439 results found

1. Add Scripts and Script Jobs to API

   Feature Request: Add Scripts and Script Jobs to API

   Currently the "Scripts" and "Script Jobs" functionality is only supported when using the SimpleMDM web console via a browser.

   • Scripts: https://a.simplemdm.com/admin/scripts
   • Script Jobs: https://a.simplemdm.com/admin/script_jobs

   With the goal to support custom advanced automation for our machine provisioning processes and integration with other configuration management systems, we need the ability to:

   Requirements:

   • Create/Update (Upload) and Delete Scripts
     • Support multipart/form-data by default (similar to other SimpleMDM APIs)
   • List and Get Scripts, including:
     • Script ID
     • Script name
     • Full script contents
     • Created/Updated timestamps
   • Create Script Jobs
   • List Script Jobs
   • Get Job Status
   • Get Job Log / Results / Output

   Desirable bells & whistles premium options:

   • Query / Filter Script Jobs via Script Jobs List API. Available Filters might include:
     • Script Name
     • Script ID
     • Target ID(s) (Device ID(s), Device Group ID(s), Assignment Group ID(s))
     • Target Type(s) (Devices, Device Groups, Assignment Groups)
     • Created Timestamp
     • Updated/Modified Timestamp
     • Script Status (Pending, Completed, Failed)
   • Support Base64 encoding for Script Content when Creating/Updating scripts
   • API endpoint to get "raw" (application/octet-stream? Base64 encoded text/plain?) output of the script stdout/stderr Something like: GET https://a.simplemdm.com/api/v1/job/response/{job_id}
     • Currently the web console embeds the Script output as a JSON-escaped field in the "Metadata.job_response" field

   Why we need this functionality:

   We use SimpleMDM in addition to SaltProject for fleet management. Most of our fleet configuration is driven by Salt, however having the ability to use the native macOS MDM for management and automation will greatly benefit our ability to serve our users. The combination of Scripts (with Attribute Support!) and Jobs could be a game changer --if-- we could programatically interact with it. Some scenarios where this is valuable:

   • Initial Device Provisioning: When a new Device is enrolled in SimpleMDM, we want to take additional actions via the "device_enrolled" webhook event with a Script Job to do just-in-time provisioning.
   • Device Status Change Events: We already pull all SimpleMDM logs via API. We want to take advantage of

   Example scenarios:

   1. Upload A Bash Shell Script

   Request (POST)
   curl https://a.simplemdm.com/api/v1/scripts/ \
   -F "[email protected];filename=myscript.sh" \
   -F attributesupport=true \
   -u {APIKEY}:

   2.1. Execute myscript.sh against a single device

   Request (POST):
   curl https://a.simplemdm.com/api/v1/jobs/ \
   -d scriptname=myscript.sh \
   -d target={deviceid} \
   -d target_type=device

   Response:
   HTTP/1.1 200
   {
   "data": {
   "type": "job",
   "id": "abcde123456",
   "attributes": {
   "scriptname": "myscript.sh",
   "created": "2022-03-03T01:23:45Z",
   "createdby": "[email protected]",
   "target_type": "device",
   "target": "device-id-xxxx1234",
   "status": {
   "pending": 1,
   "completed": 0,
   "failed": 0
   },
   "devices": [
   {
   "id": "device-id-xxxx1234",
   "status": "pending"
   }
   ]
   }
   }
   }

   2.2. Execute myscript.sh against a device group

   Request (POST)
   curl https://a.simplemdm.com/api/v1/jobs/ \
   -d scriptname=myscript.sh \
   -d target={devicegroupid} \
   -d targettype=device_group

   1. Get Job Status:

   Request:
   curl https://a.simplemdm.com/api/v1/job/{JOB_ID} \
   -u {API_KEY}

   Response:
   HTTP/1.1 200
   {
   "data": {
   "type": "job",
   "id": "abcde123456",
   "attributes": {
   "scriptname": "myscript.sh",
   "created": "2022-03-03T01:23:45Z",
   "createdby": "[email protected]",
   "targettype": "device",
   "target": "device-id-xxxx1234",
   "status: {
   "pending": 0,
   "completed": 1,
   "failed": 0
   },
   "devices": [
   {
   "id": "device-id-xxxx1234",
   "status": "completed",
   "logid": "wxyz0987"
   }
   ]
   }
   }
   }

   1. Get Job Output

   Request:

   curl https://a.simplemdm.com/api/v1/job/log/{LOG_ID} \
   -u {API_KEY}

   Response:

   {
   "data": {
   "type": "log",
   "id": "ec481e3a74a44f588f95bab03f9b76e5",
   // ... standard job attributes?
   "metadata": {
   "name": "myscript.sh",
   "job_status": "0",
   "stdout": "<<Base64 Encoded stdout>>",
   "stderr": "<<Base64 Encoded stderr>>"
   }
   }
   }

   Feature Request: Add Scripts and Script Jobs to API

   Currently the "Scripts" and "Script Jobs" functionality is only supported when using the SimpleMDM web console via a browser.

   • Scripts: https://a.simplemdm.com/admin/scripts
   • Script Jobs: https://a.simplemdm.com/admin/script_jobs

   With the goal to support custom advanced automation for our machine provisioning processes and integration with other configuration management systems, we need the ability to:

   Requirements:

   • Create/Update (Upload) and Delete Scripts
     • Support multipart/form-data by default (similar to other SimpleMDM APIs)
   • List and Get Scripts, including:
     • Script ID
     • Script name
     • Full script contents
     • Created/Updated timestamps
   • Create Script Jobs
   • List Script Jobs
   • Get Job Status
   • Get Job Log /… more
   8 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   completed  ·  Anonymous responded

   This has been implemented. Please see our documentation for more information:

   • Scripts API: https://simplemdm.com/docs/api/#scripts
   • Script Jobs API: https://simplemdm.com/docs/api/#script-jobs

   
   

   If there are additions/changes you would like to see, please submit a new suggestion. Also, thank you for the very detailed description!

2. Manage Non-Custom Profiles via API

   Currently the API has a customconfigurationprofiles endpoint (https://simplemdm.com/docs/api/#custom-configuration-profiles) which can be used to create, modify, and assign/unassign custom profiles. However, there is on way to manage other profile types via the API.

   Say I create a FileVault profile in the web app and then want to assign the profile only to specific Macs using the API. There's not a specific group or device I want to manually assign. Instead I only want to assign to specific endpoints programmatically using a config management tool like Chef or Ansible. Since the profile is not "custom" I am unable to.

   I am asking regular, non-custom profiles have these actions added to the API.

   • Assign to device
   • Unassign from device
   • Assign device group
   • Unassign from device group

   Just like is currently possible for custom profiles - https://simplemdm.com/docs/api/#assign-to-device I understand there's complexity with creating these profiles through the API and thus this request does not cover that scope. Thank you!

   Currently the API has a customconfigurationprofiles endpoint (https://simplemdm.com/docs/api/#custom-configuration-profiles) which can be used to create, modify, and assign/unassign custom profiles. However, there is on way to manage other profile types via the API.

   Say I create a FileVault profile in the web app and then want to assign the profile only to specific Macs using the API. There's not a specific group or device I want to manually assign. Instead I only want to assign to specific endpoints programmatically using a config management tool like Chef or Ansible. Since the profile is not "custom" I am unable… more

   8 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

   This has been added! Documentation is available here: https://api.simplemdm.com/#profiles

3. Support more API profile query strings

   To get information about a custom profile through the API the only option is to list them all and then filter out the required data.

   https://api.simplemdm.com/#custom-configuration-profiles

   On a SimpleMDM instance with 100+ profiles, requesting a single page of profiles takes a very long time.

   curl https://a.simplemdm.com/api/v1/custom_configuration_profiles?limit=100 \
     -u ${API_KEY}:
   

   Running the above command takes around 20-30 seconds. However, if there were URL parameters available to map to profile attributes - ID, name, identifier, etc. - the API could return only the one or subset of profiles requested, in turn improving performance. It shouldn't take 30 seconds to return data about a single profile.

   I'm asking for a few things here...
   1. Add parameters in order to refine the profiles query. For example, https://a.simplemdm.com/api/v1/custom_configuration_profiles?limit=100&attributes.name=my.amazing.profile&id=4814&attributes.bundle_identifier=com.simplemdm.is.cool Any attribute returned by the API should be queryable. Having wildcard/like, greater than, less than, etc. operators a bonus as well, but not required.
   2. Support the above for both custom and regular profiles.
   3. (Optional) Optimize API performance for profiles lookup in general. Maybe there's a better way to query the database?

   To get information about a custom profile through the API the only option is to list them all and then filter out the required data.

   https://api.simplemdm.com/#custom-configuration-profiles

   On a SimpleMDM instance with 100+ profiles, requesting a single page of profiles takes a very long time.

   curl https://a.simplemdm.com/api/v1/custom_configuration_profiles?limit=100 \
     -u ${API_KEY}:
   

   Running the above command takes around 20-30 seconds. However, if there were URL parameters available to map to profile attributes - ID, name, identifier, etc. - the API could return only the one or subset of profiles requested, in turn improving performance. It shouldn't take 30 seconds to return data about… more

   8 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

   Marking this as completed to give voters their votes back but we will continue working on optimizations. Please feel free to submit new suggestions if there is something more specific you'd like to see.

4. Report on Rapid Security Response versions

   Apple is adding a new update type to macOS called Rapid Security Responses. These updates change the build version, but not the OS version reported. Instead, the new ProductVersionExtra (sw_vers) and SupplementalOSVersionExtra (MDM query) keys are returned to denote a specific supplemental version only when a RSR is installed. If no RSR is installed the key is not present. Similarly, when using MDM query (simulated with /usr/libexec/mdmclient QueryDeviceInformation) BuildVersion is unchanged, but SupplementalBuildVersion has the correct RSR build.

   $ sw_vers
   ProductName: macOS
   ProductVersion: 13.3
   ProductVersionExtra: (a)
   BuildVersion: 22E7752300f
   

   $ /usr/libexec/mdmclient QueryDeviceInformation
   {
     BuildVersion = 22E5230e;
     OSVersion = "13.3";
     SupplementalBuildVersion = 22E7752300f;
     SupplementalOSVersionExtra = "(a)";
   };
   

   https://support.apple.com/guide/deployment/rapid-security-responses-dep93ff7ea78/web

   Please update SimpleMDM to report on installed RSR version and build when present.

   Apple is adding a new update type to macOS called Rapid Security Responses. These updates change the build version, but not the OS version reported. Instead, the new ProductVersionExtra (sw_vers) and SupplementalOSVersionExtra (MDM query) keys are returned to denote a specific supplemental version only when a RSR is installed. If no RSR is installed the key is not present. Similarly, when using MDM query (simulated with /usr/libexec/mdmclient QueryDeviceInformation) BuildVersion is unchanged, but SupplementalBuildVersion has the correct RSR build.

   $ sw_vers
   ProductName: macOS
   ProductVersion: 13.3
   ProductVersionExtra: (a)
   BuildVersion: 22E7752300f
   

   $ /usr/libexec/mdmclient QueryDeviceInformation
   {
     BuildVersion = 22E5230e;
     OSVersion = "13.3";

   … more
   8 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  0 comments  ·  Delete…  ·  Admin →

5. Enable push notification messages
   7 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   3 comments  ·  Delete…  ·  Admin →
   completed  ·  SimpleMDM responded

   We now support push notifications to devices!

   To support push messaging, sign in to DeviceLink and deploy the DeviceLink mobile app to your devices. You can also configure your groups to automatically deploy the app on device enrollment (on by default).

   Let us know what you think!

6. Root CA Certificate Support

   Support for Certificates payload. Since we use some internal root CAs, we would like to be able to push those root certs to the device so that our SSL sessions are validated when mobile devices content to https signed with certs issued from that root. This will allow us to continue to use the "disallow untrusted TLS connections".

   7 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  2 comments  ·  Delete…  ·  Admin →

7. Include build numbers when you display version numbers

   Display the build number for apps that are installed and in the catalogue details.

   7 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   completed  ·  SimpleMDM responded

   For enterprise apps, the version number displayed is actually the build number of the binary, as referenced under “CFBundleVersion” in the binary plist file.

8. Allow multiple ipa files to be uploaded in one go, with a progress bar/monitor

   This will help speed up the process as you can put all your ipa files in to upload, then carry on with your day. Rather than checking back for when it completes to do the next one.

   7 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  0 comments  ·  Delete…  ·  Admin →

9. Exchange - Allow option to change number of Sync days

   Allow the ability to set the number of days to sync with Exchange.

   7 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  1 comment  ·  Delete…  ·  Admin →

10. Device Details Report

    Provide for some reporting. It doesn't have to be much but the ability to print all device detail in a single report would do the trick.

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    2 comments  ·  Delete…  ·  Admin →
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    Closing this request since this is available with the Export Devices CSV. If there is something additional you'd like to see implemented, please submit a new suggestion outlining the problem or functionality.

11. Admin Hierarchy

    There should be a hierarchy of admin privileges.

    I would suggest adding "Owner" and "Admin" as the account owner should not be able to have an admin revoke their access. There should also be the option to transfer the ownership of the account much like you can with Slack teams.

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Delete…  ·  Admin →

12. Support iOS 10.3 Restart Device Command

    In iOS 10.3, Apple has added support for remotely rebooting a device through an MDM command.

    This would be a great option for unattended use cases to clear errors remotely. We've had a number of requests for this type of functionality in the past and I'd love to see it supported in SimpleMDM.

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  2 comments  ·  Delete…  ·  Admin →

13. Support Adding .pkg and .dmg without signing

    One of the nice things about Meraki’s SM is the way in which it handles the install of Apps vs SimpleMDM namely:
    - You dont need to sign a .pkg
    - You can upload a file or specify a URL as the source of the installer (.pkg or .dmg)

    Having to sign the .pkg is kinda annoying.

    Merkai docs: https://documentation.meraki.com/SM/Apps_and_Software/Installing_Software_on_Windows_and_Mac_Devices

    •  

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    3 comments  ·  Delete…  ·  Admin →
    completed  ·  SimpleMDM responded

    Deploying unsigned binaries to macOS is now supported with our Munki integration. Please see https://simplemdm.com/announcing-hosted-munki/

14. Create Report For Installed Applications

    Report on all installed applications across all devices. If users are in a group that allows applications to be installed, include the installed/detected applications on this report.

    So, per application, number of installations, or a detail report per application that shows where it is installed (on which devices).

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    completed  ·  Anonymous responded

    We have just added an endpoint to the API that allows you to return a list of devices with a specific app installed and the versions installed on each device. This can be called on a per-app basis for apps that exist in your account's Catalog. Here is a link to the API documentation: https://simplemdm.com/docs/api/#list-installs

    
    

    This API allows you to retrieve similar information to what you would find under the "Installs" tab when clicking into an app on the Catalog page.

    
    

    I will close this suggestion for now, but if you feel that the "Installs" tab under Catalog > [app_name] and API are not sufficient for your needs, please do not hesitate to submit a new suggestion.

15. Allow app updates to be (manually) pushed to multiple devices at once

    From the Apps->Catalog->Installs screen, add a "Push update" option to the Action menu, letting me push the most recent app binary to multiple devices at once.

    At the moment, I have to go via Devices -> Devices -> Apps and update devices one at a time.

    My use case is pushing an RC version of the app to c 3-4 manager devices, and then pushing the same/approved version to many more client devices. All at once. (Without having to generate a spurious additional build version and using auto-update during the update binary process).

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    This was added a few years back.

16. Search option in DEP Info of Automated Enrollment group for device list

    Can we get a search field like we have in the Devices list but in the Devices > Enrollments > [enrollment name] > DEP Info > DEP Devices? Right now it is a static list and can only show 20, 50, 1000, or all devices. With over 2000 devices in the list it would be handy to be able to search by Serial Number to determine if the machine is in the list or not. Selecting the “all” option takes a fair amount of time to list all the devices when all I want to know is if the machine is in the list or not.

    Use Case:
    I have a read-only account for my techs to log into SimpleMDM to see if a machine is assigned to the MDM in ABM. That way they know what workflow for provisioning to use based on if the machine is assigned to an MDM or not.

    Thanks for the consideration,
    Eric

    Can we get a search field like we have in the Devices list but in the Devices > Enrollments > [enrollment name] > DEP Info > DEP Devices? Right now it is a static list and can only show 20, 50, 1000, or all devices. With over 2000 devices in the list it would be handy to be able to search by Serial Number to determine if the machine is in the list or not. Selecting the “all” option takes a fair amount of time to list all the devices when all I want to know is if the machine… more

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    completed  ·  Anonymous responded

    This was added a while back but looks like we forgot to mark it complete. Device search is now possible on DEP Info page.

17. Ability to add a post-install script to an existing package from the SimpleMDM interface
    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Delete…  ·  Admin →

18. Webhook for new DEP devices

    When a device is added to DEP it would be great to have a webhook notification.

    My goal with this is to take that notification and have it create a new asset for the new Mac in our asset management system.

    I think the Serial number would be the biggest needed component. I'm not sure what all information you can pull from Apple side, but if possible the order number would be really awesome to have and the date it was added to DEP on Apple's end.

    Thanks!

    -bryan

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Delete…  ·  Admin →

19. Allow control of the TLSTrustedServerNames field when configuring WiFi certificates

    When deploying or upgrading machines to Big Sur, I'm finding a change in behavior vs Catalina, in that when connecting to an 802.1x network, BS devices are asking the user to approve a certificate, where Catalina devices do not. In https://macadmins.slack.com/archives/C016JHNMP1N/p1611939579192200 it is suggested that the 802.1x profile can support the TLSTrustedServerNames field. However, SimpleMDM does not offer this field in the Profiles:Wireless category. I think that having this would address the unwanted dialog. As documented at https://developer.apple.com/documentation/devicemanagement/wifi/eapclientconfiguration , it seems this could be a field you could expose in the certificate management interface?

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  1 comment  ·  Delete…  ·  Admin →

20. Rotate Firmware Password option

    We would like to use unique firmware password with the option to rotate the password, in case we have to share the password with the user at some point. Currently that would only possible with moving the device to a group without a firmware password, clear the firmware password and assign the device back to the original group.

    Maybe there is a possibility like building a mechanism that sends out multiple commands (one to clear the password and one to set it again), which would effectively "rotate" the firmware password.

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    This is now available. Verified firmware passwords can be rotated by clicking the "rotate" icon next to the firmware password field on the Device Details page.