424 results found

1. Custom Configuration Profiles API - Download the profile as a JSON object, not a text object

   Currently it looks like the download method for the custom configuration profiles API returns the profile being downloaded as a text object not a JSON object.

   The preferred (at least for me) response object that should be returned is a JSON object in keeping with all other responses.

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

2. Apps & Media > Assignment UI redesign

   The user interface for the Apps & Media > Assignment area of SimpleMDM is rather clunky for viewing and adding assignment groups, etc.

   For example, after creating an assignment group to allocate profiles to, picking/selecting a profile is a pain as you have to know the name of a profile in order for it to appear in the list of app/media/profiles that can be added to the group. This is most painful when there are more than three profiles that can be selected (in my particular case there are over twenty profiles that can possibly be selected).

   This part of SimpleMDM could do with a redesign to make it much more useful - perhaps if it was more like the Groups interface?

   The user interface for the Apps & Media > Assignment area of SimpleMDM is rather clunky for viewing and adding assignment groups, etc.

   For example, after creating an assignment group to allocate profiles to, picking/selecting a profile is a pain as you have to know the name of a profile in order for it to appear in the list of app/media/profiles that can be added to the group. This is most painful when there are more than three profiles that can be selected (in my particular case there are over twenty profiles that can possibly be selected).

   This part of… more

   •  

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

3. Introduce source IP based allow listing

   While complex username/password + TOTP requirement is a standard and solid security requirement for administrative access to the SimpleMDM controls, it could be made even stronger with the addition of IP allow listing. I would love to have +1 layer of opt-in friction between the internet at large and a tool has the ability to brick all of my organization's laptops simultaneously.
   If implemented, I'd request that a minimum of 2, preferably 3 remote sources be required before the service could be enabled: this will provide small businesses with redundancy for the event that they change ISPs and cannot bring their IP space with them

   While complex username/password + TOTP requirement is a standard and solid security requirement for administrative access to the SimpleMDM controls, it could be made even stronger with the addition of IP allow listing. I would love to have +1 layer of opt-in friction between the internet at large and a tool has the ability to brick all of my organization's laptops simultaneously.
   If implemented, I'd request that a minimum of 2, preferably 3 remote sources be required before the service could be enabled: this will provide small businesses with redundancy for the event that they change ISPs and cannot bring… more

   1 vote

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

4. Support for defined build numbers in DDM software update

   It's fantastic that we can get started with DDM software updates... however, I think the protocol does allow for us to push a specific build number.

   This is handy for testing - as I've got a device enrolled in the beta that I'd love to push specific build numbers too, to try out the functionality - without having to reach for DFU mode on a long suffering test system.

   Going forward, it would be fantastic to nudge/enforce specific build numbers for beta testers, so we can ensure testers are all on latest betas where appropriate.

   Thanks :)

   2 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

5. Use a SAN instead of CN when managing certificate renewal

   Currently if an admin wants SimpleMDM to manage the renewal of their SCEP certificates, SimpleMDM bulldozes the CN and replaces it entirely. This is problematic for workflows that require specific values to be in a CN and not a SAN. If possible, please use a SAN to insert any necessary tracking values. Intune is doing this with success (see the blue box at the top of https://learn.microsoft.com/en-us/mem/intune/protect/certificates-profile-scep).

   2 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

6. Enrollment Setting - Unassign Profiles at Re-Enrollment

   We heavily utilize individually assigned profiles for Macs. There are also a few default profiles assigned via group. When a new out-of-box Mac is being enrolled for the first time only those default profiles are installed (around 5). Profiles are installed quickly and reliably. Later on during provisioning our configuration management tool handles installing other required per device profiles.

   However, when a Mac from stock is being re-enrolled to be used by another person, every previously assigned profile is installed at setup assistant. Since in my case those individually assigned profiles are usually per user, team, department, etc. and no longer pertain to the new person using the Mac, the device configuration is functionally incorrect. I'd prefer if on re-enrollment they weren't assigned at all. With a significant number of profiles, there's also no guarantee they will all be installed by the time the user hits the desktop, and since MDM has no concept of priority delivery, oftentimes those individually assigned per device profiles from the last user get installed before the default ones.

   The current workaround is to use a webhook to watch for lock or unenrolled events and use the API to programmatically unassign profiles. I'd prefer not to though. I'm specifically asking for a setting, globally or per enrollment, to unassign every profile except those assigned to a group at re-enrollment.

   We heavily utilize individually assigned profiles for Macs. There are also a few default profiles assigned via group. When a new out-of-box Mac is being enrolled for the first time only those default profiles are installed (around 5). Profiles are installed quickly and reliably. Later on during provisioning our configuration management tool handles installing other required per device profiles.

   However, when a Mac from stock is being re-enrolled to be used by another person, every previously assigned profile is installed at setup assistant. Since in my case those individually assigned profiles are usually per user, team, department, etc. and no… more

   8 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

7. Make logging more detailed for MDM commands

   While I appreciate how detailed SimpleMDM logs can be, especially with raw responses from MDM, sometimes they need to provide more detail. For example, when sending an OS update command the log only contains...

   "Log Details
   Full ID E7B0DBE9-A7C1-4EC8-8CB8-BFA4AB990C59
   Created At 2023-08-17 3:34 PM
   Namespace device
   Type os.update.idle
   Level info
   Device redacted
   UDID F405AA51-FF04-4B71-900F-9C09F0515398
   Serial Number redacted

   Metadata
   {
   "update_version": "13.5.1"
   }
   "

   With OS updates in particular, it's useful to know what mode was used as well. 'downloadonly', 'notifyonly', 'installasap', or 'forceupdate' are all options, but there's no associated data. For some basic commands like Bluetooth enable/disable there's not as much need, but for more complex commands with many possible settings, having that detail is useful. Even more so when a command is queue via API, with no confirmation the passed arguments worked.

   Please consider adding more data to logs.

   While I appreciate how detailed SimpleMDM logs can be, especially with raw responses from MDM, sometimes they need to provide more detail. For example, when sending an OS update command the log only contains...

   "Log Details
   Full ID E7B0DBE9-A7C1-4EC8-8CB8-BFA4AB990C59
   Created At 2023-08-17 3:34 PM
   Namespace device
   Type os.update.idle
   Level info
   Device redacted
   UDID F405AA51-FF04-4B71-900F-9C09F0515398
   Serial Number redacted

   Metadata
   {
   "update_version": "13.5.1"
   }
   "

   With OS updates in particular, it's useful to know what mode was used as well. 'downloadonly', 'notifyonly', 'installasap', or 'forceupdate' are all options, but there's no associated data. For some basic commands like… more

   9 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

8. WatchOS management support

   We would like to deploy a fleet of Apple watches and would like to get support to manage these via DDM

   https://developer.apple.com/videos/play/wwdc2023/10039/

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

9. Auto-admin password complexity settings

   For the auto-admin password generation done by SimpleMDM, it'd be preferable to be able to manage the level of password complexity when the password is generated. Environments can have different password policy rules that all accounts, including MDM generated, need to abide by. The Dude abides.

   Password storage apps like 1Password and Keeper offer, at minimum, password length, use of numbers, and use of special characters. See attached.

   •  

   •  

   9 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Submit Rating

10. Support SCIM provisioning and de-provisioning for admin accounts

    SCIM (System for Cross-domain Identity Management) is a REST/JSON protocol defined in RFC 7644 that allows identity providers to direct service providers to make account create, update, and delete actions. It is generally used to pre-provision access for new accounts and de-provision access for accounts that no longer require it.

    Please add support for SimpleMDM to work with the SCIM protocol for administrator accounts. A minimum implementation for our purposes would be to create administrator accounts using SCIM at the default permission level, and have the delete function revoke access on the given account. In a perfect world, the SCIM API would also be able to map users to defined roles to keep permissions low - this would apply both at creation time and updating existing admin accounts to use a different role than they currently are assigned.

    SCIM (System for Cross-domain Identity Management) is a REST/JSON protocol defined in RFC 7644 that allows identity providers to direct service providers to make account create, update, and delete actions. It is generally used to pre-provision access for new accounts and de-provision access for accounts that no longer require it.

    Please add support for SimpleMDM to work with the SCIM protocol for administrator accounts. A minimum implementation for our purposes would be to create administrator accounts using SCIM at the default permission level, and have the delete function revoke access on the given account. In a perfect world, the SCIM… more

    17 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

11. Allow users to see the ipad locations on a map but nothing else

    Allow users to see the ipad locations on a map but nothing else. Just users who want to see real-time location of all the ipads. But don't let them manage the ipads, change settings, etc.

    1 vote

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

12. Allow before/after (un)installation script overrides for shared apps

    This would enable one to benefit from shared auto-updating apps while applying useful improvements such as /Applications/Docker.app/Contents/MacOS/Docker --unattended --install-privileged-components.

    5 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

13. Allow for export of all config profiles

    Currently you can only export the XML for custom config profiles. I am requesting that we are able to export the XML for all configuration profiles.

    1 vote

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

14. Upload more than 2 media files at once

    Increase the upload limit, allowing more than 2 files at a time.

    1 vote

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

15. Make the `app_usage_data` portion of Munki optional

    Having just confirmed with Eric and others in the Slack channel that SimpleMDM's Munki instance doesn't make use of the app_usage_data feature in Munki - would it be possible to create a toggle to turn it off?

    Additionally there are some global regions where tracking this kind of stuff falls foul of local privacy laws...

    ...and it's upset my privacy focused end users.

    Thanks in advance

    11 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

16. Filtering out data during Device Export

    Have the ability to filter out certain data points when doing a Device Export

    4 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

17. Notifications for nodes running low on disk space

    Notifications for nodes running low on disk space

    2 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

18. Implement "force password change when the user authenticates"

    As per https://support.apple.com/en-ca/guide/deployment/dep4d6a472a/web, Apple has an API for forcing a user password change. This is useful when updating password policy - passwords that met the old policy but no longer meet the new policy are not evaluated and forced to change. This setting, however, would make it so.

    6 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

19. Allow devices to be marked as unmanaged

    Another idea to borrow from Jamf Pro. Please consider allowing SimpleMDM customers to mark devices as unmanaged in order to keep them for historical or data purposes without them actively being under management and NOT taking up a license. An unmanaged device would keep the same config, but not have the ability to interact with MDM moving forward. No profile installs, polling for device info, etc. It is a record stuck in time. Devices should be able to move freely between managed/unmanaged through the GUI and API.

    As it today, every device which exists in a SimpleMDM tenant takes up a license. No matter how long ago the device was enrolled, when it last checked in, etc. a license is still consumed. Though I understand the advantage on the PDQ side for billing and revenue purposes, it would be useful as a customer to be able to keep devices within SimpleMDM as unmanaged without having to pay for the corresponding license. As best I can tell, when a device in removed it's data is not also removed. I've tested this by removing a device and re-enrolling it. Immediately after re-enrollment the old data is still present, even before MDM has had a chance to report back. My theory is when a device is removed it's simply tagged/marked as removed, with all other associated data remaining in the database. If that's the case, it's a zero or neglible cost to allow customers to mark devices as unmanaged since the only difference is whether the device is visible and requesting regular MDM actions.

    The only other options are for customers to buy more licenses (probably what PDQ prefers) or run regular cleanup to remove old/stale/retired/archived devices. While MDM is not and should not be an inventory, there are common operational and compliance needs to keep MDM device records around for longer even for devices which aren't being managed. So tl;dr - Allow devices to be marked as managed and unmanaged.

    Another idea to borrow from Jamf Pro. Please consider allowing SimpleMDM customers to mark devices as unmanaged in order to keep them for historical or data purposes without them actively being under management and NOT taking up a license. An unmanaged device would keep the same config, but not have the ability to interact with MDM moving forward. No profile installs, polling for device info, etc. It is a record stuck in time. Devices should be able to move freely between managed/unmanaged through the GUI and API.

    As it today, every device which exists in a SimpleMDM tenant takes up… more

    4 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating

20. Add Support for Munki Conditionals to SimpleMDM's Munki Implementation

    Munki includes the ability to set "conditionals" for items in specific manifests to provide granular controls over the installation or appearance of items.

    For example, if I have a multi-site organization, I can set a conditional on a NOPKG item that installs a printer so that the printer install NOPKG only shows up if the device user is connecting to Munki from a specific subnet. This allows me to refine the view of available self-service printers so that, for example, the printers available at Site A only show up if the user's local IP address matches the subnet at Site A. This results in me being able to pile all of my printers into a single Manifest/Assignment Group, and prevent users from seeing an overly polluted view of the printers available.

    Other uses for conditionals include defining installs as only taking place on portable computers (such as a VPN client).

    Please see the Munki documentation for Conditonals in Manifests at https://github.com/munki/munki/wiki/Conditional-Items for more information.

    Munki includes the ability to set "conditionals" for items in specific manifests to provide granular controls over the installation or appearance of items.

    For example, if I have a multi-site organization, I can set a conditional on a NOPKG item that installs a printer so that the printer install NOPKG only shows up if the device user is connecting to Munki from a specific subnet. This allows me to refine the view of available self-service printers so that, for example, the printers available at Site A only show up if the user's local IP address matches the subnet at Site… more

    10 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Submit Rating