa · ‎Feb 1 2018

Quick check - is it possible a configuration setting for Privacy is active on these devices? This could affect SM's ability to track location. Under Settings>Privacy...looks like this:

Melissa · ‎Feb 1 2018

This could definitely be clearer on our side! AFW will use the same default network as set for Apple, under Organization>MDM. Set the default network here, even if you don't have a DEP token to submit.

Melissa · ‎Jan 31 2018

Understood - it sounds like Apple is aware of the issue and may fix it at some point... In the meantime, the main complaint I hear about this is around losing is text history. If your users absolutely need to save this - there are other ways to do it. I've seen people use 3rd party programs like TouchCopy to download texts from a device before wiping it. For any in-app data, they can still backup to iCloud before wiping on a per-app basis and sync those apps AFTER set up. They would just not be able to use the "restore from backup" option in the initial set up steps (which I would recommend you hide/skip when applying DEP settings). It's not an ideal solution, I understand!

Melissa · ‎Jan 29 2018

Hi @CherylA - so sorry for the delay. The key piece I've learned in this thread is that it is possible to use "restore from backup" and supervise a device, but only if the backup is made on a different device than the one you intend to supervise. It does not seem that this process works on all models, as you were unable to restore from backup and apply supervised settings when moving from an unsupervised iPhone 6 on an iPhone 8. To be honest - the majority of folks I work with that ask this question (about restoring from backup) are trying to supervise the device they have in hand. In that case, I think we've determined the above process will not work for them.

Melissa · ‎Jan 29 2018

Hi @jared_f! I think this feature will help. On your apps page, select "Try the new version!" Then you'll see this option to import apps from VPP:

Melissa · ‎Jan 22 2018

@jared_f I doubt that's the issue. Here is what I found out from Apple on this process: "https://support.apple.com/en-us/HT204142 Here is a key piece: 'If you erase the device and restore the backup, the device remains unsupervised and the user can remove management. If you restore the backup to a different device that is assigned to the server, the device is supervised and the user can’t remove management.' Essentially, for you want to restore an iCloud backup, you need to restore it to a different device to retain Supervision and DEP." @CherylA This would explain your results as well!! It sounds like this is something Apple is trying to fix. Hopefully there is a better solution soon.

Melissa · ‎Jan 19 2018

@PhilipDAth I laughed 😉

Melissa · ‎Jan 19 2018

Thank you so much for sharing your experience! That's really interesting that you were able to restore from (and unsupervised) backup to an iphone 6s and have supervision persist. It sounds like you're right about the iphone 8 maybe having a restriction built in. I'll see what I can find out about that! I love the thorough analysis 🙂 I wouldn't have thought to mix models!! To be clear - once the device is supervised, you should be able to use the "restore from backup" feature in future wipes/factory reset and have that supervision persist on the device. It's just an issue when first applying supervision to a device that's already out in the field/being used.

Melissa · ‎Jan 19 2018

Good point - once the device is supervised, restore from backup will work in the future on that device. The issue is restoring from backup when the backup was made on an unsupervised device (when trying to move to a supervised state).

Melissa · ‎Jan 19 2018

I believe where we landed on this was that if you are trying to bring a device from an unsupervised to a supervised state, restore from backup will not work at initial setup (either from itunes or icloud). Our recommended method would be to have your users sync any app data in icloud, and then login and re-download that app data from icloud once setup is complete (this can't be done in the "restore from backup" step in initial setup). I would probably suggest skipping that step (you can take it out of the setup process by selecting it in "skip steps" when applying DEP settings). Note - if you were *just* enrolling the device in DEP and not supervising it, it sounds like restore from backup would work at initial setup. With regard to the wifi profile disappearing once it's enrolled - I believe what's happening is once you have configured the Meraki Management Profile (SM), any previous profiles will be removed. To configure a wifi profile with Systems Manager, you can set one up in the Systems Manager>Settings page. Here's more on that - https://documentation.meraki.com/SM/Profiles_and_Settings/Configuration_Settings I'm not sure why you're not able to access user account settings - do you mean the user is no longer logged in (to icloud?) or that logging in to icloud is blocked? There is a restriction you can set to block this - in SM it is under Settings>Restrictions>Allow Modifying Account Settings. If this was unchecked, that would block a user from signing in to icloud. Hope this helps!

Melissa · ‎Jan 8 2018

Right, so in this case, if @CMurdaugh would like to supervise these devices, restore from backup cannot be used. If it's not the goal to supervise them - just to add them to DEP...the Apple Configurator + restore from backup method should work!

Melissa · ‎Jan 8 2018

@jared_f Are you saying you've been able to use Apple Configurator to take an unsupervised, un-enrolled (in DEP) device and enroll it into SM and DEP with supervised DEP settings applied, while allowing "restore from backup" in the initial setup? The main hurdle would be moving from unsupervised to supervised while allowing "restore from backup". Please let me know what your experience has been!!

Melissa · ‎Jan 5 2018

Maybe I misread this - I thought in this case we were moving from an unsupervised enrolled device (not in DEP) to a supervised device in DEP. Is that not right?

Melissa · ‎Jan 5 2018

@PaulAM87 Can you please submit this through the "Make a Wish" button on dashboard? I'll do the same 🙂

Melissa · ‎Jan 5 2018

Hi @PaulAM87! We have some limited guides for configuration settings (everything configurable on the 'Settings" page) here - https://documentation.meraki.com/SM/Profiles_and_Settings/Configuration_Settings It sounds like you're right about next steps - configuring Wifi settings and credentials. One thing I might suggest - I might create the wifi Profile as a separate profile, with no other configuration settings tied to it (like Active Sync/email, vpn, etc.) If you do add more configuration settings to the same profile (with the wifi settings), any time you make changes to anything on that profile the wifi settings will refresh, and this could interrupt wifi connectivity. Hope this helps!

Melissa · ‎Jan 5 2018

Unfortunately you cannot "restore from backup" using itunes/icloud when moving the device from one state to another (unsupervised to supervised, or outside of DEP to enrolled in DEP). If the device was not previously supervised or enrolled in DEP, the backup will reflect a different device state and cannot be used to "restore" on a new device state 😞 One thing we've seen folks do is ask users to backup any data they'd like to keep in icloud on a per-app basis. Upon setup, DEP settings will be applied to skip the "restore from" options - these cannot be used on initial setup. Once setup is complete, users can then log in to icloud to re-download this data on a per-app basis. This is per-app data and not saved in a way that conflicts with the new device state. The biggest downfall I've seen from this method is losing data from those apps that cannot be backed up on a per-app basis in icloud - namely messages/texts. If it's critical that users keep their text history, there are other solutions for this! I've heard people like Touch Copy, for example.

About Melissa

Melissa

Community Record

Badges