449 results found

1. Report on installed certificates

   I'd like to see SimpleMDM report on installed certificates for all device types. A common feature in other MDMs, CertificateListCommand (https://developer.apple.com/documentation/devicemanagement/certificatelistcommand) has been around since iOS 4 and macOS 10.7 (!).

   While we have other tools to report on certificates (like osquery), it's useful to have MDM as a data source as well since oftentimes installed certificates originate via profiles. Knowing certificate health within the same product has benefits, and could allow for more advanced certificate management directly in SimpleMDM.

   Important fields...
   - Certificate name
   - CA/issued by
   - Expiration
   - Current validity status
   - If possible, whether the certificate is "managed" (installed) by a MDM profile.

   And, of course, please make sure certificate data is available via the API, preferably using the existing devices endpoint.

   I'd like to see SimpleMDM report on installed certificates for all device types. A common feature in other MDMs, CertificateListCommand (https://developer.apple.com/documentation/devicemanagement/certificatelistcommand) has been around since iOS 4 and macOS 10.7 (!).

   While we have other tools to report on certificates (like osquery), it's useful to have MDM as a data source as well since oftentimes installed certificates originate via profiles. Knowing certificate health within the same product has benefits, and could allow for more advanced certificate management directly in SimpleMDM.

   Important fields...
   - Certificate name
   - CA/issued by
   - Expiration
   - Current validity status
   - If possible, whether… more

   20 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   1 comment  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

2. Add Apple Silicon Dialpad App

   https://www.dialpad.com/download/

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

3. Reject enrollments for unsupported macOS versions when using SAML

   I am requesting SimpleMDM add guards for ADE where a macOS device is under 10.15. Copying directly from enrollment authentication config...

   "OSes prior to macOS 10.15 and iOS 13 using Automated Enrollment and all devices enrolled with Apple Configurator do not support SAML authentication and will not be authenticated. Optionally enroll them in a less secure initial device group."

   A helpful setting for sure since it means a device can be dropped into a group with no access to organization profiles, packages, or secrets. However, the device is still allowed to enroll and takes up a license. If that Mac were lost or stolen for example, there's now one less way to stop it from being used.

   My suggestion is to implement one of these options...
   - Fall back to legacy basic (LDAP) auth for pre-10.15 devices when SAML is configured. In this way the old style dialog will appear with no way to ever successfully to auth. A potential attacker or other security risk now has one less way to enroll or use the device. This is configurable in Jamf Pro.
   - Reject the enrollment altogether, denying the opportunity to enroll.

   I am requesting SimpleMDM add guards for ADE where a macOS device is under 10.15. Copying directly from enrollment authentication config...

   "OSes prior to macOS 10.15 and iOS 13 using Automated Enrollment and all devices enrolled with Apple Configurator do not support SAML authentication and will not be authenticated. Optionally enroll them in a less secure initial device group."

   A helpful setting for sure since it means a device can be dropped into a group with no access to organization profiles, packages, or secrets. However, the device is still allowed to enroll and takes up a license. If that Mac… more

   1 vote

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

4. Add username field to `device.enrolled` webhook event

   The goal is to have a username field in the device.enrolled webhook event.

   This field would be populated using the the custom attribute defined in the "Username custom attribute" setting in the Automated Enrollment Authentication section.

   In our use case, a user will be prompted to auth using Okta during Automated Device Enrollment (ADE). The username that is returned by Okta would be part of the webhook event payload. We use the username and device serial number to help with automating other internal processes to help determine which user is assigned to which device.

   This could be covered by https://suggestions.simplemdm.com/forums/204404-suggestions/suggestions/46831099-control-webhook-data, but I wanted to call this out more specifically.

   The goal is to have a username field in the device.enrolled webhook event.

   This field would be populated using the the custom attribute defined in the "Username custom attribute" setting in the Automated Enrollment Authentication section.

   In our use case, a user will be prompted to auth using Okta during Automated Device Enrollment (ADE). The username that is returned by Okta would be part of the webhook event payload. We use the username and device serial number to help with automating other internal processes to help determine which user is assigned to which device.

   This could be covered by https://suggestions.simplemdm.com/forums/204404-suggestions/suggestions/46831099-control-webhook-data… more

   6 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

5. Allow SimpleMDM to release devices in ABM/ASM

   Allow SimpleMDM to release devices without having to sign in to Apple Business Manager. This feature is enabled by default when you add an MDM server in ABM/ASM. You can remove this feature by deselecting the option for any new or existing MDM servers you created.

   But SimpleMDM has not implemented this feature yet. Would be nice to automate the decommissioning process of the devices.

   https://support.apple.com/en-sg/guide/apple-business-manager/axmec4d28461/web

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

6. Support choosing which webhook events to subscribe to per endpoint

   https://api.simplemdm.com/#webhooks

   The current webhook events are as follows...

   device.changed_group
   device.enrolled
   device.unenrolled
   device.lock.enabled
   abm.device.added

   Whenever any of these events occurs, the webhook endpoint is pinged. However, processing these can get particularly noisy, especially in large environments and (hopefully) as SimpleMDM adds more supported events.

   I am asking to add support for selecting which events are subscribed to per webhook endpoint. This way only events needed for a particular workflow are sent and the webhook receiver requires less work to filter out unneeded data.

   The UI could look like other SimpleMDM settings with checkboxes for each event, where by default all are selected.

   https://api.simplemdm.com/#webhooks

   The current webhook events are as follows...

   device.changed_group
   device.enrolled
   device.unenrolled
   device.lock.enabled
   abm.device.added

   Whenever any of these events occurs, the webhook endpoint is pinged. However, processing these can get particularly noisy, especially in large environments and (hopefully) as SimpleMDM adds more supported events.

   I am asking to add support for selecting which events are subscribed to per webhook endpoint. This way only events needed for a particular workflow are sent and the webhook receiver requires less work to filter out unneeded data.

   The UI could look like other SimpleMDM settings with checkboxes for each event, where by default all are… more

   •  

   18 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

7. Allow entry of Custom Integers for Software Update Delay Fields in Restrictions Payload

   Currently we only have the option to choose from predefined options in the dropdown list as shown below.
   Please add the ability to add a custom ineger up to the maximum allowed by Apple.

   •  

   1 vote

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   0 comments  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

8. Add reMarkable to shared apps

   DMG file available publicly here:
   https://downloads.remarkable.com/

   3 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   1 comment  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

9. Support "Non-Removable" flag on deployed iOS Store Apps

   As noted here on the SimpleMDM blog, an option was added to iOS starting in 14.x where individual apps can be marked as "non-removable" by the administrator when being deployed.

   https://simplemdm.com/blog/mdm-ios-14-macos-11-big-sur/
   https://it-training.apple.com/tutorials/deployment/dm195

   "To prevent a user from uninstalling a managed app, mark the app as nonremovable when you assign the managed app to a user or device. Depending on your MDM solution, you might need to deselect a Removable attribute or set a nonremovable attribute. With your MDM solution, you may also be able to set this attribute on apps that are already installed on a device."

   I feel it would be a valuable feature to implement this flag so that users can still have the ability to add and remove their own apps on their managed device (which would otherwise not be possible via a restriction profile block), but are prevented from removing apps deployed by policy (Such as security apps, or authentication apps required by the company)

   As noted here on the SimpleMDM blog, an option was added to iOS starting in 14.x where individual apps can be marked as "non-removable" by the administrator when being deployed.

   https://simplemdm.com/blog/mdm-ios-14-macos-11-big-sur/
   https://it-training.apple.com/tutorials/deployment/dm195

   "To prevent a user from uninstalling a managed app, mark the app as nonremovable when you assign the managed app to a user or device. Depending on your MDM solution, you might need to deselect a Removable attribute or set a nonremovable attribute. With your MDM solution, you may also be able to set this attribute on apps that are already installed on a device."

   I feel it… more

   16 votes

   Vote Vote Vote

   Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   1 vote 2 votes 3 votes Remove votes

   You have left! (?) (thinking…)
   2 comments  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

10. Add support for ZIP and XIP as well as DMG

    A fair number of apps are distributed as ZIPs (and one prominent app uses XIPs) instead of DMGs. It would be convenient to be able to upload these as is, instead of having to locally convert them to DMGs first $(unzip App.zip && hdiutil create -format ULMO -o App.dmg -srcfolder App.app)

    3 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

11. Scope profiles to build version

    With the advent of RSRs, the OS version is no longer a definitive identifier of what OS rev a system is on. The OS build numbers would be a more consistent way to identify target OSes.

    Historically, macOS minor builds have followed an pattern of
    [Major OS number][A...Z minor build][Patch Number] moniker.

    Now with RSRs, the build numbers are a bit more complicated but the values still go up and each build number is larger than the last based on the pattern above.

    13.3.1 22E261
    13.3.1 RSR 22E772610a
    13.4.0 22F66
    13.4.1 22F82
    13.4.1 RSR 22F770820b

    I propose that Build numbers be made an option for profile scoping to allow specific versions to be targeted.

    Note, there could be issues when new hardware is introduced and the build numbers are forked where the new hardware build number has a bigger patch number than the official public release. Hence having build numbers be an option, not the only way to supply a scope.

    With the advent of RSRs, the OS version is no longer a definitive identifier of what OS rev a system is on. The OS build numbers would be a more consistent way to identify target OSes.

    Historically, macOS minor builds have followed an pattern of
    [Major OS number][A...Z minor build][Patch Number] moniker.

    Now with RSRs, the build numbers are a bit more complicated but the values still go up and each build number is larger than the last based on the pattern above.

    13.3.1 22E261
    13.3.1 RSR 22E772610a
    13.4.0 22F66
    13.4.1 22F82
    13.4.1 RSR 22F770820b

    I propose that Build numbers… more

    5 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

12. Add AWS VPN Client to the list of managed applications

    Adding a picture of ducks discussing the idea to improve chances of upvoting.

    Thanks!

    •  

    1 vote

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

13. Customize Self Service Kiosk

    I want to be able to change text and icon for the kiosk

    https://kb.filewave.com/attachments/16?open=true

    Doesn't have to be this complete but simple changes so it says <company name> software kiosk

    •  

    6 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

14. Include the Enrollment group in Device Details section

    It would be helpful to include the Enrollment group in Device Details section

    1 vote

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

15. New notification options

    I'd love for a lot more notification options. Given SimpleMDM's position on the device already, it hopefully shouldn't be too heavy of a lift.

    • New User added
    • User priv changes
    • OS update skipped
    • Device visible (after being offline)

    This is off the top of my head, but I'm sure I could come up with quite a few more given some time.

    3 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Edit…  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

16. Include "less than macOS version" and "greater than macOS version" for profile scoping

    It would be very helpful to be able to define "less than" and "greater than" macOS version when scoping profiles. For example, I would prefer to specify "less than macOS 12" for a profile to apply to all versions of macOS 11. As it is, I have to update the maximum OS version every time a new dot release comes out.

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

17. Disable ActivationLock via API

    It should be possible to disable the ActivationLock via API call, this is specificly helpfull if you want to decomission a device.

    8 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

18. Improve Device Search with More Attributes

    Currently device search only supports device name, serial number, IMEI, MAC, and phone number.

    Scenarios where search doesn't return the results I need:
    - When I need to search by a custom attribute. For example, say I want to return all devices where the username attribute is "nathaniel.strauss". I am unable to since those attributes are not exposed in search. This is a common ask - "How many devices does x have?" The same holds true for any custom attribute set from SAML assertion - team, department, etc.
    - When the device name (SimpleMDM defined) doesn't match the Device Name (MDM reported). For example, the listed name is "MacBook Air" but the actual on device name is "Arts-Building-$SerialNumber" SimpleMDM is unable to return the device by searching "Arts".
    - Enrollment status. Though "Status" is a column in list view it is not searchable.
    - Last seen. Slightly more complex. SimpleMDM is unable to return devices not seen (or seen) within a specific time period.

    Given the values are already present in the database, I'm asking search either be configurable to allow any device attribute. If it's easier or more reasonable to ask for a smaller solution I would want these attributes prioritized to be searchable. Thank you!

    • All custom attributes
    • Device name
    • Processor arch (Apple silicon v Intel)
    • OS version
    • Enrollment status
    • FDE status
    • SIP status
    • Secure boot level
    • Secure boot external level

    Currently device search only supports device name, serial number, IMEI, MAC, and phone number.

    Scenarios where search doesn't return the results I need:
    - When I need to search by a custom attribute. For example, say I want to return all devices where the username attribute is "nathaniel.strauss". I am unable to since those attributes are not exposed in search. This is a common ask - "How many devices does x have?" The same holds true for any custom attribute set from SAML assertion - team, department, etc.
    - When the device name (SimpleMDM defined) doesn't match the Device Name… more

    64 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    4 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

19. Control Webhook data

    Webhooks are very limited in what they provide without triggering another API call to pull in more information. The ability to control the payload within the webhook endpoint creation screen would be a huge help in interfacing with other programs. The ability to add static data to the payload (like we can already do to the header) or be able to add dynamic data through attribute support.

    7 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

20. Add support for additional com.apple.MCX keys in FileVault profile type

    The current FileVault profile builder in the admin GUI only has options included in com.apple.MCX.FileVault2, the escrow payload, and dontAllowFDEDisable. Please add support for dontAllowFDEEnable and DestroyFVKeyOnStandby from com.apple.MCX as well.

    Apple docs here: https://developer.apple.com/documentation/devicemanagement/fdefilevaultoptions

    6 votes

    Vote Vote Vote

    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    1 vote 2 votes 3 votes Remove votes

    You have left! (?) (thinking…)
    0 comments  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close