Today with the release of iOS 17.4, we are excited to share that Meraki Systems Manager will now report on app installation distributor source! On iOS 17.4+ devices, a new column "Source" has been added to the Device details page:      This will expose every app's installation source, such as AppStore, Test Flight, side loaded, or any custom third party app store identifier. This is especially important in European deployments where alternative third party App Stores are now allowed per Apple.    To further enhance the security posture of your Meraki organization, use a new Security Policy to define your organization's allowed app store distributors & secure devices in bulk. This will allow administrators to select from the list of app store identifiers and/or type in their own custom store identifier. This can be used block devices in bulk which have apps installed from non-approved app store distributor sources and/or obtain a daily list of devices which have these apps installed.      More information on how to use Security Policies with SM to secure devices and alert administrators here.     ... View more

In this update Meraki Systems Manager has added improvements to the OS update commands for Apple devices. With these new command options, Meraki administrators will now be able to easily update all endpoints to the latest desired OS version.         Changes:  Systems Manager will now periodically scan all managed devices for their available OS updates. This allows Systems Manager to know about the available OS updates for all Apple devices enrolled in your organization.  New Bulk OS update options Ability to bulk select multiple device types (iOS, iPadOS, tvOS, macOS) and apply different OS update commands for each OS type.   New single device OS update options  New way to send OS updates with the latest Apple settings, to set OS Version, Priority, and Installation Actions.  OS Version: Select the specific OS version to update to.  Priority: High or Low. Setting the Priority to High will skip specific OS requirements, such as battery life % or wifi access to perform the update.  Installation Actions: Customizes the way the OS update will download/install and the overall end user's experience. Options are: Default, Install ASAP, Install & Force Restart, Install Later, Download Only, Notify Only.  New Activity Log visibility on raw status responses from device's OS updates information.  Security Policy support - ability to set minimum OS version for compliant and violating status. This will take into account the Rapid Security Response versioning.  Restrictions for Apple device installation/removal visibility of Rapid Security Response updates.  The Meraki knowledge base article for deploying OS Updates has been updated with more information, please review the documentation and enjoy installing OS updates on the managed devices!  ... View more

Deploying Powershell and Shell Scripts in Systems Manager   The scripting feature with Systems Manager is currently in Early Access and can be enabled by navigating to Organization > Early Access page and toggle Opt-in for Deploy scripts for Windows and macOS. This has been a popular feature request for Systems Manager for a long time, so we are finally excited to share this feature. Scripting will allow powerful configuration and management control over Windows and macOS devices.    Example scripts and use cases:  Add any file to any location on a device (example) Install printers and/or custom drivers (example) Configure the profile.xml profile for Cisco Secure client (example) (video) Much more!  Remember: scripts can be very powerful, so we always recommend to test scripts locally first before attempting to deploy in bulk via Systems Manager. The above examples are simply guidelines and should always be tested/validated on your own first.    Once the Early Access has been enabled, there will be a new page available in the Dashboard in Systems Manager > Manage > Scripts to upload the script files and scope to devices.        SM Scripts Early Access information:    Scripts must exit with 0 to be reported as a success in Dashboard. Other status code exits will be reported as an error.  The output from a script is stored in the m_agent.log and can be viewed from Dashboard. Currently, the scripts must be enqueued from Dashboard at the same time while the device is online. This will change during the Early Access phase. In the future scripts will be able to deploy as devices asynchronously come online as well as scheduled scripting to make repetitive script deployments easier.  Scripts must be able to finish within 60 seconds, or else they could be marked as a timeout/error. Also, the agent version 3.7.0 or higher is required. Full set of requirements available here.   ... View more

Relying on the device's Wi-Fi MAC address for device tracking has become difficult on modern mobile platforms, as devices may change their MACs exposed on the network via MAC randomization privacy. The good news: administrators can now leverage Systems Manager to install certificates on enrolled devices which Cisco ISE identifies to accurately track devices during 802.1X EAP authentication. ISE can use this certificate to track the device and review its security policy posture within Systems Manager.    To begin setting this up: in the Systems Manager > Configure > General page there is a new UI element to help administrators properly configure the EAP-TLS Wi-Fi profile+certificate with the subject names and subject alternative names for this EAP tracking via Cisco ISE. Cisco ISE then leverages the Meraki API to validate SM device posture in MDM via SM security policies to decide on Cisco ISE policy rules. To learn more and get setup with this powerful security integration please view the documentation here.      Also, bonus update for macOS! There's new support for macOS Ventura System Preferences, so administrators can enable only the System Preferences panes that they wish users to see. Find this profile payload called "macOS System Preferences" and use the "Enabled System Settings" to add/remove any panes inside System Preferences for your SM managed macOS devices.  ... View more

A new iOS SM MDM app update v2.6.2 available which includes the following:    Dark mode added. Homescreen shortcuts added! Check-in device and view app list directly from the iOS homescreen. Tap & hold the app on the homescreen to see these new homescreen shortcut action.  App cells now display version number.  App cells now have an “Update” button to request an app update. Pull to refresh added for App List. This will query the Systems Manager network to reload the device’s App List. Suggested Networks feature returns for manual enrollments. iOS devices which are connected to a Meraki MR SSID can automatically detect the SM network within the same Meraki Organization during enrollment, so end users do not need to type in network IDs or scan QR codes to enroll. More info available here. Device name is shown on the Home page. Support for Canadian enrollment clusters. Minor bug fixes.   Pro tip: to make an app an app optionally available for end users, simply uncheck the Auto-install / auto-uninstall  option in Dashboard on the SM > Apps page. That way end users can requests any optional apps they want via this SM MDM app. End users can also use portal.meraki.com for a similar app management self-service experience.  ... View more

  In the Systems Manager > Apps page, a new interface for managing apps has been added. This new interface uses the Google Play Store interface, so it is a familiar interface for administrators who manage Android applications. This new app management interface no longer requires tedious "approve app" actions, which makes the deployment of Android apps one step easier! Documentation available here.    Along with this new interface, the new app management system allows administrators to install websites directly to managed Android devices with a new feature called Web Apps! Web Apps are deployed to devices like apps, but allow administrators to configure the web app name, url, viewing mode, and add a custom app icon. Documentation available here.           ... View more

  iOS 16 support  iOS 16 devices can enrolled, and new iPhone 14, iPhone 14 Pro, and iPhone 14 Pro Max models can be reported in Systems Manager. Reminder that Systems Manager supports Automated Device Enrollment (ADE) for company owned devices, standard Device Enrollment via enroll.meraki.com for end-user owned devices, and/or User Enrollment for end-user owned devices. Or, leverage the Meraki MR and enable a special hardware integration to enable a splash page for end-user enrollments via Sentry Splash.  New iPhone 14 models are the first iPhones to support only eSIM for cellular activations, and Systems manager has added the following features to help administrators with eSIM for managed devices:   New "Cellular Access Point Name (APN)" activation profile for iOS (find in SM > Settings page) View eSIM (Phone#, IMEI, label, EID, slot#) for managed devices information directly in SM SM has new Single Sign On settings available (find in SM > Settings page) New Restrictions available:  allowUniversalControl, allowMailPrivacyProtection, allowRapidSecurityResponseInstallation, allowRapidSecurityResponseRemoval, more! Remember that iPadOS 16 and macOS 13 Ventura are right around the corner, and many more enhancements coming soon! Also as a reminder administrators can delay OS updates on Supervised Apple devices for more control of OS updates: https://documentation.meraki.com/SM/Apps_and_Software/Deploying_OS_Updates_with_Systems_Manager#Delaying_OS_Updates    Android 13 support  Android 13 devices can enrolled and Android 13 versions, PlayStore versions, and PlayStore Services versions, will be reported into Systems Manager device details.  New Google Play EMM App deployment solutions built from the ground up to support the future of app deployments with new Google Play integrations. This will allow enhanced app deployments with Public Play Store and Private Play Store via Systems Manager.  A new interface into the SM > Apps page will be rolling out in the next few weeks to further enhance this.  The "approve app" permission on SM > Apps page is no longer needed, and has been removed from the page. This gives administrator one less step to deploy apps, so should be a welcomed change.    ... View more

The Systems Manager app for Android has been updated with enhancements for Kiosk mode. This is a great way to lock down managed Android devices so they can only access specific applications. These Kiosk mode enhancements include:    Configure device for Kiosk into a Single-App Kiosk or into Multi-App Kiosk When using Multi-App Kiosk, remotely control device's branding logo/text/color Set brightness (automatic or 1-100%) Set screen orientation (automatic, landscape locked, or portrait locked) Various bug fixes and stability improvements          Bonus tip: Kiosk mode feature goes great with Android Zero Touch Enrollment (ZTE). ZTE allows Android devices to automatically enroll into your organization in Device Owner mode (required for Kiosk) upon initial setup, and optionally go directly into this Kiosk mode state. Perfect peace of mind for company owned point of sale devices and restaurant menu/ordering tablets!  ... View more

Meraki Systems Manager has added many new exciting features for macOS deployments including:    In Dashboard, "Device Enrollment Program" or "DEP" have been rebranded to "Automated Device Enrollment" or "ADE". This is so SM can stay current with the latest branding alignment with Apple. https://support.apple.com/en-us/HT204142  New ADE assign settings interface with additional features   Configure local accounts on macOS! Administrator and Standard user accounts Dynamically pre-fill macOS accounts from the SM 'Owner' set in Dashboard   Provisioning package support during macOS initial setup  Add a signed .pkg to run on all devices during initial setup!    Apple Silicon improvements  Bootstrap token automatically escrowed for new enrollments Added security for MDM commands (e.g. OSUpdates and Kernel extensions) on Apple Silicon Macs.     SM Agent 3.5.0+ is now natively built for Apple Silicon. No longer need Rosetta 2 to run SM agent!   Updated documentation with more information: https://documentation.meraki.com/SM/Device_Enrollment/Apple_Automated_Device_Enrollment_(ADE)    Thank you to all the users who have requested these features, we hear you! We're continuing to shape up new improvements for device deployments, so please continue to send in feature requests as our product and engineering teams review every request.  ... View more