Meraki Systems Manager - Profile won't install/restrictions won't enforce

[gsk]

Hi All,

 

I'm having trouble with Meraki Systems Manager. I have set up the account, setup the apple push certificate and can enroll the device. It is constantly checking in with the meraki servers and correctly identifies everything about my device. I have set the profile to add wifi settings and the enforce restrictions such as using facetime and have set an app to deploy. When I enroll the device the app atempts to deploy but fails and the restrictions aren't enforced. When i go into the details of the device on the meraki dashboard it says that profile updates are pending and the recent activity section says that the profuile failed to install. I have attached a screen shot of the error message. If anyone could help I'd be grateful. It has the potential to be a fantastic tool if it can be made to work!

Cheers,

 

[SovietRussia]

In your restrictions, you need to turn off all the ones that say Supervised Devices only. The profiles have to be very specific.

 

They must be UNTICKED like this picture

 

 

Any more help, just ask

Edited April 11, 2013 by SovietRussia

[gsk]

Brilliant thank you! It's working nicely now. If I wanted to enable the Supervised Only restrictions in a byod environment, how would I go about doing that?

[FWBD]

Just tired this now and the Managed Settings were pushed out fine so thanks for that

[Planehazza]

Bump for an old thread. My devices are on 9.3.1 and are supervised by Apple Configurator, yet I still get a failure when I try to reinstall/update a profile. The profiles install fine if I re-enroll the device, but subsequent profile updates will not install.

 

name: School iPad, error: Profile Installation Failed, status: Error

 

Any ideas?

[fredbayker]

Brilliant thank you! It's working nicely now. If I wanted to enable the Supervised Only restrictions in a byod environment, how would I go about doing that?

 

you can only use those settings for devices that are supervised either through DEP or using AC. chances are probably slim to none for those devices being supervised...

[Blue_Cookeh]

FYI Guys, plug an iPad with an issue into a Mac running Apple Configurator 2, there's an option to view the device's console somewhere in there, it's very verbose and has helped me figure out tons of problems!

[Planehazza]

you can only use those settings for devices that are supervised either through DEP or using AC. chances are probably slim to none for those devices being supervised...

 

His message was from 2013 mate, I bumped an old thread as my issue is similar.

[RLR]

Bump for an old thread. My devices are on 9.3.1 and are supervised by Apple Configurator, yet I still get a failure when I try to reinstall/update a profile. The profiles install fine if I re-enroll the device, but subsequent profile updates will not install.

 

 

 

Any ideas?

 

Are your push certificates up to date?

[Planehazza]

Yup, checked earlier and it's green and valid. Currently, I'm testing a profile built in AC2.0 rather than Meraki itself. I've created and exported it, and then uploaded it to a new mobile profile that has a single tag 'Test'. I'm going to factory reset an iPad and enrol it via AC2 and see if I can push out the profile (even though AC2 should have already done this) via Meraki.

 

Are there any good guides out there? I'm don't 100% understand all the stages in honesty. I have all the VPP and push certs sorted, but I've no idea what the SCEP CA is or if I should even be using it. There is an entry under 'current cert' however.

 

Am I right in saying that AC2 is simply a way to get all the iPads named, supervised, and enrolled, ready for further management via Meraki? I have the correct MDM URL configured in AC2 so they should be enrolling just fine. App installs work fine from Meraki, as do their licensing, I just keep getting profile install errors.

 

These situations remind me very easily why I ditched Apple entirely. Long live Windows and Android! Having said that, I've not done and mobile device managment with Android - I'm sure that's just as much of a ball ache!

Edited April 5, 2016 by Planehazza

[RLR]

Yup, checked earlier and it's green and valid. Currently, I'm testing a profile built in AC2.0 rather than Meraki itself. I've created and exported it, and then uploaded it to a new mobile profile that has a single tag 'Test'. I'm going to factory reset an iPad and enrol it via AC2 and see if I can push out the profile (even though AC2 should have already done this) via Meraki.

 

Are there any good guides out there? I'm don't 100% understand all the stages in honesty. I have all the VPP and push certs sorted, but I've no idea what the SCEP CA is or if I should even be using it. There is an entry under 'current cert' however.

 

Am I right in saying that AC2 is simply a way to get all the iPads named, supervised, and enrolled, ready for further management via Meraki? I have the correct MDM URL configured in AC2 so they should be enrolling just fine. App installs work fine from Meraki, as do their licensing, I just keep getting profile install errors.

 

These situations remind me very easily why I ditched Apple entirely. Long live Windows and Android! Having said that, I've not done and mobile device managment with Android - I'm sure that's just as much of a ball ache!

 

 

Hmm, I like to use AC2 with our MDM when setting up shared iPads (like class sets).

 

Have you setup a supervision identity to make it so you can share the ipad supervision between your MDM and AC2? The last time I used AC2 I got an error when installing our WIFI profile but it seemed to work so just ignored it.

 

It might be worth plugging the iPad into the mac and looking at the AC2 ipad logs. I haven't got my mac in front of me but you can see the iPad status when plugged into AC2 which might give more information.

[Planehazza]

"share the ipad supervision"

 

That's a new term/concept to me. How and where do I configure that? When I do the 'prepare' stage, I have the 'Allow device to connect to other Macs' ticked (so I can get photos off etc). I'm not sure if it's bending the rules etc, but we're only using one iTunes account for all 30 iPads. We're only using free apps however, so I think we're OK. I know it's not the best way to do it, but it's how it was set up before I started and this site.

[RLR]

Are your iPads in DEP (deployment enrolment program)?

[Planehazza]

Are your iPads in DEP (deployment enrolment program)?

 

Nope...

 

I was enrolling them manually by going to m.meraki.com and punching in the code, but I want to do it as part of the supervision step. Another thing that's making it annoying is our cyberoam internet access portal. I'm currently have my manager set them up as clientless so I don't need to authenticate them after joining the WiFi. This isn't the reason that they're failing the profile installation as I've tested dozens by making sure they're connected, authenticated and able to browse the Internet and install Apps (managed and manually).

Edited April 5, 2016 by Planehazza

[RLR]

Are you using the free version of Meraki or the paid version? What IOS are the iPads on?

[Planehazza]

Are you using the free version of Meraki or the paid version? What IOS are the iPads on?

 

Free as I have less than 100 devices, and they are on a mixture of 9.1, 9.2.1, and 9.3.1. I'm aware of a bug on 9.2 but none are on that. I've just foolishly released I'm infact not on AC2; I'm on 1.75. The OSX device I use is currently updating to El Capitan so I can install 2.0. I think I'm just going to have to give up on the idea of remotely managing profiles, and instead use Meraki purely for App deployment.

[RLR]

The free version of Meraki doesn't get the extra functionality that comes with IOS9 although you can still use the old functionality and manage IOS9 devices. We don't use Meraki so can't help too much with this but it might be worth trying just using Meraki and not both to see what happens.

[Planehazza]

The free version of Meraki doesn't get the extra functionality that comes with IOS9 although you can still use the old functionality and manage IOS9 devices. We don't use Meraki so can't help too much with this but it might be worth trying just using Meraki and not both to see what happens.

 

 

Thanks for this. I want to use AC2 to essentially set up one iPad as master and clone them from there, then really just use MDM to push out new app requests and update restrictions. Really, I want all the apps and restrictions to be set via AC2 from the start so I can essentially just use Meraki MDM to update them. IMO, Apple devices simply aren't suitable (yet) for enterprise environments. It's just awful to work with.

[RLR]

Thanks for this. I want to use AC2 to essentially set up one iPad as master and clone them from there, then really just use MDM to push out new app requests and update restrictions. Really, I want all the apps and restrictions to be set via AC2 from the start so I can essentially just use Meraki MDM to update them. IMO, Apple devices simply aren't suitable (yet) for enterprise environments. It's just awful to work with.

 

Yep. They've come a long way in the 4 years I've been working with them but they still have a lot of things they can make better.

[Planehazza]

Yep. They've come a long way in the 4 years I've been working with them but they still have a lot of things they can make better.

 

It's a shame because they lightyears ahead of microsoft for portable devices, but for central remote management, they're horrendously bad. Looking forward to trying AC2 though. I might just have to give up for now and just make sure they all have apps X, Y, and Z as requested until I have more time. I can't see me having this done by the end of this week...

[fredbayker]

The free version of Meraki doesn't get the extra functionality that comes with IOS9 although you can still use the old functionality and manage IOS9 devices. We don't use Meraki so can't help too much with this but it might be worth trying just using Meraki and not both to see what happens.

 

As long as you won't have more than 100 devices in the long term, you can upgrade your account (if it's an old one) to get all the features.

It doesn't solve your issue but I just thought I'd add this.

Edited April 6, 2016 by fredbayker

[Blue_Cookeh]

As long as you won't have more than 100 devices in the long term, you can upgrade your account (if it's an old one) to get all the features.

It doesn't solve your issue but I just thought I'd add this.

 

Do you know roughly how much that is?

[RLR]

Do you know roughly how much that is?

 

You'll have to get a quote . I don't think they have set prices but I think it's around £5 per device for Meraki.

[Planehazza]

Argh, I've changed my mind. AC2 is just as awful as 1.x. Initially I thought it was much better, but now it's just super fiddly, and it's constantly failing or crashing. Should "step 1 of xx - Generating wallpaper" on applying a blueprint take a long time?

 

As long as you won't have more than 100 devices in the long term, you can upgrade your account (if it's an old one) to get all the features.

 

Our account is about 9 months old. Will this be eligible for said upgrade? We only have 33 devices.

Edited April 7, 2016 by Planehazza

[Planehazza]

I can't install any profiles either. I've created several new from scratch in AC2 and tried assigning them to various iPads (fully restored) and it keeps failing after I hit the 'Apply profile' button on setup. It just says 'Invalid Profile'. My instinct is saying it#s something to do with certificates as I had to choose Always Allow for the Organisation cert in keychain. Could it be that the iPads are rejecting this? If so, how do I get around it?