About PaulF

PaulF

Hi Dylan So far, Apple have only announced Declarative Management for User Enrollment, not for Apple MDM in general The SM team, however, are very interested in this, in that it allows changes to be made instantly on the device (within reason) and also allows the device to tell Systems Manager that something has changed WHEN it actually changes. I personally feel that Apple are dipping their toes in the water to see what the take up and interest will be before deploying this for all types of management. The other problem is that, Systems Manager, as well as other MDM platform, have complex business logic engines to device what should happen to devices when something is reported back or has changed. Because the devices now have the ability to have business logic applied on them, you're having to split the logic between the MDM platform and device. This isn't easy to do. And if you wish you let admins chose between SM doing the logic, the device, or a bit of both, it magnifies this complexity even further! Having had a look at Apple's documentation, there appears to be limited support for this for a user enrolled device If you could let us know what features you're interested in, that would be immensely helpful, though!

PaulF

Again, please use the "make a wish" link at the bottom of your dashboard

PaulF

This is not currently a feature. Please use the "make a wish" link at the bottom of your dashboard if you require it. Kind regards, Paul

PaulF

Understood. So, Google Play allows for multiple accounts, so you can have both a personal google play account and a work one. What may prevent this is the default behavior of a DO enrolled device to prevent modification of accounts. This can be changed in the Android Device Owner profile: In the same profile you can also disable factory reset

PaulF

The problem with this approach is that, in a world that is becoming more and more focused on privacy, the enterprise still has full visibility of the personal part of the device, something that most users would have issues with. If the requirement is to secure enterprise data whilst segmenting user data, then Work profile on a NON managed Android is a much better approach. It still allows you to wipe the enterprise data, which maintaining the personal data. Should the user wish to wipe the entire device, they can they use the various Google tools to do so. Of course, this is a personal opinion, but it does allow you to avoid the pitfalls of managing personal data.

PaulF

Hello @akram and welcome! So, in lieu of Systems Manager focused training, we also have these resources available deployment guides: https://documentation.meraki.com/SM/Deployment_Guides Meraki Minute videos: These tend to be focused on very simple, quick tutorials, but a great start to get your head round some of the functionality: https://www.youtube.com/merakiminute There's also some device platform specific information: Apple: https://support.apple.com/guide/deployment/welcome/web Android: https://developers.google.com/android/work/overview Microsoft: https://docs.microsoft.com/en-us/windows/client-management/mdm/ And, of course, here! Start with some use cases, and then see how they align with the features of the various device platforms and Systems Manager: It's a much easier way to learn...

PaulF · ‎10-27-2021

Thank you for checking @Shany !

PaulF · ‎10-21-2021

They tend to be referenced in the release notes: https://developer.apple.com/documentation/ios-ipados-release-notes/ios-ipados-15_1-release-notes However, as it's not released yet, expect this page to update

PaulF · ‎10-21-2021

Apple don't permit more than one Education profile on a device at a time. Sorry to be the bearer of bad news.

PaulF · ‎10-15-2021

I can confirm that Text is the only value you can use. Can you raise a case? Thanks!

PaulF · ‎10-08-2021

Have you raised a case? If not, please do so. Support are aware of it, and raising a case will help Eng understand the impact. I can confirm that there is an issue

PaulF · ‎10-08-2021

I can confirm this For some reason, this has to be enabled by support. Please raise a case and they should be able to do this for you

PaulF · ‎10-08-2021

So, a few things: 1. There isn't a passcode "reset" for iOS, there is only a "clear" passcode. As far as I can see, this doesn't need a supervised device, if Apple's website is to be believed, but it certainly WON'T work for a User Enrolled Device. An my colleague in support is correct: You can't systematically set a new passcode on the device remotely. That's an Apple restriction 2. It would be useful to know the connectivity of the device during the period that you needed to perform the reset: If the device was offline, no amount of coercing would achieve your requirements. Something that I've seen in the past So, what could you have done? If the requirements was to lock the user out of the device, you could have placed the device into kiosk mode with some completely unrelated application. Notes, for example. This would have prevented the user from using the device whilst keeping the device online. The other alternative would have been to have completely wiped the device (if the device was in DEP). The user would have been forced to have enrolled the device. The only downside to this is that you'd have lost visibility of the device.

PaulF · ‎10-06-2021

I've used the steps below with other customers to install all sorts of packages. If you use AnyConnect, Umbrella, etc, you're probably familiar with them You can place all of the files you wish into a DMG. Alternatively, a ZIP will work just as well Open Terminal Using mkdir Create a Directory. I’ve used InstallerPackage as the Example In Terminal Type cd InstallerPackage mkdir Scripts mkdir Content cd Scripts touch postinstall Copy the DMG you need into the Content Folder Using a text editor, edit the postinstall file and paste in your script (an example script is at the end of this post) that will move files in /tmp to where ever you need to chmod a+x postinstall cd .. Build the package sudo pkgbuild --identifier com.meraki.sophosinstaller --root Content --script Scripts --install-location /tmp com.meraki.sophosinstaller.pkg pkgbuild: Inferring bundle components from contents of Content pkgbuild: Adding top-level postinstall script pkgbuild: Wrote package to com.meraki.sophosinstaller.pkg Double Note: ensure that there is a space between /tmp and com.meraki.sophosinstaller.pkg An example postinstall: #!/bin/bash dmgPath="/tmp/YourDMGName.dmg" mountPath="/Volumes/YourDMGMounted" currentuser="$(id -un)" usersAppDir="$(sudo -u $currentuser echo $HOME)" /usr/bin/hdiutil attach "$dmgPath" -nobrowse -quiet if [[ -e "$mountPath" ]] then cp -r "$mountPath"/"YourApp.app" /Applications/"YourAppName.app" fi umount "$mountPath" rm -rf "$dmgPath" # insert the commands that you need to # provision your application exit 0 This may take a few attempts to get right. So, I'd install the installer manually first before deploying via SM Also note: The name of the bundle ID that you use in SM when creating the custom app HAS to match the bundle ID of Sophos, else SM has no way to know that it's been installed correctly.

PaulF · ‎07-21-2021

Hi Hopefully the issue of not being able to see the status bar should be resolved in the next few months As for the ability to change the screen dimming: I believe that to be an android / Samsung issue. Sorry!

PaulF · ‎07-20-2021

So, I believe that you're looking for the apps, within the work profile, to be usable when connected via VPN, but you want the VPN to either fire when needed, or to be always on. SM does have support for Android's always on VPN feature: There's more details about it here: https://www.youtube.com/watch?v=imVjE_oF_kI You can ignore the bit about Umbrella 🙂 This should hopefully solve your problem

PaulF · ‎07-16-2021

Yes..... When sending a notification to an android, you can select the messaging type:

PaulF · ‎07-01-2021

That capability doesn't exist in Android Enterprise. If the business problem is to keep enterprise and personal data separate, then work profile is the only answer

PaulF · ‎07-01-2021

Zach: Have you considered a white list instead? Assuming the Device is in Device Owner mode, it would make for a much smaller list that you'd have to maintain. You'd only have to specify the apps that you want, rather than those that you don't.

PaulF · ‎06-29-2021

Hi One of the biggest problems with Android Enterprise in this use case is actually knowing what the identifiers actually are of the preinstalled apps This can be achieved using adb and the following command: adb shell pm list packages | awk -F ":" '{print $2}' Once you've got the list of apps, you can then use the Android System Apps payload:

PaulF · ‎06-29-2021

Is this being pushed from SM, or are you installing this manually?

PaulF · ‎06-29-2021

I know that there's many of you that have workflows that involve the manual install of the SM agents on macOS, such as Silent installer for MacOS However, with the changes in the SM agent 3.1.0 and above, instead of being able to do silent installs, you know have to specify your enrollment code manually, as per Mac Enrollment - Command Line Options You can optionally specify the network enrollment code / string with the following command: sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id && sudo launchctl setenv enrollment_code <network enrollment code or enrollment string> && sudo installer -pkg <path/to/package.pkg> -target / && sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id There's two optional parameters here: <network enrollment code or enrollment string> : This is the enrollment code that's quoted in Systems Manager > Add Devices, or Network Wide > General <path/to/package.pkg> : This is the path to the SM agent installer This is, understandably, unwieldy, primarily due to not being able to pass parameters to installers in macOS. However, there is an alternative: You can actually build an installer that allows you for silent enrollments, and this is how 1. Download the Current SM Agent Installer From Systems Manager > Add devices > macOS, download the SM agent 2. Create a new folder on your Desktop: SMAgent3.1.1 (for example) 3. Open Terminal and type the following cd ~/Desktop/SMAgent3.1.1 mkdir Scripts cd Scripts touch postinstall chmod a+x postinstall cd .. mkdir Content cd Content open . This last command will open the Content directory Move the previously download SM agent into here and rename it SMAgent.3.1.1.pkg Go back to terminal and type cd .. cd Scripts open . This will open the Scripts directory in Finder. 4. Edit postinstall With a suitable text editor, open the postinstall file and type: #!/bin/bash sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id && sudo launchctl setenv enrollment_code XXXX-XXXX-XXXX && sudo installer -pkg /tmp/SMAgent-3.1.1.pkg -target / && sudo launchctl unsetenv enrollment_code && sudo launchctl unsetenv organization_id NOTE: Replace XXXX-XXXX-XXXX with the network enrollment code or string Save this file 5. Create installer Go back to Terminal and type: cd .. sudo pkgbuild --identifier com.meraki.smautoenroll --root Content --script Scripts --install-location /tmp com.meraki.SMAgent3.1.1-autoenroll.pkg This should result in: paulf@Paul-F-MBP-680 SM3.1.1pkg % sudo pkgbuild --identifier com.meraki.smautoenroll --root Content --script Scripts --install-location /tmp com.meraki.SMAgent3.1.1-autoenroll.pkg Password: pkgbuild: Inferring bundle components from contents of Content pkgbuild: Adding top-level postinstall script pkgbuild: Wrote package to com.meraki.SMAgent3.1.1-autoenroll.pkg You should now have an installer that will silently install the SM agent without prompts!

PaulF · ‎06-23-2021

Hello all. Further to this, agent 3.1.1 has been released, as per: https://documentation.meraki.com/SM/Device_Enrollment/Systems_Manager_Agent_Release_Notes Changes: macOS [Bug fix] Installing agent over MDM now automatically enrolls without needing any user intervention. [Bug fix] The agent installer will now install Rosetta 2 on Apple Silicon macOS devices, if it is not already installed. This allows Apple Silicon macOS devices to enroll in MDM and then push the agent without requiring user intervention. Windows [Bug fix] Agent only enrollments no longer have a delay in initial sync with Dashboard. [Bug fix] Incorrect LAN IP reported via agent for Windows devices with multiple NICs. [Security] Various agent file privilege fixes. [Update] Reduced usage of the shared C:\Windows\Temp directory so there are fewer audit events generated.

PaulF · ‎06-10-2021

Hi @JoelMiles I'll chase this up today for you...

PaulF · ‎06-04-2021

You'll find https://developer.cisco.com/meraki/api-v1/#!get-organization-networks a really excellent resource for prototyping

PaulF

Community Record

Badges

Re: Declarative Mobile Device Management support

Re: Kiosk Mode - Change Logo?

Re: Can you Customize the Kiosk mode color/logo

Re: System Manager....evolution...?

Re: System Manager....evolution...?

Re: Certifications of cisco meraki

Re: Erase All Contents and Settings restriction broken after iOS 15 update

Re: Erase All Contents and Settings restriction broken after iOS 15 update

Re: Only one education configuration can be installed at a time

Re: Samsung email Managed app Settings

Re: Meraki MX250 16.12 beta - breaks SM authentication

Re: SSP Cutomization

Re: Reset passcode on iOS

Re: Deploy Sophos Intercept X using Systems Manager

Re: Issues with App in Kiosk Mode

Re: Using SM with MS Apps that have conditional access turned on

Re: Does Meraki MDM support Intent?

Re: Google account changing allows application install

Re: Blacklist on Android no longer working

Re: Android System Apps

Re: New SM Agent v3.1.0 for macOS and Windows Now Available

HOWTO: Silent Install of SM agent 3.1.0 and above

Re: New SM Agent v3.1.0 for macOS and Windows Now Available

Re: New SM Agent v3.1.0 for macOS and Windows Now Available

Re: Use API call to get non-compliant device.

Re: Allow all apps to download

Re: Widgets on the homescreen

Info: Locking down an iOS device to a static webpage

MAC address Randomisation and how to use Systems Manager to avoid

HOWTO: Silent Install of SM agent 3.1.0 and above

HOWTO: Package files for deployment to windows computers

Re: Widgets on the homescreen