About Melissa

Melissa · ‎02-01-2018

Quick check - is it possible a configuration setting for Privacy is active on these devices? This could affect SM's ability to track location. Under Settings>Privacy...looks like this:

Melissa · ‎02-01-2018

To all who would like to see this feature - please please submit it on the "Make a Wish" section at the bottom of dashboard! We really use that data to help drive development decisions 🙂

Melissa · ‎02-01-2018

This could definitely be clearer on our side! AFW will use the same default network as set for Apple, under Organization>MDM. Set the default network here, even if you don't have a DEP token to submit.

Melissa · ‎02-01-2018

I've seen a number of companies use SM to push and manage 3rd party apps for this kind of bread crumb tracking. That might be something to look into! You could also use the API to routinely pull and externally save/store location info . For privacy purposes, SM will not do this itself. If at some point it is supported by apple and android in their APIs for MDM, that could change!

Melissa · ‎02-01-2018

@DCalder Similarly to @PhilipDAth's point, if you could put the device in Single App mode the end user would not be able to get to the settings app to adjust/change the wifi settings....though I'm not sure if that is helpful. It wouldn't be if you need to give access to more than one app 😞 You could also use Wifi Whitelisting to only allow the device to connect to SM configured wifi networks - this is a restriction in Settings>Restrictions>Supervised devices. It would only allow the device to connect to wifi networks that have been set up using SM. You could then setup Network Usage policies (to restrict all apps from using cellular data - basically forcing the end user to turn the wifi back on. More on that here - https://documentation.meraki.com/SM/Monitoring_and_Reporting/Cellular_Data_Management_with_Systems_Manager#section_3 Hope that helps!

Melissa · ‎02-01-2018

Hi everyone! For those using SM to track cellular data usage on iOS devices – check out the new Network Usage Rules feature! Network Usage Rules allow you to enable or disable roaming or cellular data for managed apps (those apps deployed through SM). Here is the guide for this feature - https://documentation.meraki.com/SM/Monitoring_and_Reporting/Cellular_Data_Management_with_Systems_Manager#section_3 To set this up, go to Settings > Add Settings >More iOS > Network Usage Rules to set this up - it looks like this: You could use this feature in conjunction with a cellular data usage policy as well! An example might be to set up a policy that checks to see when devices exceed a certain data usage threshold. If devices exceed the threshold, Network Usage Rules could become active to disable data usage by certain apps. See the guide above for more details. Note - This payload does NOT require supervision or DEP enrollment

Melissa · ‎01-31-2018

Understood - it sounds like Apple is aware of the issue and may fix it at some point... In the meantime, the main complaint I hear about this is around losing is text history. If your users absolutely need to save this - there are other ways to do it. I've seen people use 3rd party programs like TouchCopy to download texts from a device before wiping it. For any in-app data, they can still backup to iCloud before wiping on a per-app basis and sync those apps AFTER set up. They would just not be able to use the "restore from backup" option in the initial set up steps (which I would recommend you hide/skip when applying DEP settings). It's not an ideal solution, I understand!

Melissa · ‎01-29-2018

Hi @CherylA - so sorry for the delay. The key piece I've learned in this thread is that it is possible to use "restore from backup" and supervise a device, but only if the backup is made on a different device than the one you intend to supervise. It does not seem that this process works on all models, as you were unable to restore from backup and apply supervised settings when moving from an unsupervised iPhone 6 on an iPhone 8. To be honest - the majority of folks I work with that ask this question (about restoring from backup) are trying to supervise the device they have in hand. In that case, I think we've determined the above process will not work for them.

Melissa · ‎01-29-2018

Hi @jared_f! I think this feature will help. On your apps page, select "Try the new version!" Then you'll see this option to import apps from VPP:

Melissa · ‎01-29-2018

In case it's helpful, SM now has a Self Service Portal that may come in handy when setting up macOS devices. You can use this to create a bank of app store apps, non-app store apps, or scripts (any packages) for users to download on their own! More here - https://documentation.meraki.com/SM/Other_Topics/Systems_Manager_Self-Service_Portal

Melissa · ‎01-29-2018

@MRCUR I would love to include you in the beta! Can you please send me a private message with your contact details to go forward?

Melissa · ‎01-24-2018

Ah I see! Thanks for the explanation. Is the idea that if you can get all this info in notes, you would then set a manual profile that pulls "device name" on the lock screen?

Melissa · ‎01-24-2018

Hi @jared_f! Quick question on this, does all of that info have to be in the device name? (User Last, User First, Serial #) I ask because SM will pull all of those fields anyway, and you can add that to your main view on the Clients page. Users' names can be forced as the "Owner" if you either set it (manually through dashboard or through the API), or use User Enrollment Authentication. https://documentation.meraki.com/SM/Device_Enrollment/SM_Enrollment_Authentication I do agree that mass renaming devices en masse would be easier if available through dashboard and not just the API - I'll submit that myself as well. (For folks on the thread that want this, please help by submitting it in the "Make a Wish" box in dashboard!)

Melissa · ‎01-22-2018

@jared_f I doubt that's the issue. Here is what I found out from Apple on this process: "https://support.apple.com/en-us/HT204142 Here is a key piece: 'If you erase the device and restore the backup, the device remains unsupervised and the user can remove management. If you restore the backup to a different device that is assigned to the server, the device is supervised and the user can’t remove management.' Essentially, for you want to restore an iCloud backup, you need to restore it to a different device to retain Supervision and DEP." @CherylA This would explain your results as well!! It sounds like this is something Apple is trying to fix. Hopefully there is a better solution soon.

Melissa · ‎01-19-2018

@PhilipDAth I laughed 😉

Melissa · ‎01-19-2018

Thank you so much for sharing your experience! That's really interesting that you were able to restore from (and unsupervised) backup to an iphone 6s and have supervision persist. It sounds like you're right about the iphone 8 maybe having a restriction built in. I'll see what I can find out about that! I love the thorough analysis 🙂 I wouldn't have thought to mix models!! To be clear - once the device is supervised, you should be able to use the "restore from backup" feature in future wipes/factory reset and have that supervision persist on the device. It's just an issue when first applying supervision to a device that's already out in the field/being used.

Melissa · ‎01-19-2018

Good point - once the device is supervised, restore from backup will work in the future on that device. The issue is restoring from backup when the backup was made on an unsupervised device (when trying to move to a supervised state).

Melissa · ‎01-19-2018

I believe where we landed on this was that if you are trying to bring a device from an unsupervised to a supervised state, restore from backup will not work at initial setup (either from itunes or icloud). Our recommended method would be to have your users sync any app data in icloud, and then login and re-download that app data from icloud once setup is complete (this can't be done in the "restore from backup" step in initial setup). I would probably suggest skipping that step (you can take it out of the setup process by selecting it in "skip steps" when applying DEP settings). Note - if you were *just* enrolling the device in DEP and not supervising it, it sounds like restore from backup would work at initial setup. With regard to the wifi profile disappearing once it's enrolled - I believe what's happening is once you have configured the Meraki Management Profile (SM), any previous profiles will be removed. To configure a wifi profile with Systems Manager, you can set one up in the Systems Manager>Settings page. Here's more on that - https://documentation.meraki.com/SM/Profiles_and_Settings/Configuration_Settings I'm not sure why you're not able to access user account settings - do you mean the user is no longer logged in (to icloud?) or that logging in to icloud is blocked? There is a restriction you can set to block this - in SM it is under Settings>Restrictions>Allow Modifying Account Settings. If this was unchecked, that would block a user from signing in to icloud. Hope this helps!

Melissa · ‎01-17-2018

Here's some information about how SM approximates location on devices - hopefully this explains some of the accuracy differences between laptops and supervised iOS - especially in single app mode with the SM app running the background! @Ponceme @jared_f https://documentation.meraki.com/SM/Monitoring_and_Reporting/How_Systems_Manager_Approximates_the_Location_of_a_Managed_Device As for your question about no-go zones @Ponceme, would it help to create geofencing policies around the driver's houses and rethink what "compliance" means for those policies? For example, I might suggest making a geofencing policy that is only selecting the driver's residence. Let's say you called it, "DriverHome". When the device is in the no go zone / at home, a "DriverHome_compliant" tag would automatically be added to the device in SM. When the device is not shown in the no go zone / at home would also automatically get a DriverHome_violating tag. You could pull these tags into your main view in the Clients page, or set up an automatic report (Systems Manager>Alerts) of violating and compliant-after-violating devices. If that doesn't sound like it would help, I would say please submit the feature request in the "Make a Wish" box at the bottom of any dashboard page 🙂

Melissa · ‎01-17-2018

Check out this note from our AfW Deployment Guide - it would appear to be a mandatory step in AfW enrollment: "Google requires that Android 5.0+ devices be encrypted when using AfW. This is important for both general device security as well as application specific data security. " Source - https://documentation.meraki.com/SM/Deployment_Guides/Android_Enterprise_Deployment_Guide_(Android_for_Work)

Melissa · ‎01-17-2018

Good news! Meraki has recently started a beta of this feature - deploying the agent and enrollment profile for macOS through DEP. Please reach out if you'd like to be a part of the beta 🙂

Melissa · ‎01-08-2018

Right, so in this case, if @CMurdaugh would like to supervise these devices, restore from backup cannot be used. If it's not the goal to supervise them - just to add them to DEP...the Apple Configurator + restore from backup method should work!

Melissa · ‎01-08-2018

@jared_f Are you saying you've been able to use Apple Configurator to take an unsupervised, un-enrolled (in DEP) device and enroll it into SM and DEP with supervised DEP settings applied, while allowing "restore from backup" in the initial setup? The main hurdle would be moving from unsupervised to supervised while allowing "restore from backup". Please let me know what your experience has been!!

Melissa · ‎01-05-2018

Maybe I misread this - I thought in this case we were moving from an unsupervised enrolled device (not in DEP) to a supervised device in DEP. Is that not right?

Melissa · ‎01-05-2018

Have you tried calling Apple to ask for help with this? The best way forward would be to renew that old certificate, if possible! We've found sometimes that calling Apple directly can help.

Melissa

Community Record

Badges