rterakedis Tracker

Re: iPad won't update past iPadOS 14.7.1, stuck on downloading 15.1 at 0% for days

rterakedis — Thu, 02 Dec 2021 01:58:10 GMT

I've seen this behavior if you set the RecommendationCadence to block the iOS15 upgrade visibility from the user. Basically, if RecommendationCadence blocks iOS15, MDM commands can't force the upgrade either.

Re: Enrolling into a DEP-defined Organization Group

rterakedis — Wed, 20 Oct 2021 06:02:11 GMT

When macOS enrolls to Workspace ONE UEM, numerous factors control the specific organization group where the device is placed. Before the Organization Group for the device is finalized, Workspace ONE checks multiple attributes for both the DEP profile and the User account enrolling to best determine where the device should go. The following attributes are considered during Organization Group selection:

User's "Enrollment Organization Group" -- Found in the User Account properties under the General tab
User's "Managed By" Organization Group -- The level at which this user is integrated into the console
The "Device Organization Group" associated with the Automated Device Enrollment (or "DEP") Profile
"User Group Mapping" setting in the console Groups & Settings > All Settings > Devices & Users > General > Enrollment > Grouping
"Batch Import" for device Organization Group Override following Automated Device Enrollment (or "DEP"). Note: This method is not typically advised.

For devices enrolling with Automated Device Enrollment (or "DEP") via Apple Business Manager:

ONLY if the Automated Device Enrollment (or "DEP") Profile specifies "Authentication = OFF" and staging is configured, the device will enroll to the Staging User's "Enrollment Organization Group" and NOT the Automated Device Enrollment (or "DEP") Profile's "Device Organization Group"
If "User Group Mapping" is configured, the device will enroll to the organization group based on the preconfigured AD user group and organization group mapping. In this scenario, the Automated Device Enrollment (or "DEP") Profile's "Device Organization Group" and the User's "Enrollment Organization Group" are not considered.
Without User Group Mapping, if the Automated Device Enrollment (or "DEP") Profile's "Device Organization Group" and the User's "Enrollment Organization Group" are in the same branch (parent/child), the device enrolls to the lower (child) Organization Group.
Without User Group Mapping, if the Automated Device Enrollment (or "DEP") Profile's "Device Organization Group" and the User's "Enrollment Organization Group" are siblings, then the device enrolls to the Automated Device Enrollment (or "DEP") Profile's "Device Organization Group".

For more information (and a flowchart), refer to VMware KB 83132 - Organization Group Assignment In Workspace ONE for Automated Device Enrollment (ADE) Devices.

Re: Getting Ready for Apple Fall 2021 Releases

rterakedis — Fri, 24 Sep 2021 13:59:29 GMT

@chengtmskcc - You are correct. Apple has only provided a restriction to disable DNS Private Relay, but nothing yet for toggling Mail Privacy Protection: https://support.apple.com/en-us/HT212791

Re: Getting Ready for Apple Fall 2021 Releases

rterakedis — Fri, 23 Jul 2021 14:37:48 GMT

Custom XML Samples can be found here:

Re: Workspace One - Intelligent Hub Prompt MacOS

rterakedis — Sat, 17 Jul 2021 04:40:02 GMT

@gurjotd89 -- that looks like the type of prompt you'd see if you had a Disk Encryption (FileVault) profile and then possibly had reached the "forced logout" after exhausting all the deferral periods.

Re: Applications Stuck in "Queued" or on "Installing"

rterakedis — Tue, 06 Jul 2021 15:51:13 GMT

This may be an issue that is fixed in UEM 2105 patch 1 (2105.01).

Re: Restore iOS native app?

rterakedis — Tue, 06 Jul 2021 15:47:55 GMT

@cm1190 - can you be more specific? Which app did the user delete?

Getting Ready for Apple Fall 2021 Releases

rterakedis — Tue, 06 Jul 2021 15:46:31 GMT

New Page Posted to WS1 Documentation

Getting Ready for Apple Fall 2021 Releases:
https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/GettingReadyForAppleReleases/GUID-GettingReadyForAppleReleases.html

Re: How do I create a restriction profile on iPad different from the other one's

rterakedis — Fri, 04 Jun 2021 02:34:16 GMT

Alvin,

The new restrictions profile won't replace the old restrictions profile. If you're looking to swap these payloads on the 2 devices, you'll need to make the following changes.

1. create a new smart group that contains ONLY the 2 devices you wish to include. You'll see the option to select users or specific devices in the new smart group creation screen.

2. edit the existing smart group that has deployed the old restriction payload to these 2 devices. Leave that smart group as is, except add the two devices as excluded devices and save the smart group.

3. Add the new smart group containing ONLY the 2 devices to the new restrictions profile.

Re: Full Disk Access now being granted via custom profile xml

rterakedis — Fri, 04 Jun 2021 02:26:03 GMT

@shaharnis - did you copy/paste this into a custom XML profile or did you use the "Privacy Preferences" payload in a macOS device profile?

If you did a custom XML profile, you may have pasted too much of the profile. You would only need to paste the following content:

<dict> <key>PayloadDescription</key> <string>My_App_Policy</string> <key>PayloadDisplayName</key> <string>My_App_Policy</string> <key>PayloadIdentifier</key> <string>1111111-1111-1111-1111-11111111</string> <key>PayloadOrganization</key> <string>myapp</string> <key>PayloadType</key> <string>com.apple.TCC.configuration-profile-policy</string> <key>PayloadUUID</key> <string>22222222-1111-1111-1111-11111111</string> <key>PayloadVersion</key> <integer>1</integer> <key>Services</key> <dict> <key>SystemPolicyAllFiles</key> <array> <dict> <key>Allowed</key> <true/> <key>CodeRequirement</key> <string>identifier "com.myapp.app" and anchor apple generic and certificate 1[field.x.x.xxx.xxxxxx.xxx.x.x.x] /* exists */ and certificate leaf[field.x.x.xxx.xxxxxx.xxx.x.x.xx] /* exists */ and certificate leaf[subject.OU] = NNNNNNNNNN</string> <key>Comment</key> <string></string> <key>Identifier</key> <string>com.myapp.app</string> <key>IdentifierType</key> <string>bundleID</string> </dict> </array> </dict> </dict>

Workspace ONE will handle wrapping the custom XML dictionaries into the array.

New KB: AppleCare GSX integration may fail on pre-2102 Workspace ONE UEM

rterakedis — Thu, 06 May 2021 05:36:41 GMT

New KB Posted: https://kb.vmware.com/s/article/83620?lang=en_US&queryTerm=83620

Symptoms:

Workspace ONE UEM's AppleCare GSX integration to populate a device's warranty information will stop working. This will mean new AppleCare GSX integrations will not be able to be set up and existing integrations will fail to sync new data.

This will only occur on Workspace ONE UEM consoles below 2102.

Resolution:

Upgrade your environment to Workspace ONE UEM 2102+ to continue using AppleCare GSX integration.

Apple has not announced when this deprecation will be taking place so consider upgrading to avoid disruption.

Re: macOS: macOSAppProxyProvider dialog with every Traffic Rule change

rterakedis — Thu, 22 Apr 2021 18:44:15 GMT

There is an open item internally to get this resolved. We've submitted Feedback to Apple, but we're also researching a workaround.

KB - Upgrade before 2021-03-29 to support APNS over HTTP/2

rterakedis — Wed, 10 Mar 2021 18:42:48 GMT

The following is a small excerpt from a KB published at https://kb.vmware.com/s/article/78976?lang=en_US&queryTerm=78976

Upgrade Workspace ONE UEM before March 29, 2021 to support Apple Push Notifications over HTTP/2 (78976)

What Is Changing?

In December 2015, Apple made available its Apple Push Notifications Service (APNs) API using HTTP/2 requests instead of the legacy binary protocol interface for APNs. Since that time, Workspace ONE has been working on migrating our APNs messaging integration responsible for all Apple MDM commands and app notifications to the new API. This has been a multi-year effort to ensure the success of our customers.

In the 2003 release, Workspace ONE UEM enabled the new HTTP/2 API for all MDM and app-related APNs messages by default for all upgraded environments. This means that all MDM and app commands for enrollment, profiles, apps, samples, push notifications, etc., will communicate using this new API.

Starting in April 2021, Apple will stop supporting the legacy APNs communication interface. Due to this, we encourage all Workspace ONE customers to upgrade their environments to an HTTP/2 supported version as soon as possible.

Review Apple's support article for more information: Updated APNs provider API deadline .

Apple Push Notification service server certificate update (On-Prem Only)

Per these changes, Apple has also announced HTTP/2 connections to the Apple Push Notification service must incorporate a new root certificate. This change goes into effect on March 29th, 2021. As such, Workspace ONE application Console and Device Services servers must include the new root certificate (AAACertificateServices 5/12/2020 ) in the Trust Store of each of your notification servers before March 29. An example script to accomplish this has been added to the "On-Premise" section of this article.

Review Apple’s support article for more information: Apple Push Notification service server certificate update

Note: For SaaS-hosted environments, this change will be handled by VMware internally, and no further action is required.

Solution:

The Solution and Related Information are available in the KB article at https://kb.vmware.com/s/article/78976?lang=en_US&queryTerm=78976

Re: Deploy Cisco Umbrella on Mac OS with Workspace One

rterakedis — Wed, 03 Mar 2021 17:51:43 GMT

This may help you diagnose the macOS app deployment issue: https://techzone.vmware.com/troubleshooting-macos-management-vmware-workspace-one-operational-tutorial#_1319037

Re: Adding iPad without DEP

rterakedis — Wed, 03 Mar 2021 16:13:13 GMT

@smejia1 - you can add iOS devices to your DEP account via a 30-day provisional process. The video is old, but I don't think the process has changed much since then: https://www.youtube.com/watch?v=Ujem_mS_tLc

New KB: Workspace ONE UEM dedicated SaaS release cadence updates (82728)

rterakedis — Thu, 25 Feb 2021 02:46:53 GMT

If you are a dedicated SaaS customer, please review the recently published KB for updates on a new release schedule for dedicated SaaS customers: https://kb.vmware.com/s/article/82728?lang=en_US

The new schedule will come into effect from the 2104 release which will be available to hosted (shared SaaS) customers only.

Re: Intelligent Hub is not installing after enrollment (macOS DEP)

rterakedis — Wed, 24 Feb 2021 16:08:38 GMT

Just making sure that you all are aware of this KB article also: https://kb.vmware.com/s/article/82642

There's an issue that arises when using the Require admin password to install or update apps key in a macOS Restrictions profile that prevents Bootstrap packages (including Hub), and VPP apps to be installed on Big Sur.

Re: Workspace one Bare Metal Provisioning

rterakedis — Mon, 22 Feb 2021 17:06:45 GMT

For iOS and macOS, the process is relatively straightforward:

Integrate with Apple Business Manager: https://www.youtube.com/watch?v=1jpEzd6ulsU
Ensure the device has synced to Workspace ONE and has a DEP profile assigned.
Power on the device and proceed through device enrollment during Setup Assistant.

New KB: Freestyle Orchestrator FAQs

rterakedis — Mon, 22 Feb 2021 16:57:31 GMT

If you're curious, a new KB article was posted with Frequently Asked Questions about Workspace ONE Freestyle Orchestrator (currently in Tech Preview): https://kb.vmware.com/s/article/81163

VMware Conference Dates Announced

rterakedis — Tue, 02 Feb 2021 15:37:13 GMT

In Case You Missed It: https://www.vmware.com/company/news/updates/2021/vmware-conference-dates.html

Today, we’re excited to announce the VMware conferences slated for this upcoming year. To ensure the safety and well-being of conference attendees, customers, partners and employees, we will continue hosting digital events that are just as informative, entertaining and engaging.

CloudLIVE: May 12-13, 2021
VMware Carbon Black Connect: June 3, 2021
SpringOne: September 1-2, 2021
VMworld: October 5-7, 2021
VMworld China: November 2021
VMworld Japan: November 2021