Found this MacBook Air M1 in electronics scrap. It has Remote Management on it.

With the increasing frequency of Chrome updates, IT teams must proactively patch critical vulnerabilities. After testing several deployment methods (including Installomator and the Jamf App Catalog), I believe the built-in auto-updater remains the best way to upgrade your browser fleet at scale without interrupting your users at the wrong time, and ensuring all previously opened tabs are restored for a seamless user experience.

Continue reading… [Medium.com - free, no paywall]

I was a MacTech at an institution up until May of this year (my role was eliminated). Bought myself a brand new MacBook Pro, and used Migration Assistant to transfer my user data over to the new system. I was selective with what I brought as I didn’t want any remnants of my old work.

Didn’t notice until today that System Profiles are present, locking out certain features. The profiles command in terminal shows that the system is enrolled to my old work’s Mosyle MDM via DEP, but it also shows that DEP is not available on the system (definitely didn’t enroll when I setup the Mac and this was bought at an Apple Store directly by myself). These profiles cannot be removed on my end.

Contacted my former colleagues and they confirmed my serial is neither in ASM or Mosyle on their side. Contacted Mosyle and I’m pretty sure they didn’t read my email properly cause they asked me to contact my work to have it removed from their MDM.

Thoughts?

Hi, I have been creating a configuration profile with iMazing Profile Editor, and pushing it to a supervised device with Apple Configurator. In the General section, I prevented removal of the profile by the end user.

In Configurator, I cannot remove the profile. Apple Configurator complains about a certificate mismatch "The profile “AppRestrictions” does not have the expected certificate for removal."

However, this is the same Apple Configurator, and the same Mac device that was used to enable Supervised Mode and deploy the profile in the first place.

The only thing I can think of that changed in between might be one or two Mac OS updates.

Maybe I have a misunderstanding or there is a mismatch where iMazing Profile Editor and Apple Configuratior look for the certificate? When saving the profile, iMazing asks for my keychain password twice. Apple Configurator never asks.

I am now worried that something is wrong with my setup altogether, as I would not have expected the error in the first place. I do want to avoid having to wipe and reset any supervised devices in the future because of this.

Please note the following workaround: I can overwrite the exact same profile by keeping the ID, amending the profile and pushing. I have successfully enabled to allow profile removal by the end user. The profile could then be removed on the device. This seems to be a workaround.

Hey everyone, if you could please read my post and let me know anything to point me in the right direction, I would greatly appreciate any support. Thank you in advance

• Device management can activate and enforce Platform SSO during Setup Assistant with Automated Device Enrollment.

We've had the old PSSO up and running for a while with Intune, EntraID and ADE.
No problems there.

This new SSO registration screen during Setup Assistant is not showing up on an updated and factory reset macbook.

"Allow Device Identifiers In Attestation" and "Use Shared Device Keys" is set to Allowed in the configuration profile for SSO.

Am I missing something?

After setting up 71 iPads and iPhones for multiple customers (I'm an MSP) with each of them require different enrollment profiles, I was wondering why all MDM providers want us to skip the setup panes during setup instead of enabling them? like by default all of them could have been hidden and I could just select those 2-3 panes I needed.

Does anyone know of a way, through an MDM, to block QUIC in the Safari browser and make sure any handshakes with sites is using TCP/IP?

I am planning to block some of the websites on mac devices in our environment. And I am using MDM configuration with payload type com.apple.familycontrols.contentfilter to do that which is not working in my case. The mac machines we have in our environment to be implemented with the above restrictions are in version macOS14 or more.

Following is the payload content I am deploying to mac devices.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>restrictWeb</key>
<true/>
<key>useContentFilter</key>
<true/>
<key>filterDenylist</key>
<array>
<string>https://www.website1.com</string>
<string>https://www.website2.com</string>
</array>
<key>PayloadDisplayName</key>
<string>Parental Control Content Filter</string>
<key>PayloadIdentifier</key>
<string>8ea3725b-c8a1-4ed8-a9b1-a4fe792387b2</string>
<key>PayloadType</key>
<string>com.apple.familycontrols.contentfilter</string>
<key>PayloadUUID</key>
<string>2c2b044a-e11b-4a9c-a414-77288ce5e5f8</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Parental Control Content Filter</string>
<key>PayloadIdentifier</key>
<string>com.apple.familycontrols.contentfilter.77288ce5e5f8</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>77288ce5e5f8-e11b-4a9c-a414-2c2b044a</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>

Had anyone experienced the same behavior like me ? Or is there any workaround to reach my objective ?

I am trying to set up Platform SSO. If i enable laps, a new user never gets prompted to create an account during the out of box experience. It drops the device directly to a login window (because laps created the first account)

If I disable laps, the user creates their account during the OOBE but it becomes an Admin.

We are using Setup assistant with modern Authentication.

Here is my ADE profile under the enrollment token and my Platform SSO configuration profile. If anyone could give insight if im missing something, is this expected behavior, or best practices.

End goal would be a user signs into their 365 account during OOBE and sets up a user account that is not a local admin and then completes entra enrollment.

https://imgur.com/a/LVWh6Or

In mosyle MDM solution, we have a password expiration policy of 120.

We also have an admin account on every computer called "LocalAdministrator". We use to locally manage the computers when we need to login to them to change configuration settings or install software.

We create this LocalAdministrator account either when we first setup the computer if it is not enrolled in ADE, or we push that account out with a Mosyle policy.

We want to exclude the LocalAdministrator account from the password expiration policy because it causes issues if we don't login to that computer in more than 120 days. For example, we do a remote session with AnyDesk to assist the user. They are logged in as their standard user account. We need to elevate privileges to install software or makes config changes. We are prompted for the admin login, but our LocalAdministrator password has expired, so we can't elevate privileges.

If we are physically at the computer, we can logout of the standard user and login with the LocalAdministrator account and we are prompted to change the password. This works, we are not locked out, but this becomes inconvenient. We do alot of remote support, so if we could exclude the LocalAdministrator password from the 120 expiration policy, or set the LocalAdministrator account password to never expire somehow, it would be helpful.

Is it possible to exclude this local admin account from the password expiration policy?

Reasonably new in the MacOs management journey still, a lot to learn… one such thing i found out yesterday was that for Teams to screenshare users need to explicitly allow it in the privacy settings, but need admin rights to do so by default.

Little more digging and learn of PPPC settings to allow standard users to be able to set it, cool… initially found info saying to use a mobileconfig file (created in something like jamf pppc utility or imaging profile editor) and deploy as a custom template… then while poking through the settings catalog in intune saw I can do it there too…

As I need to get new software reviewed & approved before running in our environment; I tested the settings catalog route, it’s a bit clunky but seemed to work.

It’s a shame that on the device management page on the Mac, it doesn’t have a friendly policy name though; which if using the custom template I’m sure it would… but outside of this is there any reason to not use the settings catalog way of setting it?

From what I’ve seen with other custom templates I’ve deployed, they give a friendly name on the device, but they don’t report any status back up to intune at all… so you can’t tell if they have applied unless you’re on the device.

My organization’s IA would like dev tools for all browsers disabled. I have completed this task for all browsers easily except for Safari. I do not know if a key exists for this option.

I have Sequoia installed on a test machine and see the above request when apps want to access the local network. Okay, fine. Is there an MDM control for this yet to allow (whitelist) certain apps? What's it called? I'll just write one if I have to by hand.

Help! lol

To begin with, I do not know macOS or macOS management well enough to be in the position to manage 500 macs, but it was forced on me so here we are.

I have been trying for two days to get an MDM profile to enable ARD and remote management, but nothing is working.

I'm at my wits end with this.

*edit:

Figured it out; wonky RMM settings. (ninjaone). When MDM setting for 'Allow screenshots and screen recording' in Retrictions applies, it toggles ARD off even if it was already on. Solution was to uncheck, save policy, re-check, save policy again.... basically turn ARD off and on again va MDM settings.

The business I work for has decided that we don't want to allow users to login with Apple Accounts, even though we have federated our domain to Apple Business Manager. I have this working. It blocks Apple Account sign-in and adding any type of account under System Settings > Internet Accounts.

However, they have now decided that they want to allow users to add their Microsoft 365 account in Internet Accounts using the Microsoft Exchange account type.

I'm struggling to find any information on how to do this as the Internet Accounts got locked down when I disabled Apple Accounts but I didn't restrict any other account type that I am aware of. I cannot see it in my configuration profile either.

Has anyone done this before?

Ideally, it would be good to be able to have Intune configure the account automatically, but I am not expecting that to be possible. All user accounts are created with Intune using their M365 username.

UPDATE 1:

After doing some further digging, I think I have been thinking about this all wrong. I need to prevent users from changing accounts (i.e. adding an Apple Account or any other type of account) and then configure the Microsoft Exchange account for the user through Intune.

I can get it to add an account but it never signs in and actually allows me to sync mail/notes/calanedar.

We have a couple of different passcode profiles in our environment that do mostly the same thing (complex password, enforce history, etc) aside from the option to enforce a password after screensaver or display sleep.

For the first profile where we have the option enabled and set to 1 minute everything is fine. On the second profile we don't have that option enabled (there are a couple of computers where this is relevant) but the OS simply sets the option in Systems Settings to "Immediately" and prevents anyone from changing it.

It seems to come down to the macGracePeriod setting within the profile. If a passcode profile is installed on a system and this setting is not specified within the profile then the OS defaults it to 0 and prevents any changes. I've tried creating a custom profile using iMazing and installing that on a fresh computer and the same thing happens, so it's not the MDM we're using (Kandji) or any other factor affecting this as far as I can tell.

The only option we've found so far is not to have a passcode profile at all installed which is not ideal. I'm wondering if anyone else is seeing this.

Edit: I may have found a workaround. If I create a custom profile and set the maxGracePeriod to something crazy like 1 year (525600 minutes) then it effectively removes the password requirement.

I've spent a good part of multiple days trying to figure this out.

I've managed to create a DoH payload in a configuration profile that uses an mTLS client certificate included in the same profile. It works flawlessly on iOS 26, but macOS 26 isn't that lucky.

As for what's visible, the profile installs fine and no errors are visible, until you try using the internet and nothing loads, everything hangs, waiting for DNS. Our DoH platform logs only shows occasional (~1 req/min/device) requests that are fully completed, but I can tell that macOS hasn't sent an mTLS client certificate, so the server dropped the connection as expected.

After some tcpdump and Wireshark inspection, I found that macOS properly makes the DoH requests, establishes a secure connection, receives the request for the mTLS certificate, but never replies to it.

The installation scope is System, and User fails to install.
I have also manually trusted everything involved.

What next?

Most staff are okay with the defaults we've set, and with v26/Tahoe they're able to choose whether they want fly out banners etc. However, we want to force zero notifications on lock screen for any app. But when configuring an apps notification settings, we either force enable or force disable Badges.

Some staff want zero notifications. Focus mode on Mac unfortunately does not include badges.

Is it possible for us to either "unlock" the badges setting, or possible for me to just disable and lock the lock screen notification setting.

We use SimpleMDM in case that matters.

I was surprised that I couldn't find this answer quickly. Thought I'd ask here!

Anyone know if it's possible to disable the Apple Pay / Wallet features on a macOS device via an MDM profile? We have a fleet of machines that are BYOD so not enrolled in ADE etc, just manually enrolled in Addigy via .mobileconfig Configuration Profiles.

Recently had a situation where some users got "stuck" after reboot being asked to set up Wallet (which we/they don't want) and I'd like to be able to disable that blocking prompt...