Meraki

jared_f · ‎May 14 2020

Sorry y'all, I noticed someone tried to access the guide via Google Drive and it did not work. I am in the midst of consolidating my email and moving my data to OneDrive! Should be fixed above, but here is the link if you are still having issues. https://flittorg-my.sharepoint.com/:b:/g/personal/jaredflitt_flitt_org1/EU5-feCrhylBnvFifzuDQy8BK5apuIafBOk_6A9RQTIsKQ?e=P2L6W4

jared_f · ‎May 12 2020

Hi @ArthurJames, do you have Zoom? I haven't been playing around with Meraki MDM too much over the last year (though I still do glance at it). That being said, I was the lead on the management and deployment on Jamf Pro at my University for our iOS and Mac management platform and I did all the integrations with Apple School Manager. Are you using an SIS? My high school relied heavily on PowerSchool when they implemented Apple Classoom. My university uses a product called Banner from Ellucian, I always wanted to build the bridge but they weren't too Apple friendly and I have moved on from my day to day work there. I might by a little Meraki rusty ~ but I am sure I can help!

jared_f · ‎Jul 24 2019

Do you plan on using this iPhone in production in the future and would want it to be in DEP? To make your life easier, I would just remove the device from the DEP profile in Meraki. You need to do this prior to doing a factory reset -- the DEP configuration comes down once the device is activated (once you start setup). Another option is to remove it from the DEP scope and then remove it from Apple Business/School Manager by either (a) removing it from scope of the Meraki server or (b) fully removing it from DEP.

jared_f · ‎Jul 24 2019

@Paul_CELP How is your DEP enrollment setup in Systems Manager? Are the devices added to that enrollment. I haven't done a direct phone transfer, but if your DEP enrollment is properly setup and allocated to the correct devices it should force them at the end of the transfer to enroll. You need to make sure that you are making enrollment mandatory and the MDM profile non-removable. While I have never directly done so... I have worked with iCloud backups... My recommendation to you is to get your folks in the habit of using iCloud backup and having it configured. Are phones are heavily restricted so they use little data and only the apps I push out so the 5gb isn't and issue for us. I know when I take a backup of phone "A" and restore it on phone "B" during setup phone "B" goes through DEP after that backup is restored.

jared_f · ‎Jul 24 2019

Sadly no, I installed the Meraki agent on a PC already bound to the domain. Then in order to populate a user the device needs to be enrolled again. I actually did find a use for JumpCloud. To connect to WiFi it is WPA2 Enterprise with AD and your IP gets issued via Windows DHCP. I can fully shutdown my domain and authentication fails over to JumpCloud and DHCP fails over to my Synology HA Cluster and the DNS is changed to 8.8.8.8 and 8.8.4.4 -- that was the only use I found for JumpCloud in the end.

jared_f · ‎Jul 16 2019

Are the devices joined to Meraki using just the agent or also the MDM tie-in (if it is even in Windows 7 -- I know it is in Windows 10)? If so, I believe if you remove the MDM connection, run the agent uninstall script, then delete the device from Meraki (in that order), it removes it.

jared_f · ‎Jul 12 2019

I agree with all of the above. The big thing for us is infrastructure. We ditched our last server in 2007 and all of our services are hosted. Meraki was one of the first to offer a hosted MDM suite and is one of few currently offering a camera suite w/o the need for an NVR. The cost is a little more, but for a smaller team makes more sense in my eyes.

jared_f · ‎Jul 12 2019

I would go with the newer ones. A site walk through is your best option and see is panoramic might work best to eliminate multiple cameras in certain areas.

jared_f · ‎Jul 12 2019

I also have RD issues with Meraki. ARD is my best friend. Using the profile + kickstart command you can successfully enable in on Mojave.

jared_f · ‎Jul 12 2019

Glad to hear. The certificates can be a real pain.

jared_f · ‎Jul 12 2019

Hello All! Try reaching out to your local Apple store. They have been a great point of contact and very helpful for me.

jared_f · ‎Apr 6 2019

The Meraki agent is generally broken. I would say that is the culprit of this specific problem.

jared_f · ‎Apr 6 2019

I have never run into this specific issue, but is there one central account you used when signing up for Apple Business Manager and/or DEP? I would use that email and password and try re-syncing. This might be a Meraki issue though.

jared_f · ‎Apr 4 2019

Apple has yet to implement this into the MDM framework. This request would have to be pointed to them and then implemented by Meraki.

jared_f · ‎Jan 9 2019

Also experiencing a similar problem. It seems Meraki doesn't like having to DC's plugged in or it throws off the sync. I removed one DC and re-synced AD groups and it seemed to have solve the problem.

jared_f · ‎Dec 24 2018

Is there any specific reason why target groups do not query auto-tags? For example, I want to have a target group for: iOS Devices + Security Policy 1 + Security Policy 2 The auto tags are more helpful than you think.

jared_f · ‎Dec 17 2018

@alexis_cazalaa In iOS, there was usually a delay as profiles were coming down. It makes sure all profiles, wifi, webclips, etc. are installed right after the device is enrolled and while the user is completing setup. I think the target groups is just to simplify scoping. I have no real use for it, but I guess if your scoping restrictions based on a student being enrolled in a grade and all grades get the restrictions you could make a target group called "All_Students" and target AD security groups containing students in 2019, 2020, 2021, 2022, etc.

jared_f · ‎Dec 16 2018

@MikeMandalorian Add an exclusion tag to the restriction profile causing problems and then add that exclusion tag to the device you want to exclude. Follow the example below. Use WITHOUT ANY of the following tags Add iOS Devices & Exclusions Make sure installation target states: iOS Devices without any of the followings tags Exclusions

jared_f · ‎Dec 12 2018

@PeterJames Noticed the same thing here. Our domain controllers were re-done and Exchange moved from 2010 so we re-enrolled everything with the agent so we can query for AD membership.

jared_f · ‎Dec 12 2018

Also experience all the same issues as above. @BlakeRichardson - How is pricing of Jamf vs. Meraki? If we were to do Jamf for Macs, I think we would switch all iOS over too - it is much more powerful, and cloudhosted like Meraki

jared_f · ‎Dec 12 2018

Hi All, I re-enrolled a test iPad today and noticed that neither the wireless or a lock screen asset tag configuration came down. Both of these are scoped based on membership in an AD group. Upon further inspection under "Users" in Meraki I was missing my AD groups... odd - I clicked the sync button and realized it was coming back that everyone in there was not a member of an AD group. Of course I did not click save as that would have messed up the scope on a lot of things. I did remote into both DCs (one replicates the other) and none of the users fell out of their security groups. Is anybody else experiencing this issue? This can be quite a problem if AD does sync... 50+ apps and a lot of configuration profiles are scoped on group membership. Thanks! Jared

jared_f · ‎Dec 12 2018

1. If you did not see, you can now create Target groups in Meraki. See Systems Manager > Tags (Under "Configure") 2. Also, you can now push profiles before the user reaches the lock screen in iOS. You will have to re-create your DEP configuration and set it as default. You can default it so it takes affect on all newly enrolled/re-enrolled devices. So, hopefully naming based on AD information coming? Also, when an AD user logs in, push profiles scoped to his/her role (Meraki already pulls security group info, pulling departments here would also be useful) soon... (?) Thanks Meraki team, these are two great features. Thanks! Jared

jared_f · ‎Dec 5 2018

@misterharrison The rule is that the most restrictive profile will take precedence. Having separate profiles is not a problem. You can leave your Meraki profile in place.

jared_f · ‎Dec 5 2018

@PeterJames As long as you do those two fixes above it should be pretty smooth rolling out the custom profile. The only thing is the software updates will be delayed 1 day. I will look into editing the actual profile code and seeing it that solves the bugs I am seeing. I agree with the bluetooth problem (especially in K-12 for Apple Classroom). My recommendation is to enforce the bluetooth restriction on any new DEP devices. In addition, you could possibly send the bluetooth command to your entire fleet and then tie that to a timed configuration profile to take effect 5 minutes after the command is sent then edit the scope to make sure is stays static. It is all about timing! Jared

jared_f · ‎Dec 5 2018

@licenseNOW When a license is assigned to a device, it is revocable. Navigate to Systems Manager > VPP (under "Manage" Heading) and check the app you are having problems with then click "Edit Auto Management" and check the following options. Finally, click Apply changes and your license count should update. I prefer to apply these options to all app I place in Self Service for users.

About jared_f

jared_f

Community Record

Badges