Meraki

T1 · ‎Dec 14 2021

It does on DEP enrolled devices.

T1 · ‎Dec 13 2021

Yes, as long as they are DEP enrolled: https://documentation.meraki.com/SM/Device_Enrollment/Apple_Device_Enrollment_Program_(DEP)

T1 · ‎Nov 11 2021

Yes, you can change user password via console as long as Meraki Agent is installed. Having said that, if device is not encrypted, there are ways to bypass it.

T1 · ‎Oct 22 2021

I have always been under the impression that to remove DEP enrolled devices from the network, you need to "Unassign settings" under Systems Manager > Manage > DEP. Which is direct opposite of enrolling them by "assigning settings" in MDM which consumes a license and activating the device establishing the link between the two. Deleting them from the devices list works for other types of enrollment,

T1 · ‎Oct 14 2021

Can we see the error in question? I was getting an unspecified error with one of my test accounts until I cleared the browser cache. Althought, the manifest in my app has different type for reply URL entries.

T1 · ‎Oct 7 2021

There are 3 ways to enroll iOS device in MDM. Company owned devices should ideally be enrolled via DEP, device enrollment is a decent alternative for BYOD and user enrollment is a joke and a pain to set up and manage.

T1 · ‎Oct 1 2021

Did you choose a Device profile (Default) or User Profile (Apple)? Former has all available settings, latter what you have on your screenshot.

T1 · ‎Sep 30 2021

It is easier to put the installer onto a public s3 bucket with a complex name like "our_sohphos_unstaller_for_mdm.domain" and push a script to macs to download, unzip and install it.

T1 · ‎Sep 20 2021

Nothing has changed in the last 2 years. Windows 10 support is non existent.

T1 · ‎Sep 14 2021

Managed to get it working: new portal requires a new reply URL to be added to Azure app: https://enroll.meraki.com/loginsuccess

T1 · ‎Aug 17 2021

So, I got an email earlier today inviting to beta test new enrollment URL enroll.meraki.com. Clicked on the link and got 503 error, because automatic redirect to HTTPS is not configured. Fair enough, this is a beta test after all. Let's see what next steps are: it accepted network shortcut but stumbled at authentication (we have Azure AD configured) with error AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'XXXXXXXXXXXXXXXX'. Have devs forgotten to repoint Azure auth component from their test environment to the public ones?

T1 · ‎Jun 13 2021

According to Microsoft the code scanner app ID is com.apple.barcodesupport.qrcode, but it doesn't come up in the list when I search for it in Mobile App Config.

T1 · ‎May 6 2021

This is not entirely true, you can specify user created tags as "Default" ones under Systems Manager > General.

T1 · ‎Feb 25 2021

Is device in question even online? I doubt the thief would turn it on, connect to WiFi and leave it sitting at the Windows login screen for you to wipe remotely. We occasionally use remote wipe to quickly reset returned Windows laptop, it is slightly quicker than going through Settings and it works without signing in.

T1 · ‎Jan 3 2021

Are there any security implications? We have quite a few devices enrolled in 2019 that have 3 out of 5 signing certificates expired, which marks Management Profile as "Not Verified". I'd rather not re-enroll a thousand odd devices.

T1 · ‎Nov 25 2020

We don't enroll Macs via DEP but with iPads profiles for iOS 12 and iOS 13 are not completely interchangeable. We had a case when iOS 12 device wouldn't activate with iOS 13 profile or other way around. We do skip as much steps as possible though, so I think the reason might lie in additional steps introduced in iOS 13. iOS 13 profile works fine with iOS 14 device though.

T1 · ‎Oct 23 2020

Just spin up a separate MDM network per each domain. We have four in our tenant with different authentication methods.

T1 · ‎Aug 3 2020

If you Google for "Cisco Umbrella Roaming Client unattended installation", the desired result is on the front page. https://docs.umbrella.com/deployment-umbrella/docs/appendix-g-command-line-and-customization-for-installation

T1 · ‎Jun 8 2020

https://gallery.technet.microsoft.com/scriptcenter/PS2EXE-Convert-PowerShell-9e4e07f1 There is also a GUI version of it: https://gallery.technet.microsoft.com/scriptcenter/PS2EXE-GUI-Convert-e7cb69d5 I use MSIWrapper for .exe to .msi conversion and sign it with signtool.exe. There is probably a better or easier way to do it but this is what I stick to right now.

T1 · ‎Jun 8 2020

I usually code thing like that in Powershell, then wrap the script as .msi, sign it and push as an app.

T1 · ‎Jun 8 2020

How do you enroll iPhones in MDM? DEP, User Enrollment or good old profile enrollment via m.meraki.com? We have had O365 with MFA and MDM for a couple of years now, never had any problems. What kind of restrictions, settings and credentials are you pushing with your profile? As mentioned below Outlook is a preferred option here, but our users use native Mail as well. It does sometimes require mail account reset but it has nothing to do with MDM and happens on both enrolled and not enrolled devices.

T1 · ‎May 28 2020

If anyone is still interested, this is how I did it. In Okta create a new app, type Web. In General Tab set the following: Initiate login URI: https://m.meraki.com Login redirect URIs: merakismoauth://com.meraki.pcc https://m.meraki.com https://mp.meraki.com/ssp/login https://mp.meraki.com/ssp/loginsuccess https://portal.meraki.com/loginsuccess Allowed grant types: Authorization code tick Implicit (Hybrid) tick Allow ID Token with implicit grant type tick Allow Access Token with implicit grant type In MDM go to System Manager > General and scroll down to User authentication settings. Choose OpenID Connect from the drop down menu. Authorization endpoint: https://TENANT.okta.com/oauth2/v1/authorize Token endpoint: https://TENANT.okta.com/oauth2/v1/token Client ID: XXXXXXXXXXXXXX (Okta app Client ID) Token issuer claim: https://TENANT.okta.com Public Keys Endpoint: https://TENANT.okta.com/oauth2/v1/keys?client_id=XXXXXXXXXXXXXXX Public Keys Format: JWK Endpoints can be looked up via this API call: https://TENANT.okta.com/.well-known/openid-configuration?client_id=XXXXXXXXXX I suppose this approach can be used with any IDP and then you need to double check what claims IDP returns to Meraki. Meraki expects "email" claim with user email as a value. Okta sends all default info in its claim so there is no need to set up a custom authorization server. With other IDPs it can be different. I asked support to include this example to official docs.

T1 · ‎May 14 2020

Can you please explain a business case for a shared business iPad?

T1 · ‎Apr 26 2020

Remote device wipe requires active Internet connection which is unlikely with lost or stolen laptops. Besides, not many laptops have LTE modules in the first place. Reasonable password complexity policy and enforced encryption adds more to security than remote wipe gimmick.

T1 · ‎Apr 23 2020

With domain in place why do you enroll Win 10 devices in MDM in the first place? It offers virtually nothing in terms of device configuration, restrictions or reporting. Domain covers everything Meraki can offer and much more.

About T1

T1

Community Record

Badges