@CherylA The latest iOS 12.4 allows for up to 200 MB over cellular, and iOS 13 will remove that restriction entirely.   https://www.cultofmac.com/629094/ios-13-drops-app-store-200mb-download-limit/ ... View more

Is this in reference to the new SSO features in macOS 10.15 Catalina? I've had trouble tracking down an example profile on the MacAdmins slack, and it's not in Apple's documentation at the moment. I have the beta installed on a test Mac, and either that feature is buried somewhere, or it hasn't even been released as part of the beta yet. So there's a bit of work and testing before Meraki would get to it. Keep an eye on ProfileCreator for an example profile template whenever the app gets updated to support all the new Catalina profile payloads, including the SSO at enrollment profile. ... View more

@mbonne Great find, OSXvnc-server-4 not being signed prevents the creation of a PPPC profile to whitelist. ... View more

The migration was fairly smooth. I freaked out at first because it appeared a good chunk of my devices were missing post-upgrade, but I just had to click the force sync button, and everything populated as expected. Haven't had any syncing issues since then. ... View more

@SoCalRacer On Macs/iOS the profile only restricts Siri (and Cortana is only restricted on Windows 10 devices). Blocking Google Assistant from Chrome is supported in Windows and ChromeOS, but not macOS/iOS, and I'm not aware of Alexa support on the Mac. ... View more

It's an Apple-enforced restriction that iOS devices need to be unlocked (with the display on) to receive these update commands. ... View more

@mdmike There's somewhat of an update/addendum to the first issue with account creation.   SecureToken behavior has changed a bit under Mojave, now any admin account will get secureToken if that is the first user account to sign into the Mac. Not all environments can take advantage of this in your deployment workflow, but here's an example of how that could work:   -Use a tool like Installr or Bootstrappr to install a pkg that creates an admin account and skips the user creation portion of the Setup Assistant. -Power on the Mac, Meraki pushes the enrollment profile as you go through the non-skippable Setup Assistant screens like language, country, etc. -Reach the sign-in screen, then log into the admin account that was created with the pkg you previously installed. -That admin user now has secureToken, and you can then create additional users via System Preferences, script, etc. ... View more

@David_Limiero Deploying Safari settings is kinda messy, not even Jamf offers something out-of-the-box. Mojave complicates things a bit more in that a lot of Safari preferences aren't really admin configurable because they are protected with SIP.   You can use the Profile Manager feature in the macOS Server app (or something like ProfileCreator) to create a custom profile with the pref domain set to com.apple.Safari. There used to be a single plist with the same com.apple.Safari filename, but now you have to dig around in ~/Library/Safari for the exact settings you want. You can try setting up Safari exactly how you want it, then reference that folder to see what changes have been made to the plist files. You can then use Server.app or ProfileCreator.app to generate a mobileconfig, and then upload to your Meraki dashboard. ... View more

@rguthrie @Richard_W If you're re-deploying a Mac, it might be worth to just delete the client from the dashboard so a fresh record is created when it re-enrolls. Don't delete the machine from DEP, just the standard client list. ... View more

@eatyourpeas747 @Nick Yeah, Apple has been nudging admins towards DEP for a few years now. The user-approved MDM requirement starting in macOS 10.13.4 (where a user must explicitly approve the MDM enrollment) is the final nail for any attempt at automating enrollment outside of DEP. ... View more

This is a change on Apple's end to prevent malicious actors from joining your org's MDM server if they obtain a copy of the enrollment profile. ... View more

@lma aside from Apple's server app, there's an excellent tool called ProfileCreator that recently added the ability to create font payloads. Just drag-and-drop your desired fonts into the app, then upload the custom mobileconfig to your Meraki dashboard.   ... View more

@swillette702 A clever workaround a colleague shared is to set a password for Screen Time, and then set specific apps to be disallowed for 23 hours and 59 minutes. It's not perfect, but it does mean that for the majority of a 24-hour period a user will get a passcode prompt to use an app when it's opened. ... View more

If this was initiated from the device end, the user should have received an email alert from Apple stating that there was some sort of iCloud/Find My Phone account activity change if they were logged in with a personal account.   While it's certainly possible that this occurred from the Meraki end, my experience has been that someone with physical access to the device erased it (intentionally, or not). ... View more

This site tries to keep a database of any known managed app config settings on iOS. That being said... Apple doesn't allow for any management of "default" apps for mail/calendar/contacts/Maps/browser/etc. ... View more

I've definitely experienced that in the past, spanning 10.10 -- 10.13.6, so I don't think it's a Mojave thing. Sometimes the enrollment profile goes away, sometimes it's other profiles that should be in scope based on tags remove themselves.   I never found the root cause, but I got the problem to not reappear:   1- uninstall the Meraki agent launchctl unload /Library/LaunchDaemons/com.meraki.agentd.plist rm -f /usr/local/sbin/m_agent /usr/local/sbin/m_agent_upgrade rm -rf '/Library/Application Support/Meraki/' rm -f /Library/LaunchDaemons/com.meraki.agentd.plist 2- (requires physical access to the Mac) boot into the Recovery partition and disable SIP. After the Mac reboots back into the Recovery OS, remove the configuration profile database. Then re-enable SIP.   csrutil disable -rf /var/db/ConfigurationProfiles/Store/ csrutil enable   3- Then re-install the Meraki agent/re-enroll as needed ... View more

Not sure if this is more of an Apple, or Meraki quirk. But that error reads like you have an existing passcode or restrictions payload that prevents a user from changing the device passcode. The "Teacher Settings" profile is probably tied to the Classroom app, yes? So there's probably something in the default Classroom configuration that makes you change the device passcode that's in conflict with the other profile blocking passcode changes.   A test would be to remove whatever other passcode restriction profile you have, then push the Teacher Settings profile and open the Classroom app to see if there's anything that requires a passcode change. ... View more

You can create printer payload profiles using the macOS Server app from the Mac App Store using the Profile Manager feature. It’s $20, but it’s worth it b/c you can create custom profiles not necessarily available with Meraki.    Just configure a Mac with all your desired printers (and associated drivers) in System Preferences. Then use Profile Manager on that same Mac to upload the printers into a profile, export the .mobileconfig and then import to your Meraki dashboard.  ... View more

For anyone still following this thread: Apple has released a workaround for remotely controlling vs observe-only mode. You'll have to upload a custom mobileconfig to your Meraki dashboard.   https://support.apple.com/en-us/HT209161 ... View more

If it's possible in Outlook for iOS you would find the exact preference key here: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/outlook-for-ios-and-android/outlook-for-ios-and-android-configuration-with-microsoft-intune   Then create a custom/managed config profile for iOS in Meraki ... View more

There are a couple of methods you can use, but definitely with some caveats.   1. If the Mac is enrolled in DEP and is running 10.13.4 (or later) you can use the Software Update command on an individual client page in the Meraki dashboard. It should appear in the same grouping as remote desktop/remote lock/etc on the client page. This is super manual however, I don't know of a Meraki-supported way to do this in batches.   2. You can use startosinstall as part of the macOS Mojave installer, however Meraki would also need to support this in some way to remotely push out. You could use an app management tool like Munki to force an update with startosinstall, as an example.   https://support.apple.com/en-us/HT208020 ... View more

There are a couple of potential causes, one is that Apple only allows "observe" by default unless the user activates Remote Management in the Sharing prefs pane. I know you mentioned that's turned on, but I'm wondering if Apple is enforcing a "user-approved" methodology, where the user has to enable those settings in the GUI vs it being activated as part of a script/another management tool.   The other possibility is that m_agent or some other Meraki binary needs to be whitelisted for accessibility/AppleEvents and/or full disk access as part of the new Privacy Preferences Policy Control payload  ... View more