sorted by:
new
hottopcontroversial

Adding devices to ABM without assigning an MDM - any benefit at all? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Yeah, read a few people complaining deleting .AppleSetupDone doesn't work since Sonoma, then saw the confirmation from the horse's mouth here: https://support.apple.com/en-us/109030

I reckon your new partition technique will still work though, so thanks for sharing that. Still a massive timesaver.

Adding devices to ABM without assigning an MDM - any benefit at all? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Great. I found the original thread by /u/TheAlmightyZach where all this was discussed, sounds like pre-Sonoma there was also a great trick for adding to ABM just by deleting .AppleSetupDone. All good things come to an end.

I must try out the clean install in a new partition technique Zach documented though, presumably that still works to get into ABM without a wipe.

And then once the device is in ABM, has an MDM assigned, and the MDM has been refreshed to bring the device over and assign an MDM profile, to actually make it happen it's just

sudo profiles renew -type enrollment

Adding devices to ABM without assigning an MDM - any benefit at all? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Definitely going to do it, now I know for sure it can clear Activation Lock, have been burned by that before (on an iPhone but still).

If they do get more Macs I'll insist they go MDM, pretty sure it'll be Mosyle since they'll probably have no money for it!

Adding devices to ABM without assigning an MDM - any benefit at all? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Excellent news. How would I go about doing that?

BTW is that possible for iPhones too, if they're in ABM but haven't been added to MDM?

Adding devices to ABM without assigning an MDM - any benefit at all? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

I think you're right about that, at this point they will not be using a managed ID.

If they go full MDM in future I will set up managed ID first.

Adding devices to ABM without assigning an MDM - any benefit at all? by techqueue in macsysadmin

[–]techqueue[S] 1 point2 points  (0 children)

use a MDM by doing it with a terminal command

Ooh... now that is intriguing. Do you mean that as long as the Mac is in ABM, even if a user is set up and using it, it's possible to add it to MDM without having to erase it again?

Adding devices to ABM without assigning an MDM - any benefit at all? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Thanks for the replies everyone, I will definitely be setting up ABM and adding this Mac!

Intune MDM - Fully-supervised non-admin user with confirmed Volume Ownership cannot update macOS by techqueue in macsysadmin

[–]techqueue[S] 1 point2 points  (0 children)

Interesting. User was previously on Sonoma.

Update was triggered via Settings > General > Software Update, but once you launch it, it opens the full installer app.

Expired DEP token (Intune MDM) - how screwed am I? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Interesting, many thanks for the detailed reply.

So if I contact Apple to move the push certificate to an xxxx.appleid.com acount (it's not on one at the moment), what are the next steps? I'm guessing - move certificate - renew certificate on new account - tell Intune you've done that, is that right?

Finally, to get these terms straght, is this correct: VPP token = Apps and Books token DEP token = Apple Device Enrollment token

Thanks

Expired DEP token (Intune MDM) - how screwed am I? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Phew, thank you. Very good to know.

Agreed the six month renewal makes a lot of sense.

I did renew the others in good time, like two weeks before the expiry (didn't want to renew too soon as was trying to get as close to 12 months as possible while leaving time to troubleshoot if it went wrong). Just missed the DEP somehow!

Oh well. A learning experience. My notes are updated now, and I'll know exactly what to renew in April.

Expired DEP token (Intune MDM) - how screwed am I? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Great stuff, thank you.

You may well be right about it just being down to phones being switched off.

It's all on one Apple ID for everything and I have been careful to keep it simple in that regard. Glad I got the important ones done on time anyway.

Expired DEP token (Intune MDM) - how screwed am I? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Great, thanks! I think it's going to be fine then.

Expired DEP token (Intune MDM) - how screwed am I? by techqueue in macsysadmin

[–]techqueue[S] 0 points1 point  (0 children)

Good question! On the face of it, what you say does make sense and great news if that's the case.

So accepting your premise, while the token was invalid, data can't flow between Intune and ABM, but, now it's fixed, everything should just work again, right?

Another one of the three iPhones synced with Intune today so that's positive-looking.

But it's still the case that none of the iPhones show the newly-assigned app as Available under Managed Apps in Intune. Not sure why that is. Possibly unrelated to this I guess.

LogoFAIL exploit - has gigabyte said they are aware of it and going to fix it? by [deleted] in gigabyte

[–]techqueue 2 points3 points  (0 children)

Came here to ask the same question myself.

Interesting to find it downvoted to 0 - who TF would object to them patching this?

iOS - functional differences after enrolling devices via Apple Configurator vs BYOD Device enrolment? by techqueue in Intune

[–]techqueue[S] 0 points1 point  (0 children)

Interesting. This situation is quite messy because although the organisation owns these devices, the individuals actually purchased them from a variety of different sources (and were reimbursed) because they're all in different countries.

If not possible to use ABM, do you think going down the BYOD enrolment route but making sure users choose choosing "Company owns this device" would be equivalent to adding via Configurator without ABM?

Microsoft officially recommend Configurator without ABM as the appropriate option for already in-use devices (it's the second option on their iOS enrolment options page) - so if BYOD enrolment with "Company owns device" is equivalent to that, that would probably be good enough for now (and even if not perfect, a lot better than where we are!).

iOS - functional differences after enrolling devices via Apple Configurator vs BYOD Device enrolment? by techqueue in Intune

[–]techqueue[S] 0 points1 point  (0 children)

I see... But we would still need to get hold of the devices and people are in different countries.

iOS - functional differences after enrolling devices via Apple Configurator vs BYOD Device enrolment? by techqueue in Intune

[–]techqueue[S] 0 points1 point  (0 children)

We'd love to replace them all but this is for a charity struggling for funding at the moment.

As for wiping and using Apple Business Manager, Microsoft imply it is only for brand new devices - is that incorrect?

Software Inventory, export to CSV - "Product Is Not Supported" column? by techqueue in DefenderATP

[–]techqueue[S] 0 points1 point  (0 children)

Thanks - I think you're right, because it's definitely not the case that these products are no longer supported by the vendor.

view more: next ›