Auteur/autrice : Franck Sartori

UltimateMDM is the one you’ve chosen, or the one your Apple consultant has recommended. Our legacy or free instances of Meraki Systems Manager will no longer be available after February 7, 2024. If the product meets your needs, you can just order your licenses. If not, you must perform your MDM Switching as soon as possible.

Meraki Systems Manager does not make it easy to remove a locked Remote management profile. You’ll find below the instructions delivered in the Integration Guide of MOM release 5.16 for this specific case. Please note that updating the locked Remote management profile to the unlocked Remote management profile can take time, which is important to bear in mind if you have thousands of Macs in your fleet.

If the Remote management profile is not locked or if the Mac was enrolled using Device Enrollment, the interactions described below are not required and the migration is seamless. MOM will deal with the problem as it arises.

MOM can be distributed by any Apple partner as a new service. Licenses are not tied to a specific MDM. If the targeted MDM is not currently supported, we’ll need to coordinate.

Context of the edge case

• Migration planned from Meraki Systems Manager to UltimateMDM with AutoLauncher mode
• Device executing any version of macOS 11 and later
• Device enrolled in Meraki Systems Manager with a locked Remote Management profile
• Device assigned to an Automated Device Enrollment Profile :
  • linked to Meraki Systems Manager
  • Removable : No
• Logged in user is a standard account or an admin account

Known macOS limitations :

• the unenrollment must be performed from the same user session as the one used for the enrollment if the associated user account still exists on the device
• calls to AxM are rate limited to once every 23 hours with macOS 12.3.x, and to 10 times every 23 hours with macOS 13 and later ; these limits should be reached when fine-tuning the workflow, but not in production ; when the limitations are reached, wait for 24 hours or use a different test device.

This is the chronology of the required interactions between the IT Support and the End User.

• IT Support

• In Meraki SM :
  • Settings : Custom configuration profile that plans a migration from Meraki Systems Manager to UltimateMDM – Tag : mom
  • Apps : MOM Content and MOM Core packages – Tag : mom
  • Devices : Device selected > Tag > mom (Command > Sync apps can help to during testings)
• Webhook message received : « Workflow of type migration started »

• End User

• MOM started

	• End User User chooses to execute the migration now (postpone possible if planned)
	• End User Message displayed : « The Remote Management Profile of this device is locked. The workflow will be paused until the unenrollment is done. Please follow the displayed instructions. » Dialog displayed : « Please contact the IT Support. Once confirmed that an Automated Device Enrollment Profile that plans a removable Remote Management Profile is assigned to the device, click on Continue. » User contacts the IT Support • IT Support Webhook message received : « Device pending unenrollment from Meraki Systems Manager » In Meraki SM : Apple Automated Device Enrollment : Device assigned to an Automated Device Enrollment Profile : still linked to Meraki Systems Manager Removable : Yes Full sync IT Support confirms to the user that he can click on « Continue » • End User User clicks on « Continue »
	• End User Dialog displayed : « After clicking the Continue button, a device enrollment notification is going to be displayed in the upper right corner of the screen. Please click inside this notification and proceed to the update of the management configuration. » User clicks on « Continue »
	• End User macOS notification displayed : « Device Enrolment – Update company name configuration. » User clicks inside the notification
	• End User Profiles System Setting (macOS 13 or later) / Profiles System Preference (macOS 12 or earlier) is automatically opened macOS dialog displayed : « Update Device Enrolment? – Update management configuration for company name. » User clicks on « Update » Depending of how fast the update action is done, reminder dialog may be displayed : « The Remote Management Profile of this device is still locked. After clicking the Continue button, a device enrollment notification is going to be displayed in the upper right corner of the screen. Please click inside this notification and proceed to the update of the management configuration. » User clicks on « Continue » Once the device enrollment update is done, the Remote Management Profile becomes removable MOM deletes locally the unlocked Remote Management Profile Note : It has been observed that the Remote Management Profile may not become immediately removable ; in this situation, the update process may be triggered several times until the unenrollment can take place. • IT Support Webhook message received : « Device unenrolled from Meraki Systems Manager »
	• End User Message displayed : « The MDM enrollment provisioning of this device must be managed by the IT Support. Please follow the displayed instructions. » Dialog displayed : « Once IT support has confirmed that the device has been provisioned for enrollment with the new MDM, click on Continue. »
	• End User Message displayed if the « Continue » button is clicked before the next step is done : « The MDM enrollment provisioning is still associated to Meraki Systems Manager. Once IT support has confirmed that the device has been provisioned for enrollment with the new MDM, click on Continue. » • IT Support Webhook message received : « Device pending provisioning to enroll in UltimateMDM » In AxM : device assigned to UltimateMDM In UltimateMDM : device assigned to an Automated Device Enrollment Profile IT Support confirms to the user that he can click on « Continue » • End User User clicks on « Continue »
	• End User With macOS 14 or later, a Remote Management pane is displayed in full screen mode. With macOS 13 or earlier, a device enrollment notification is displayed in the upper right corner of the screen. The workflow is paused until the enrollment is done.
	• End User The device is enrolled in UltimateMDM and the workflow continues.

 

Avant de devenir un outil d’aide à la migration d’un Mac d’un MDM à un autre, MacOnboardingMate (MOM) était à l’origine un assistant conçu pour rationaliser l’intégration d’un Mac dans un MDM. Un flux de travail MOM est configuré via un fichier de configuration comportant plus d’une centaine de clés pour couvrir l’étendue des besoins des clients. Aucune connaissance en matière de script n’est requise, aucune perte de temps pour adapter un script existant à la dernière version de macOS ou du MDM.

Mais il manquait une pièce du puzzle : la localisation de l’interface pour afficher toutes les instructions dans la langue préférée de l’utilisateur connecté. Vous devinez à travers ce post que la pièce a été trouvée. Dès aujourd’hui, les clients MOM peuvent construire leurs propres traductions de l’ensemble des chaînes de caractères affichées en utilisant une méthode standard basée sur la construction d’un fichier PO à partir d’un modèle fourni. Au moment de l’exécution, MOM lit les langues définies dans la Préférence Système Langue et région de haut en bas et si un fichier PO est disponible pour cette langue, il est utilisé pour la durée du flux de travail.

Cette nouvelle capacité est très importante si l’on considère que MOM prétend que l’utilisateur final devrait être capable de migrer son propre Mac entre deux MDM comme il a pu l’intégrer au départ en utilisant l’inscription automatisée des appareils. De plus, la localisation peut être utilisée en conjonction avec une capacité de MOM+ qui propose de restreindre la disponibilité du processus de migration aux heures d’ouverture du support informatique local, en fonction du fuseau horaire de l’appareil.

La capacité de localisation est offerte aux propriétaires actuels et futurs de licences MOM et MOM+.

Pour en savoir plus sur MacOnboardingMate, veuillez visiter les pages Introduction, Support des solutions de gestion, Capacités et Offres et tarification du site Web Agnosys.

Before becoming a tool to help migrate a Mac from one MDM to another, MacOnboardingMate (MOM) was originally a wizard designed to streamline the onboarding of a Mac in an MDM. A MOM workflow is configured via a configuration file with more than one hundred keys to cover the scope of customer needs. No scripting knowledge required, no time lost to adapt an existing script for the latest version of macOS or the MDM.

But one piece of the puzzle was missing : the localization of the interface to display all instructions in the logged in user’s preferred language. You guess from this post that the piece has been found. As of today, MOM customers can build their own translations of the displayed set of strings using a standard method based on building a PO file from a provided template. At runtime, MOM reads the languages defined in the Language & Region System Preference from top to bottom and if a PO file is available for that language, it is used for the duration of the workflow.

This new capability is very important considering that MOM claims that the end user should be able to migrate his own Mac between two MDM as he was able to first onboard it using Automated Device Enrollment. Furthermore, localization can be used in conjunction with a MOM+ capability that offers to restrict the availability of the migration process to the local IT Support hours, based on the time zone of the device.

Localization capability is offered to current and future MOM and MOM+ license owners.

To learn more about MacOnboardingMate, please visit the Introduction, Management Solutions Support, Capabilities and Offers and pricing pages of the Agnosys website.