Recent content on MicroMDM
The MicroMDM project in its current form—what I refer to as MicroMDM “v1”—has effectively been in maintenance mode for years now. Development effort has been almost entirely focused on NanoMDM and the “Nano”-suite of projects . This post serves to merely confirm and formalize the current situation: MicroMDM “v1” is indeed in maintenance mode.
SCEP has been a cornerstone of Apple MDM. While you’ve always technically been able to avoid SCEP in MDM, by directly embedding a device identity into an enrollment profile, SCEP has been the de facto (and most secure) way to get device identities for MDM authentication onto devices since the beginning of Apple MDM.
Amongst the many announcements at Apple’s WWDC21 was declarative management . I would highly recommend watching the WWDC session “Meet declarative device management” to get a a general idea of what it is and how it works. I wanted to tinker with the new capabilities and created some initial support for it and wanted to share how you can try this out, too. My hope is that, if…
I’d like to introduce NanoMDM . From the project’s README : NanoMDM is a minimalist Apple MDM server heavily inspired by MicroMDM. Which is a rather minimalist description itself. To expand a bit: NanoMDM is a fully functional (yet scope-limited) “core” Apple MDM protocol server written in Golang. Another small open source MDM server, you ask? Yes! Doesn’t that also describe…
If you work with Apple in some capacity, you know that they’re not very likely to admit mistakes. I’m not aware of Apple publishing postmortems after outages or providing details about known issues. So it’s up to the developer and admin communities at large to help each other learn about outages and potential causes. With the release of macOS 11.1 this week I’ve been…
Here are some of my opinions about Mobile Device Management (MDM) related changes announced last week. SimpleMDM did a great job of summarizing the announcements, so I won’t repeat the same list here. Instead, I’ll focus on a few things which are interesting to me. Before I get into that, I have to mention this isn’t a well-balanced editorial. It’s in my nature to skip over…
After announcing the kickoff of a big rewrite last week, I wasn’t sure how to actually get things going. There’s a lot I want to get done, but I also want to do it in a way that tells a story. So it’s important not to rush too fast ahead. Then Saturday, fueled by a fresh pot of good coffee and WWDC excitement, things really took off. Now I have a bunch to share.
Apple MDM is over 10 years old today. Initially, MDM was a protocol to manage iPhones, but later expanded to the growing range of Apple devices. MicroMDM started about five years ago, when a few of us in the MacAdmin community became curious about what the MDM could do. We were intrigued by the “zero touch” deployment, which was brand new at the time. Lots of things were different.…
Earlier this year Apple updated the MDM Protocol Reference document to add a previously undocumented key to the AvailableOSUpdates command. Key Content IsMajorOSUpdate Set to true if this is a major OS update (e.g. 10.13.x to 10.14). macOS only. This got a few of us in the #mdmdev channel on MacAdmins Slack talking. We’ve tried scheduling OS Updates in the past, and MicroMDM has had support…
There’s an understandable sense of urgency in the MacAdmin community around MDM and Kernel extensions these days. If you’ve been paying attention you know that in order to be able to reliably deploy kernel extensions in an enterprise environment, DEP and MDM are becoming a requirement. Apple is likely not going to stop there, and both MDM and DEP will become a requirement for Mac…
The Device Enrollment Program(DEP) allows enterprises to configure their Macs to auto-enroll into a Mobile Device Management(MDM) server of their choice. DEP makes it possible to ensure that a new Mac becomes managed during the unboxing process, reducing the need for Netboot and complex imaging workflows. Of course, as any workflow that depends on the network, this enrollment process can fail, and…
Apple Mobile Device Management (MDM) requires the use of various digital certificates for its operation. But exactly which certificates and the various ways in which they are generated, acquired, signed, used, exported, imported, and managed within an MDM product may not be so clear. Generally speaking a commercial MDM product or service manages most of the complexity related to these certificates…
Getting started with MDM is hard enough, but the toughest part is not technical, it’s getting approval to create all the accounts with Apple in order to begin. I recently went through the whole process for my company and thought it would be useful to others if I blogged about it. Below is infromation about what accounts you might need, and how you might go about acquiring them.
I first wrote about experimenting with MDM at the end of 2015. Since then, Apple has made the MDM specification public , many administrators are looking to swap imaging devices for a DEP workflow, and even commercial vendors are taking notice of the needs of our community. One thing has become increasingly clear — MDM will play a critical role in the future of managing Apple devices in the…