Mdm on MicroMDM

Tinkering with Declarative Management

Thu, 10 Jun 2021 12:00:00 -0700

Amongst the many announcements at Apple’s WWDC21 was declarative management. I would highly recommend watching the WWDC session “Meet declarative device management” to get a a general idea of what it is and how it works.

I wanted to tinker with the new capabilities and created some initial support for it and wanted to share how you can try this out, too. My hope is that, if you’re inclined, you can get these tools and start playing with it.

Note this is a mostly technical how-to to get up and running and testing Declarative Management with NanoMDM. I hope to write more about the conceptual/paragidm changes DM brings as well more broad thinking in how to implement this protocol in a server. See the bottom for links to further discussion. Also note this is all really early stuff, based on beta software and documentation priovided by Apple and of course is all subject to major breaking changes.

Introducing NanoMDM

Sun, 30 May 2021 11:45:00 -0700

I’d like to introduce NanoMDM. From the project’s README:

NanoMDM is a minimalist Apple MDM server heavily inspired by MicroMDM.

Which is a rather minimalist description itself. To expand a bit: NanoMDM is a fully functional (yet scope-limited) “core” Apple MDM protocol server written in Golang. Another small open source MDM server, you ask? Yes! Doesn’t that also describe MicroMDM, too? Well, yes it does. So what gives? Why a new project?

I hope to explain how this project came about, why I think it has a place here, and a little about how it differs from MicroMDM. I think this will give some insight into the goals and design of NanoMDM along the way as well. Finally, I hope to recruit your help with this new open source project.

About Software Updates in Big Sur

Thu, 17 Dec 2020 00:00:00 +0500

If you work with Apple in some capacity, you know that they’re not very likely to admit mistakes. I’m not aware of Apple publishing postmortems after outages or providing details about known issues. So it’s up to the developer and admin communities at large to help each other learn about outages and potential causes. With the release of macOS 11.1 this week I’ve been debugging a new issue with the Mac software update process, one which will affect most enterprise users.

WWDC20: What's new in managing Apple devices

Tue, 30 Jun 2020 00:00:00 +0500

Here are some of my opinions about Mobile Device Management (MDM) related changes announced last week. SimpleMDM did a great job of summarizing the announcements, so I won’t repeat the same list here. Instead, I’ll focus on a few things which are interesting to me. Before I get into that, I have to mention this isn’t a well-balanced editorial. It’s in my nature to skip over accomplishments and focus on things that still need attention.

Five years behind, Five years ahead

Mon, 22 Jun 2020 00:00:00 +0500

Apple MDM is over 10 years old today. Initially, MDM was a protocol to manage iPhones, but later expanded to the growing range of Apple devices. MicroMDM started about five years ago, when a few of us in the MacAdmin community became curious about what the MDM could do. We were intrigued by the “zero touch” deployment, which was brand new at the time. Lots of things were different. Almost nobody was using MDM and Apple Business Manager for the Mac.

Updating to Mojave?

Tue, 16 Oct 2018 13:04:37 +0200

Earlier this year Apple updated the MDM Protocol Reference document to add a previously undocumented key to the AvailableOSUpdates command. Key Content IsMajorOSUpdate Set to true if this is a major OS update (e.g. 10.13.x to 10.14). macOS only. This got a few of us in the #mdmdev channel on MacAdmins Slack talking. We’ve tried scheduling OS Updates in the past, and MicroMDM has had support for all these commands for years.

Surviving the Kextpocalyse, Round 0

Mon, 13 Nov 2017 13:04:37 +0200

There’s an understandable sense of urgency in the MacAdmin community around MDM and Kernel extensions these days. If you’ve been paying attention you know that in order to be able to reliably deploy kernel extensions in an enterprise environment, DEP and MDM are becoming a requirement. Apple is likely not going to stop there, and both MDM and DEP will become a requirement for Mac management over the next year or two.

How to troubleshoot your DEP/MDM Enrollments

Mon, 06 Nov 2017 13:04:37 +0200

The Device Enrollment Program(DEP) allows enterprises to configure their Macs to auto-enroll into a Mobile Device Management(MDM) server of their choice. DEP makes it possible to ensure that a new Mac becomes managed during the unboxing process, reducing the need for Netboot and complex imaging workflows. Of course, as any workflow that depends on the network, this enrollment process can fail, and it’s important for an administrator to know how to troubleshoot it.

Understanding MDM Certificates

Thu, 11 May 2017 13:04:37 +0200

Apple Mobile Device Management (MDM) requires the use of various digital certificates for its operation. But exactly which certificates and the various ways in which they are generated, acquired, signed, used, exported, imported, and managed within an MDM product may not be so clear. Generally speaking a commercial MDM product or service manages most of the complexity related to these certificates for you but in the case of an open source MDM much of that responsibility will land on you. In this post I hope to bring a better understanding of these certificates with the aim that you’ll be managing at least a few of them yourself.

The business side of MDM - Do you know your DUNS Number?

Sat, 06 May 2017 13:04:37 +0200

Getting started with MDM is hard enough, but the toughest part is not technical, it’s getting approval to create all the accounts with Apple in order to begin. I recently went through the whole process for my company and thought it would be useful to others if I blogged about it. Below is infromation about what accounts you might need, and how you might go about acquiring them.

What's next for MicroMDM

Mon, 24 Aug 2015 13:04:37 +0200

I first wrote about experimenting with MDM at the end of 2015. Since then, Apple has made the MDM specification public, many administrators are looking to swap imaging devices for a DEP workflow, and even commercial vendors are taking notice of the needs of our community. One thing has become increasingly clear — MDM will play a critical role in the future of managing Apple devices in the enterprise. And with the renewed interest in MDM from the macadmin community, it’s only fair to be asked — What is the future of the MicroMDM project?