400 results found

1. Support account-driven user enrollment

   Initially announced at WWDC21 [1], macOS, iOS, and iPadOS devices starting with iOS15 and macOS Monterey support a workflow called account-driven user enrollment [2]. This workflow differs from the existing user enrollment methodology in that it uses a slightly different protocol and requires the implementation of a session token on the MDM provider side.

   We are interested in the account-driven workflow because it removes the need to distribute enrollment profiles or have users visit an enrollment URL and download / install the profile. The improved UX, when combined with this year's promised release of federated authentication to more providers in ABM, should allow customers to offer a hassle-free, non-ticket-generating BYOD enrollment for both macOS and iOS.

   References:
   [1] https://developer.apple.com/wwdc21/10136
   [2] https://support.apple.com/guide/deployment/user-enrollment-and-mdm-dep23db2037d/web

   Initially announced at WWDC21 [1], macOS, iOS, and iPadOS devices starting with iOS15 and macOS Monterey support a workflow called account-driven user enrollment [2]. This workflow differs from the existing user enrollment methodology in that it uses a slightly different protocol and requires the implementation of a session token on the MDM provider side.

   We are interested in the account-driven workflow because it removes the need to distribute enrollment profiles or have users visit an enrollment URL and download / install the profile. The improved UX, when combined with this year's promised release of federated authentication to more providers in… more

   31 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

   Account-Driven Enrollment is now supported!

2. Support the new minimum macOS version at enrollment feature

   Apple's documentation shows that a new feature will allow MDMs to set a minimum version during ADE enrollments. Please support this for testing during the macOS 14 beta cycle.

   24 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   1 comment  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

   Closing this since the feature was added and it will give some votes back. However, suggestions in comments have been noted. Feel free to open a new request with any additional suggestions.

3. Support the new FileVault enforcement key in macOS 14

   macOS 14 adds support for the new "ForceEnableInSetupAssistant" key to require that devices enable FileVault during Setup Assistant. Please support this key for testing during the macOS 14 beta cycle.

   7 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  1 comment  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

4. Add device EID from DeviceInformationResponse.QueryResponses.ServiceSubscriptionProperty command

   Hello,

   as part of eSIM distribution it will be very nice to have EID of the devices accessible via API in device details (adding EID to portal will be also nice).

   Can you please add EID to each device from MDM command (this command is already in use by SimpleMDM for other data) https://developer.apple.com/documentation/devicemanagement/deviceinformationresponse/queryresponses/servicesubscriptionproperty

   Thank you David.

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

5. Support more API profile query strings

   To get information about a custom profile through the API the only option is to list them all and then filter out the required data.

   https://api.simplemdm.com/#custom-configuration-profiles

   On a SimpleMDM instance with 100+ profiles, requesting a single page of profiles takes a very long time.

   curl https://a.simplemdm.com/api/v1/custom_configuration_profiles?limit=100 \
     -u ${API_KEY}:
   

   Running the above command takes around 20-30 seconds. However, if there were URL parameters available to map to profile attributes - ID, name, identifier, etc. - the API could return only the one or subset of profiles requested, in turn improving performance. It shouldn't take 30 seconds to return data about a single profile.

   I'm asking for a few things here...
   1. Add parameters in order to refine the profiles query. For example, https://a.simplemdm.com/api/v1/custom_configuration_profiles?limit=100&attributes.name=my.amazing.profile&id=4814&attributes.bundle_identifier=com.simplemdm.is.cool Any attribute returned by the API should be queryable. Having wildcard/like, greater than, less than, etc. operators a bonus as well, but not required.
   2. Support the above for both custom and regular profiles.
   3. (Optional) Optimize API performance for profiles lookup in general. Maybe there's a better way to query the database?

   To get information about a custom profile through the API the only option is to list them all and then filter out the required data.

   https://api.simplemdm.com/#custom-configuration-profiles

   On a SimpleMDM instance with 100+ profiles, requesting a single page of profiles takes a very long time.

   curl https://a.simplemdm.com/api/v1/custom_configuration_profiles?limit=100 \
     -u ${API_KEY}:
   

   Running the above command takes around 20-30 seconds. However, if there were URL parameters available to map to profile attributes - ID, name, identifier, etc. - the API could return only the one or subset of profiles requested, in turn improving performance. It shouldn't take 30 seconds to return data about… more

   8 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

   Marking this as completed to give voters their votes back but we will continue working on optimizations. Please feel free to submit new suggestions if there is something more specific you'd like to see.

6. Add Tunnelblick 3.8.8c to the catalog

   Update the Tunnelblick app to the latest release (v3.8.8c)

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

7. Report on Rapid Security Response versions

   Apple is adding a new update type to macOS called Rapid Security Responses. These updates change the build version, but not the OS version reported. Instead, the new ProductVersionExtra (sw_vers) and SupplementalOSVersionExtra (MDM query) keys are returned to denote a specific supplemental version only when a RSR is installed. If no RSR is installed the key is not present. Similarly, when using MDM query (simulated with /usr/libexec/mdmclient QueryDeviceInformation) BuildVersion is unchanged, but SupplementalBuildVersion has the correct RSR build.

   $ sw_vers
   ProductName: macOS
   ProductVersion: 13.3
   ProductVersionExtra: (a)
   BuildVersion: 22E7752300f
   

   $ /usr/libexec/mdmclient QueryDeviceInformation
   {
     BuildVersion = 22E5230e;
     OSVersion = "13.3";
     SupplementalBuildVersion = 22E7752300f;
     SupplementalOSVersionExtra = "(a)";
   };
   

   https://support.apple.com/guide/deployment/rapid-security-responses-dep93ff7ea78/web

   Please update SimpleMDM to report on installed RSR version and build when present.

   Apple is adding a new update type to macOS called Rapid Security Responses. These updates change the build version, but not the OS version reported. Instead, the new ProductVersionExtra (sw_vers) and SupplementalOSVersionExtra (MDM query) keys are returned to denote a specific supplemental version only when a RSR is installed. If no RSR is installed the key is not present. Similarly, when using MDM query (simulated with /usr/libexec/mdmclient QueryDeviceInformation) BuildVersion is unchanged, but SupplementalBuildVersion has the correct RSR build.

   $ sw_vers
   ProductName: macOS
   ProductVersion: 13.3
   ProductVersionExtra: (a)
   BuildVersion: 22E7752300f
   

   $ /usr/libexec/mdmclient QueryDeviceInformation
   {
     BuildVersion = 22E5230e;
     OSVersion = "13.3";

   … more
   8 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

8. Update Tunnelblick to the latest release

   Update the Tunnelblick app to the latest release (v3.8.8b)

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

9. Support for Munki installer_type "nopkg"

   Munki has a pkginfo key for the installer type "nopkg". In a self-hosted Munki environment, this allows pkginfo files to be added to a repository that do not have an associated .pkg or .dmg file. You can read the Munki Project docs on the feature here: https://github.com/munki/munki/wiki/nopkgs

   This has a variety of uses, because it allows Munki to be used as a general script execution tool. An admin can use any of Munki's installation conditions (package receipt, installs array, installcheck_script, or OnDemand) to then run a pre or postinstall script embedded in the pkginfo.

   One example of how this is used is the venerable PrinterGenerator tool, which generates nopkg-style pkginfo files to enable printers to be installed and uninstalled via Managed Software Center.

   https://github.com/kevinmcox/PrinterGenerator

   Combined with Custom Attributes, nopkg support has the potential to greatly expand on the script execution capabilities offered to a SimpleMDM admin well beyond the current Scripts/Jobs feature.

   Munki has a pkginfo key for the installer type "nopkg". In a self-hosted Munki environment, this allows pkginfo files to be added to a repository that do not have an associated .pkg or .dmg file. You can read the Munki Project docs on the feature here: https://github.com/munki/munki/wiki/nopkgs

   This has a variety of uses, because it allows Munki to be used as a general script execution tool. An admin can use any of Munki's installation conditions (package receipt, installs array, installcheck_script, or OnDemand) to then run a pre or postinstall script embedded in the pkginfo.

   One example of how this is… more

   26 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   completed  ·  0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

10. Respect local time zone of iOS devices when applying a software update window

    Currently, the software update window is a singular entity, which means some units in Europe would be updating in the middle of the day for units in the USA. Implementing a method to either auto-detect local time of the units or specify a time zone in the profile would help solve this.

    1 vote

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

11. Update multiple custom attributes via API

    Currently only one custom attribute can be updated per API call either for a single device or device group.

    https://api.simplemdm.com/#set-value-for-device
    https://api.simplemdm.com/#set-value-for-group

    Say I want to set multiple custom attributes within a single workflow. I need to make as many API calls as there are attributes to update. In my recent work that's four calls which could've been one. This also simplifies developing with the API - don't have to iterate through values along with grokking associated return statuses.

    I'm requesting the functionality to update multiple custom attributes with one API call.

    PUT https://a.simplemdm.com/api/v1/devices/{DEVICE_ID}/custom_attribute_values

    Remove attribute name from endpoint URL and move to the request body. Multiple attributes can then be defined for devices or groups. Something like...

    {
    "username": "tobias.funke",
    "role": "therapist",
    "team": "natural good-time family band solution",
    "department": "musical theater"
    }

    Thank you for considering!

    Currently only one custom attribute can be updated per API call either for a single device or device group.

    https://api.simplemdm.com/#set-value-for-device
    https://api.simplemdm.com/#set-value-for-group

    Say I want to set multiple custom attributes within a single workflow. I need to make as many API calls as there are attributes to update. In my recent work that's four calls which could've been one. This also simplifies developing with the API - don't have to iterate through values along with grokking associated return statuses.

    I'm requesting the functionality to update multiple custom attributes with one API call.

    PUT https://a.simplemdm.com/api/v1/devices/{DEVICE_ID}/custom_attribute_values

    Remove attribute name from endpoint URL and… more

    19 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

12. API support for enabling/disabling Bluetooth of an iOS device

    I have an automated process to configure enrolled devices using SimpleMDM API, and recently there is a need to enable/disable Bluetooth depending on the device groups, which is currently not available for the API.
    I understand that I can use the restrictions profile to prevent supervised devices from changing Bluetooth settings, and I can enable/disable BT from the Devices page, but it would be great if SimpleMDM can add this ability to the API, so I can integrate it into my automated process.

    3 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    This is now supported: https://api.simplemdm.com/#enable-bluetooth

13. Add "Run Script" option to Actions menu

    A “Run Script” option in the Actions menu on both individual devices and any selected devices from a listing would be very helpful. Ideally, clicking it would pop you into the create job UI and pre-populate the “Run on” field with either that one device or any selected devices. This would speed up creating script jobs especially for multiple machines.

    2 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

14. Support RemovableSystemExtensions for System Extension policies

    In Monterey Apple added the RemovableSystemExtensions key to com.apple.system-extension-policy which is required to enable scripted uninstalls of system extensions.

    9 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    A "Removable" checkbox option has been added to the System Extensions profile UI to mark each extension as removable (or not). Default state is not removable.

15. Add Enrollment Date to API

    The enrollment date would be handy to pull via the API

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    Enrollment date has been added to the Device Details page and to the Devices API.

16. Allow password rotations via API

    Now that firmware and recovery lock passwords may be rotated via the web interface, it would be great to have that functionality available via the API as well.

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

17. eSIM management aka RefreshCellularPlans command

    Apple introduced iPhones completely without SIM tray in US recently (rest of the world will follow soon), command for managing eSIM is available for some time.

    Implementing command RefreshCellularPlans will help us to streamline our SIM deployment to our users and get rid of plastic waste.

    Please implement RefreshCellularPlans and make available via API.

    https://support.apple.com/en-gb/guide/deployment/dep36c581d6x/web
    https://developer.apple.com/documentation/devicemanagement/update_the_esim_cellular_plan

    6 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  1 comment  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

18. "UpdateOS version" GUI commands available for Macs via the API

    Add the maOS UpdateOS GUI Update commands to the API. Currently only iOS Software Updates are supported in the API

    4 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    This has been added: https://api.simplemdm.com/#update-os

19. Manage Non-Custom Profiles via API

    Currently the API has a customconfigurationprofiles endpoint (https://simplemdm.com/docs/api/#custom-configuration-profiles) which can be used to create, modify, and assign/unassign custom profiles. However, there is on way to manage other profile types via the API.

    Say I create a FileVault profile in the web app and then want to assign the profile only to specific Macs using the API. There's not a specific group or device I want to manually assign. Instead I only want to assign to specific endpoints programmatically using a config management tool like Chef or Ansible. Since the profile is not "custom" I am unable to.

    I am asking regular, non-custom profiles have these actions added to the API.

    • Assign to device
    • Unassign from device
    • Assign device group
    • Unassign from device group

    Just like is currently possible for custom profiles - https://simplemdm.com/docs/api/#assign-to-device I understand there's complexity with creating these profiles through the API and thus this request does not cover that scope. Thank you!

    Currently the API has a customconfigurationprofiles endpoint (https://simplemdm.com/docs/api/#custom-configuration-profiles) which can be used to create, modify, and assign/unassign custom profiles. However, there is on way to manage other profile types via the API.

    Say I create a FileVault profile in the web app and then want to assign the profile only to specific Macs using the API. There's not a specific group or device I want to manually assign. Instead I only want to assign to specific endpoints programmatically using a config management tool like Chef or Ansible. Since the profile is not "custom" I am unable… more

    8 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close
    completed  ·  AdminEric McCann (Admin, SimpleMDM) responded

    This has been added! Documentation is available here: https://api.simplemdm.com/#profiles

20. Profiles API - add upload/create custom profile method

    The profiles API endpoint doesn't have a method of uploading a custom configuration profile. This means it is not possible to create custom profiles and upload them to SimpleMDM, and then automatically create device group relationships and or assigning scopes to those custom profiles.

    An example where this would be useful is where profiles are managed within a git repo and pushed to SimpleMDM via automated workflows when these profiles are updated with new payloads.

    This upload/create method should also include settings for creating an assignment scope (for example, setting the OS type the profile can be applied to, the minimum and or maximum macOS version that the profile can be assigned to, and macOS architecture types the profile can be assigned to).

    This method should be able to take signed or unsigned profiles.

    The profiles API endpoint doesn't have a method of uploading a custom configuration profile. This means it is not possible to create custom profiles and upload them to SimpleMDM, and then automatically create device group relationships and or assigning scopes to those custom profiles.

    An example where this would be useful is where profiles are managed within a git repo and pushed to SimpleMDM via automated workflows when these profiles are updated with new payloads.

    This upload/create method should also include settings for creating an assignment scope (for example, setting the OS type the profile can be applied to, the… more

    0 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    completed  ·  2 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close