Post

Replies

Boosts

Views

Activity

Notes from Custom App Distribution and Device Management lab (Friday, June 11th)
Question: Will be able to manually add macOS Monterey devices into Automated Device Enrollment similarly to how we can manually add iOS devices using Apple Configurator? Answer: Use Apple Configurator for iPhone for this. For more information, please see the following link for the Manage Devices with Apple Configurator" session video : https://developer.apple.com/wwdc21/10297 Question: Will Apple provide a way to configure Automated Device Enrollment so that macOS Monterey Macs cannot skip the device enrollment process? Answer: Not at this time. please submit feedback if you want this feature. Question: Will Apple provide a method of being able to re-trigger the enrollment check at the macOS Monterey Setup Assistant if the remote management screen does not appear? Reasons it may not appear may include network issues, device was incorrectly assigned in Apple Business Manager or Apple School Manager, MDM issues etc. Answer: This should be do-able. Please submit feedback if you want this feature. This also sounds like a good idea to iOS, please submit feedback if you want to see this feature on iOS as well. It was suggested that the feature to trigger the re-checkin should only be available on the Setup Assistant screen which appears in place of the Remote Setup screen. The reason is that, if you get further into Setup Assistant, you may set up your account or make choices for your Mac's settings which conflict with the settings your MDM server has for Automated Device Enrollment. Question: What are Apple's plans, if any, to support using Apple's own two-factor authentication system (not the two step one which uses SMS) to log into a Mac running macOS? Answer: Apple does not discuss future plans. Please submit feedback if you want this feature. Apple School Manager does include the ability to generate verification codes. If you want to have Apple Business Manager support a similar feature for ABM's Managed Apple IDs, please submit feedback for this feature. Question: What are Apple’s plans, if any, to support Azure AD workplace join as a replacement for on-premise Active Directory binding? Answer: Apple does not comment on future plans. Please submit feedback if you want this feature.
0
0
883
Jun ’21
Notes from Security lab (Wednesday, June 9th 2021)
Question: As of macOS Big Sur, it is not required for an installer package to be signed or notarized in order for it to be installed via Installer.app or the installer command line tool. Is this still the case on macOS Monterey? If it is not, what requirements have changed? Answer: Restrictions are the same as on macOS Big Sur for installer packages with regards to notarization. Question: Is there any additional guidance from Apple on the installation and use of multiple solutions using System Extensions and/or Network Extensions when it comes to co-habitation? For example, is it supported by Apple to have two "Network Filters" (each managed by a separate application) installed and active? Answer: Having multiple network system extensions installed is supported by Apple. Multiple content filters are supported on iOS and macOS: iOS: 2 filters maximum macOS: 8 filters maximum Question: As of macOS Big Sur, it is not required for an application to be signed or notarized in order for it to be installed or run on an installation of macOS with Apple's full security settings enabled. Is this still the case on macOS Monterey? If it is not, what requirements have changed? Answer: Restrictions on macOS Monterey are the same as on macOS Big Sur for applications with regards to signing and notarization. Question: What are Apple’s plans, if any, to support Azure AD workplace join as a replacement for on-premise Active Directory binding? Answer: We see you're also signed up for the Friday Security lab, we'll see if we can get this question answered there. Question: What are Apple's plans, if any, to support using Apple's own two-factor authentication system (not the two step one which uses SMS) to log into a Mac running macOS Answer: We see you're also signed up for the Friday Security lab, we'll see if we can get this question answered there.
1
0
797
Jun ’21
Notes from Custom app distribution and device management lab (Wednesday, June 9th 2021)
Question: Will Apple be eliminating the use of kernel extensions on macOS Monterey? Answer: No. In general, restrictions are the same as on Big Sur but as Apple adds new APIs for system extensions, new restrictions may be added for kernel extensions. If kexts are whitelisted by MDM, behavior is the same as on Big Sur. Question: Does Apple have any plans to support “managed” migration assistant so supervised devices can easily transfer user data from old to new macs without compromising MDM enrollment. Managed with a profile to ensure only specific data can be migrated would be very helpful. Answer: Not at this time, please submit feedback if you want this feature. Question: Is there any additional guidance from Apple on the installation and use of multiple solutions using System Extensions and/or Network Extensions when it comes to co-habitation? For example, is it supported by Apple to have two "Network Filters" (each managed by a separate application) installed and active? Answer: Having two network filters installed and active is supported by Apple. Consult with your vendor or vendors for best practices. Question: Can admins enforce software update deferrals for X number of days after they’re released by Apple, rather than X number of days after a given device first sees the software updates? Answer: Software deferral is based on the date metadata associated with the update and that's in macOS today. Question: Can admins force Mac users to install software updates on macOS Monterey without interrupting users with a surprise reboot? Desired state is to gracefully prompting users to install mandatory updates, but also have those updates have an admin-chosen deadline where the updates get installed automatically without further deferral. Answer: There are a number of changes in macOS Monterey which address these concerns. Please see the "Manage software updates in your organization" session video. One change is that you can schedule using the marketing version number instead of a product key. For example, you can now specify "macOS 12.1" instead of a specific product key. Question: Are printer drivers still supported in macOS Monterey? Answer: Yes. Question: Since Apple Silicon Macs technically can support NetBoot, can NetBoot be restored as a device provisioning tool? Answer: NetBoot is not supported as a mechanism for macOS provisioning on Apple Silicon Macs. Question: What are Apple’s plans, if any, to support Azure AD workplace join as a replacement for on-premise Active Directory binding? Answer: Apple can't comment on future plans. Please submit feedback if you want this feature. Apple does offer the Kerberos extension for connecting to on-premise Active Directory.
0
0
790
Jun ’21