If anyone is still interested, this is how I did it.   In Okta create a new app, type Web. In General Tab set the following: Initiate login URI: https://m.meraki.com Login redirect URIs: merakismoauth://com.meraki.pcc https://m.meraki.com https://mp.meraki.com/ssp/login https://mp.meraki.com/ssp/loginsuccess https://portal.meraki.com/loginsuccess   Allowed grant types: Authorization code tick Implicit (Hybrid) tick Allow ID Token with implicit grant type tick Allow Access Token with implicit grant type   In MDM go to System Manager > General and scroll down to User authentication settings. Choose OpenID Connect from the drop down menu.   Authorization endpoint: https://TENANT.okta.com/oauth2/v1/authorize Token endpoint: https://TENANT.okta.com/oauth2/v1/token Client ID: XXXXXXXXXXXXXX (Okta app Client ID) Token issuer claim: https://TENANT.okta.com Public Keys Endpoint: https://TENANT.okta.com/oauth2/v1/keys?client_id=XXXXXXXXXXXXXXX Public Keys Format: JWK   Endpoints can be looked up via this API call: https://TENANT.okta.com/.well-known/openid-configuration?client_id=XXXXXXXXXX I suppose this approach can be used with any IDP and then you need to double check what claims IDP returns to Meraki. Meraki expects "email" claim with user email as a value. Okta sends all default info in its claim so there is no need to set up a custom authorization server. With other IDPs it can be different.   I asked support to include this example to official docs. ... View more

It's not in Apple's documentation yet, but at the WWDC "managing devices" session they did have a slide indicating that a profile would be available to restrict or block the activation lock feature. It's up in the air as to when Meraki would support the new profile payload, however. I would keep an eye on ProfileCreator, so when the app is updated with new Catalina payloads you'll at least be able to create a custom profile you can then upload to Meraki. ... View more

If you get the iPad working again there's a couple of scenarios:   1) If the iPad has not already been restored to factory settings, then you'll want to open Settings/General and there will be a section labelled either "Profiles" or "Device Management" where you can remove the Meraki enrollment profile from the iPad. Then you can delete from Systems Manager.   2) If the iPad was already restored, you can just delete from Systems Manager and it shouldn't return. ... View more

Hi all -- I did some testing, changing from institutional to institutional + personal keys for existing users has no ill effects. ... View more