Meraki

Melissa · ‎Feb 6 2018

Hi @schoolssupport! SM is integrated with Apple School Manager, and it does support the shared device model I think you are referring to! Here is a guide on that! https://documentation.meraki.com/SM/Profiles_and_Settings/Configuring_Apple_School_Manager_for_Shared_iPad_or_1-to-1_iPad This is not available on our legacy SM dashboards! You can tell if you are using a legacy dashboard by going to Organization>License Info. See what's listed on the top under Systems Manager.

Melissa · ‎Feb 6 2018

It looks like the change happened on 11/29/17 - any devices using version 4.0.1 of the SM App should have this automatically disabled.

Melissa · ‎Feb 5 2018

@JoshH Good news! For all new devices enrolling in Android for Work, factory reset protection is automatically disabled. This was a fairly recent change in SM!

Melissa · ‎Feb 2 2018

That's great news!! Happy to help 🙂

Melissa · ‎Feb 2 2018

Yes - this only applies to iOS devices right now. I'm not sure if there are plans to apply this to Android overall, or if it is (or will be) universally supported in Android for Work (as it is for iOS). That being said - there are some Android apps that can be managed this way through app settings. For those apps that support it, you could make a configuration profile (SM>Settings>App Settings) to configure those apps to only work on wifi! There is also the option in Device Owner mode to disable data roaming (Settings>More Android>Device Owner).

Melissa · ‎Feb 2 2018

@Lafaunda500 I'm so glad it helped! I will get a request for this submitted with Apple - the ability to block the user from turning off the wifi!

Melissa · ‎Feb 1 2018

Quick check - is it possible a configuration setting for Privacy is active on these devices? This could affect SM's ability to track location. Under Settings>Privacy...looks like this:

Melissa · ‎Feb 1 2018

To all who would like to see this feature - please please submit it on the "Make a Wish" section at the bottom of dashboard! We really use that data to help drive development decisions 🙂

Melissa · ‎Feb 1 2018

This could definitely be clearer on our side! AFW will use the same default network as set for Apple, under Organization>MDM. Set the default network here, even if you don't have a DEP token to submit.

Melissa · ‎Feb 1 2018

I've seen a number of companies use SM to push and manage 3rd party apps for this kind of bread crumb tracking. That might be something to look into! You could also use the API to routinely pull and externally save/store location info . For privacy purposes, SM will not do this itself. If at some point it is supported by apple and android in their APIs for MDM, that could change!

Melissa · ‎Feb 1 2018

@DCalder Similarly to @PhilipDAth's point, if you could put the device in Single App mode the end user would not be able to get to the settings app to adjust/change the wifi settings....though I'm not sure if that is helpful. It wouldn't be if you need to give access to more than one app 😞 You could also use Wifi Whitelisting to only allow the device to connect to SM configured wifi networks - this is a restriction in Settings>Restrictions>Supervised devices. It would only allow the device to connect to wifi networks that have been set up using SM. You could then setup Network Usage policies (to restrict all apps from using cellular data - basically forcing the end user to turn the wifi back on. More on that here - https://documentation.meraki.com/SM/Monitoring_and_Reporting/Cellular_Data_Management_with_Systems_Manager#section_3 Hope that helps!

Melissa · ‎Feb 1 2018

Hi everyone! For those using SM to track cellular data usage on iOS devices – check out the new Network Usage Rules feature! Network Usage Rules allow you to enable or disable roaming or cellular data for managed apps (those apps deployed through SM). Here is the guide for this feature - https://documentation.meraki.com/SM/Monitoring_and_Reporting/Cellular_Data_Management_with_Systems_Manager#section_3 To set this up, go to Settings > Add Settings >More iOS > Network Usage Rules to set this up - it looks like this: You could use this feature in conjunction with a cellular data usage policy as well! An example might be to set up a policy that checks to see when devices exceed a certain data usage threshold. If devices exceed the threshold, Network Usage Rules could become active to disable data usage by certain apps. See the guide above for more details. Note - This payload does NOT require supervision or DEP enrollment

Melissa · ‎Jan 31 2018

Understood - it sounds like Apple is aware of the issue and may fix it at some point... In the meantime, the main complaint I hear about this is around losing is text history. If your users absolutely need to save this - there are other ways to do it. I've seen people use 3rd party programs like TouchCopy to download texts from a device before wiping it. For any in-app data, they can still backup to iCloud before wiping on a per-app basis and sync those apps AFTER set up. They would just not be able to use the "restore from backup" option in the initial set up steps (which I would recommend you hide/skip when applying DEP settings). It's not an ideal solution, I understand!

Melissa · ‎Jan 29 2018

Hi @CherylA - so sorry for the delay. The key piece I've learned in this thread is that it is possible to use "restore from backup" and supervise a device, but only if the backup is made on a different device than the one you intend to supervise. It does not seem that this process works on all models, as you were unable to restore from backup and apply supervised settings when moving from an unsupervised iPhone 6 on an iPhone 8. To be honest - the majority of folks I work with that ask this question (about restoring from backup) are trying to supervise the device they have in hand. In that case, I think we've determined the above process will not work for them.

Melissa · ‎Jan 29 2018

Hi @jared_f! I think this feature will help. On your apps page, select "Try the new version!" Then you'll see this option to import apps from VPP:

Melissa · ‎Jan 29 2018

In case it's helpful, SM now has a Self Service Portal that may come in handy when setting up macOS devices. You can use this to create a bank of app store apps, non-app store apps, or scripts (any packages) for users to download on their own! More here - https://documentation.meraki.com/SM/Other_Topics/Systems_Manager_Self-Service_Portal

Melissa · ‎Jan 29 2018

@MRCUR I would love to include you in the beta! Can you please send me a private message with your contact details to go forward?

Melissa · ‎Jan 22 2018

@jared_f I doubt that's the issue. Here is what I found out from Apple on this process: "https://support.apple.com/en-us/HT204142 Here is a key piece: 'If you erase the device and restore the backup, the device remains unsupervised and the user can remove management. If you restore the backup to a different device that is assigned to the server, the device is supervised and the user can’t remove management.' Essentially, for you want to restore an iCloud backup, you need to restore it to a different device to retain Supervision and DEP." @CherylA This would explain your results as well!! It sounds like this is something Apple is trying to fix. Hopefully there is a better solution soon.

Melissa · ‎Jan 19 2018

@PhilipDAth I laughed 😉

Melissa · ‎Jan 19 2018

Thank you so much for sharing your experience! That's really interesting that you were able to restore from (and unsupervised) backup to an iphone 6s and have supervision persist. It sounds like you're right about the iphone 8 maybe having a restriction built in. I'll see what I can find out about that! I love the thorough analysis 🙂 I wouldn't have thought to mix models!! To be clear - once the device is supervised, you should be able to use the "restore from backup" feature in future wipes/factory reset and have that supervision persist on the device. It's just an issue when first applying supervision to a device that's already out in the field/being used.

Melissa · ‎Jan 19 2018

Good point - once the device is supervised, restore from backup will work in the future on that device. The issue is restoring from backup when the backup was made on an unsupervised device (when trying to move to a supervised state).

Melissa · ‎Jan 19 2018

I believe where we landed on this was that if you are trying to bring a device from an unsupervised to a supervised state, restore from backup will not work at initial setup (either from itunes or icloud). Our recommended method would be to have your users sync any app data in icloud, and then login and re-download that app data from icloud once setup is complete (this can't be done in the "restore from backup" step in initial setup). I would probably suggest skipping that step (you can take it out of the setup process by selecting it in "skip steps" when applying DEP settings). Note - if you were *just* enrolling the device in DEP and not supervising it, it sounds like restore from backup would work at initial setup. With regard to the wifi profile disappearing once it's enrolled - I believe what's happening is once you have configured the Meraki Management Profile (SM), any previous profiles will be removed. To configure a wifi profile with Systems Manager, you can set one up in the Systems Manager>Settings page. Here's more on that - https://documentation.meraki.com/SM/Profiles_and_Settings/Configuration_Settings I'm not sure why you're not able to access user account settings - do you mean the user is no longer logged in (to icloud?) or that logging in to icloud is blocked? There is a restriction you can set to block this - in SM it is under Settings>Restrictions>Allow Modifying Account Settings. If this was unchecked, that would block a user from signing in to icloud. Hope this helps!

Melissa · ‎Jan 17 2018

Here's some information about how SM approximates location on devices - hopefully this explains some of the accuracy differences between laptops and supervised iOS - especially in single app mode with the SM app running the background! @Ponceme @jared_f https://documentation.meraki.com/SM/Monitoring_and_Reporting/How_Systems_Manager_Approximates_the_Location_of_a_Managed_Device As for your question about no-go zones @Ponceme, would it help to create geofencing policies around the driver's houses and rethink what "compliance" means for those policies? For example, I might suggest making a geofencing policy that is only selecting the driver's residence. Let's say you called it, "DriverHome". When the device is in the no go zone / at home, a "DriverHome_compliant" tag would automatically be added to the device in SM. When the device is not shown in the no go zone / at home would also automatically get a DriverHome_violating tag. You could pull these tags into your main view in the Clients page, or set up an automatic report (Systems Manager>Alerts) of violating and compliant-after-violating devices. If that doesn't sound like it would help, I would say please submit the feature request in the "Make a Wish" box at the bottom of any dashboard page 🙂

Melissa · ‎Jan 17 2018

Check out this note from our AfW Deployment Guide - it would appear to be a mandatory step in AfW enrollment: "Google requires that Android 5.0+ devices be encrypted when using AfW. This is important for both general device security as well as application specific data security. " Source - https://documentation.meraki.com/SM/Deployment_Guides/Android_Enterprise_Deployment_Guide_(Android_for_Work)

Melissa · ‎Jan 17 2018

Good news! Meraki has recently started a beta of this feature - deploying the agent and enrollment profile for macOS through DEP. Please reach out if you'd like to be a part of the beta 🙂

About Melissa

Melissa

Community Record

Badges