Suggestions
Have a great idea that you’d like to see added to our service? Perhaps there’s an existing feature that you’d like to have extended or modified? Share it here!
401 results found
-
Improve Device Search with More Attributes
Currently device search only supports device name, serial number, IMEI, MAC, and phone number.
Scenarios where search doesn't return the results I need:
- When I need to search by a custom attribute. For example, say I want to return all devices where the username attribute is "nathaniel.strauss". I am unable to since those attributes are not exposed in search. This is a common ask - "How many devices does x have?" The same holds true for any custom attribute set from SAML assertion - team, department, etc.
- When the device name (SimpleMDM defined) doesn't match the Device Name…46 votes -
Show all apps on all devices, enriched with metadata & approval-management
Currently I can see a list of all installed apps for one device at a time. I would love to have an overview of ALL the apps across ALL managed devices.
My use case: We allow users to install apps themselves, but they need to be approved. I would like to see all apps, filter out the system apps (like "AirDrop"), and then see which apps are only on a single/a few devices.Additionally:
* I want to see if an app is notarized/from the App Store, since any malware app can just call itself "Calendar.app".
* I want…25 votes -
Support choosing which webhook events to subscribe to per endpoint
https://api.simplemdm.com/#webhooks
The current webhook events are as follows...
device.changed_group
device.enrolled
device.unenrolled
device.lock.enabled
abm.device.addedWhenever any of these events occurs, the webhook endpoint is pinged. However, processing these can get particularly noisy, especially in large environments and (hopefully) as SimpleMDM adds more supported events.
I am asking to add support for selecting which events are subscribed to per webhook endpoint. This way only events needed for a particular workflow are sent and the webhook receiver requires less work to filter out unneeded data.
The UI could look like other SimpleMDM settings with checkboxes for each event, where by default all are…
7 votes -
Add Device Group to the standard attributes
Adding the devices group to the standard attributes would make it much easier to customize profiles based on the group of the device. This is somewhat possible to do currently with a default value on a custom attribute, but a standard attribute would be preferred.
9 votes -
Build in native support for Nudge
As Mac admins, it's fair to say that the current state of patch management isn't great... and that Nudge is the go to open source tool to get devices patched in a timely fashion. I can also see that other vendors have actually integrated Nudge into their products.
It would be awesome if SimpleMDM would consider something similar - not least because of how well you've integrated Munki.
Selfishly it means I don't have to roll it out myself... ;)
11 votes -
Enforce matching name and device_name fields
Note: Due to formatting, not including the _ underscore in device name. Everything was italics.
SimpleMDM has two name values for each device - "name" and "device name". "name" is the value used in the device list (https://a.simplemdm.com/admin/devices) and the header of a device record. "device name" is the actual hostname set locally. If the hostname changes on device, it will change in SimpleMDM on next inventory refresh. Similarly, "device name" can be edited manually in SimpleMDM and a MDM command will be issued to update it on device.
What if "device name" changes at any point…
14 votes -
Add a Dark Mode option
Add an option for dark mode on the web interface.
8 votes -
Report on installed certificates
I'd like to see SimpleMDM report on installed certificates for all device types. A common feature in other MDMs, CertificateListCommand (https://developer.apple.com/documentation/devicemanagement/certificatelistcommand) has been around since iOS 4 and macOS 10.7 (!).
While we have other tools to report on certificates (like osquery), it's useful to have MDM as a data source as well since oftentimes installed certificates originate via profiles. Knowing certificate health within the same product has benefits, and could allow for more advanced certificate management directly in SimpleMDM.
Important fields...
- Certificate name
- CA/issued by
- Expiration
- Current validity status
- If possible, whether…8 votes -
Store more information for deleted devices
Deleted devices have very little paper trail to them shown in the web console. If we have the ability to store the custom attributes, notes and who deleted the device with the deleted devices, that would be a huge help in understanding why a specific machine was deleted without searching through other sources.
12 votes -
API: Dont send Filevault keys by default from /devices
Separate the device API so it does not return filevault keys with every device object. Or create a filter to omit the keys.
I keep running into scenarios where using the device API means scrubbing file vault keys every single time I make it get request to https://a.simplemdm.com/api/v1/devices
It gets pretty messy downstream especially with logs.3 votes -
Add profile.created and profile.deleted webhook events
https://api.simplemdm.com/#webhooks
I am requesting the profile.created and profile.deleted events be added to webhooks. Considering the sensitive nature of profiles, it follows these are events which would be of interest to security and IT teams. For example, if an attacker were to gain access to a SimpleMDM instance and craft a malicious profile.
In our case, most profiles are created through the API. Knowing when a profile is manually created in the web app is an important signal as it could mean someone has maliciously gained access or an impending profile misconfiguration is on the way. We also keep a cache…
4 votes -
Support custom attributes for boolean values in profiles
I would like to create a custom configuration profile that uses an attribute to populate a boolean field, like so:
<key>allowCloudDocumentSync</key>
<{{setting_allowCloudDocumentSync}}/>In this case, the default value of the attribute would be "false", but I would be able to override that with "true" at the group or device level.
Currently, since the above is not valid Plist syntax SimpleMDM will reject the profile during upload or pasting into the console.
8 votes -
SimpleMDM Terraform provider
It would be great if you could create a provider so we can manage SimpleMDM using Terraform :)
Adding a picture of a Capybara walking on water for the wow effect6 votes -
Implement more granular API permissions
In https://suggestions.simplemdm.com/forums/204404-suggestions/suggestions/32990482-scope-api-key API permissions were split up to correspond with API endpoints. While a welcome change, it doesn't go far enough in providing granular access to sensitive MDM actions. Since the the /devices endpoint contains so much (device update, info, restart, shut down, lock, erase, etc.) it is a prime target were an API key to be compromised.
I am asking for API permissions to be split up to be even more granular by MDM command. An API key which only needs to enable/disable remote desktop should not also be able to lock or wipe the device. While I don't…
3 votes -
Add column sorting to all columns across SimpleMDM
For example, under Devices > Enrollments > [MDM Server] > DEP Info, none of the columns (S/N, Model, Color, Last DEP Check-In, Linked Device, Status) can be sorted.
Another example is Config > Profiles. Only the "Type" column can be sorted, but none of the other columns.
I realize we can search and filter on these same pages, but it would be helpful to have sort options as well.
17 votes -
Report on Rapid Security Response versions
Apple is adding a new update type to macOS called Rapid Security Responses. These updates change the build version, but not the OS version reported. Instead, the new ProductVersionExtra (
sw_vers) and SupplementalOSVersionExtra (MDM query) keys are returned to denote a specific supplemental version only when a RSR is installed. If no RSR is installed the key is not present. Similarly, when using MDM query (simulated with /usr/libexec/mdmclient QueryDeviceInformation) BuildVersion is unchanged, but SupplementalBuildVersion has the correct RSR build.$ sw_vers ProductName: macOS ProductVersion: 13.3 ProductVersionExtra: (a) BuildVersion: 22E7752300f
…$ /usr/libexec/mdmclient QueryDeviceInformation { BuildVersion = 22E5230e; OSVersion = "13.3";4 votes -
Offer access to script jobs from MSC
Not sure if this is possible, but I'd like to be able to assign script jobs, so they'd appear in the MSC. I know this is probably somewhat similar to NoPKG, but it would remove the hassle of authoring the PKG.
1 vote -
Assign profiles to multiple groups from the Profiles Action menu
There's no easy way to assign a single profile to multiple groups at once. Instead, I have to go to the Groups view and click on each group I want to add the profile to, click the profile tab, click Assign Profile, find the Profile I want to add, then click the Assign button. Doing that for each group is tedious.
Instead, I suggest the Profiles view have an option in the Action button to be able to add whichever Profiles are selected to add to Groups. I imagine the resulting view would be a list of groups with a…
17 votes -
allow user roles who (only) see their own device
The idea here is to make our employees trust in the MDM solution. I'd like to give them read-only-access to SimpleMDM to see
1) what is configured
2) what I can see about their device
3) what is NOT possible (I frequently get the question "can you read my e-mail now?")Currently, the lowest level of access still allows to see ALL settings, accounts and apps installed on ANY device.
Being able to restrict the app-listing (similar to the settings in "Allow secret information visibility") would be a helpful feature.
Even better would be linking the SAML-identity from the Enrollment…
13 votes -
Allow for a few different local admin password formats
The current format is often very hard to type (and not easily copied), so it would be helpful if you offered some other password types that were more user and script friendly. 1Password's "memorable" word based passwords are a good example of a strong password, that's also easy type. Bonus points if you omit characters that need to be escaped in scripting (like when using the sysadminctl -secureTokenOn function).
Thanks3 votes
- Don't see your idea?