Release Notes Silverback 19.0 Update 1

E-Mail Notifications for manual unenrollments

We always appreciate the feedback about improvements or missing features in our product that you provide us in our Idea Portal. One of the most voted feature request was the Send notifications to admin when users remove the profile. With Silverback 19.0 Update we are happy to provide you this functionality for all supported devices types. From now on you will find a new Email Template (Admin > Email Templates) called Manual Unenrollment Alert. After updating to the new release, all Administrators with enabled Receive Email Alerts will receive an Email Notification whenever a user unenrolls the device manually. 

Device Enrollment Program with Active Directory Authentication

We are happy to announce a more comfortable way to enroll devices with the Device Enrollment Program from Apple. It was one of the most common awaited features in our Idea Portal. So from now on its possible to directly use the Active Directory Credentials to enroll the device  during the Out-of-the-Box-Experience for Device Enrollment Program prepared devices. The functionality will be enabled by default after the update. To deactivate the functionality navigate to Admin > Device Enrollment Program > Settings and disabled the checkbox Active Directory Authentication. With activated Active Directory Authentication your end user just need to authenticate with their Active Directory credentials to complete the enrollment.

QR Code Enrollment for iOS

Another way to make enrollments more user friendly, is to use our new QR-Code functionality in Silverback. Navigate to Admin > Self Service Portal > Simple Enrollment. There you will find the by default enabled checkbox "Use QR-Code". Here you have also the possibility to upload a branded QR-Code Logo (recommended size of 48x48 pixel).  As usually Silverback offers multiple way to enroll devices, so we want to recap the different approaches and show the benefits of the QR-Code

User driven enrollment via Self Service Portal from a second device

A user driven enrollment from a second device starts as usual. First, the end use needs to sign in into the Self Service Portal, then select (depending on your configuration) the ownership and enter the phone number, which is optional. With the last step the QR-Code is shown. If the end user provided a phone number, an additional SMS will be sent, so the end user can decide to use the sent link in the SMS or proceed with scanning the QR-Code with the native iOS camera.  After that the end users needs to follow the instructions on the device. 

Administrator driven enrollment for a single user

Another way to enroll devices is the Administrator driven enrollment. Depending on your workflows it might be that you want to provide your end users a fully configured device. For this navigate to Devices > Pending and click Provision User. On the next screen select the Ownership, enter the Username and provide the common Admin Credentials to create the Pending Enrollment. The next screen will display the Enrollments Details with the QR-Code. Just scan the QR-Code with the iOS Camera and follow the instructions on the device. In this case the end user will receive an E-Mail Notification based on the Admin Provisioned a Device Notification for User Template. When you add a Mobile number during in the Provision User screen, an additional SMS will be send and the displayed screen will be differ. 

Without mobile number	With mobile number

Create Computer Objects in Active Directory

With Silverback 19.0 Update 1 we added the ability to create Computer Objects in your Active Directory. You may already be familiar with the automatic creation of Computer Objects after a Computers joins your Active Directory.  From now on, Silverback can do the same and has the ability to create Computer Objects during the Enrollment on your behalf. For this functionality we added under Policy > Computer Objects the following settings: 

Assign Computer Certificates to Computer Object

As a second step, you might want to add distributed Wi-Fi certificates to the created computer object in your Active Directory based on computer certificate templates. We are happy to provide you this functionality in this Release. To achieve the adding of certificates to computer objects a couple of steps needs to be done. On a high level the following steps are required

• Add a Certification Authority to Silverback
  • Login as Settings Admin
  • Navigate to Certificates and enable Individual Client
  • Add your CA in the following format
    • ca.imagoverum.com\imagoverum-CA
• Create a certificate Request Agent Template
  • Open the Silverback Microsoft CA Integration for Android & iOS v1.6.pdf Guide and
  • Work through the following chapters:
    • 5.2.1. Creating the Certificate Request Agent Template
    • 5.3. Publishing the Newly Created Certificate Templates (Enrollment Agent only)
    • 5.4. Creating the Certificate Request Agent Certificate
    • 5.5. Importing the Certificate Request Agent Certificate
• Create and Publish Computer Certificate Template 
• Add a WiFi Profile into the same Tag where you enabled the Computer Object Creation Policy

QR Code Enrollment for Android

As well as for iOS, we are happy to provide you a more user friendly and more faster way to enroll Android and SamsungSafe device with Silverback 19.0 Update 1. To make it work for Android and SamsungSafe we extended our Companion App with an integrated QR-Code scanner. The first change you may notice is that after the first installation Companion asks for a new app permission called "Allow Companion to take pictures and record video?". This permission is required to use the camera engine on each Android and SamsungSafe device and is needed to use the Scan QR-Code functionality, which is displayed in the initial Companion screen. End users just need to select Scan QR-Code to scan the provided Silverback Enrollment QR-Code. After a successful scan, everything remains the same and the process hasn't changed. You will still have the possibility to enter all needed enrollment information manually by selecting the second option "Enter Manually". Please refer to the iOS chapter where we already recap the different approaches and benefits of the QR-Code

Managed App Configuration for Device Owner Mode

Some Android applications designed for enterprises include built-in settings called managed configurations. You may have already noticed the Edit Managed Configuration button for each Managed Play application that you added into Silverback. If the application is extended with managed configuration you will see a configuration pop-up with all supported managed configuration for this application. This functionality was given for Work Profiles on Android Enterprise and is now fully supported for devices in device owner mode. In Companion we added a profile information "App Configuration Profile" which means that managed configuration is distributed to your end users device(s).

Passcode Settings Update

With Silverback 19.0 Update 1 we updated the Passcode Settings for Android and SamsungSafe devices. Now you have new options to define device passcode settings in a more granular way. These settings were changed both for lock screen in the personal area and in the work profile section.  You will find in the Work Profile section also a new checkbox called "Allow same passcode". For Android 9 and later it's possible to require two different passcodes for personal area and for unlocking the work profile section. During the update we fixed also a known issue, where passcodes for work profiles hasn't applied. Please find your appropriate setting in the following overview: 

Android Q Support

Android Q is the tenth version of Google's operating system. Currently it's in the beta phase and will be probably launched in August this year. For all early adopters we are happy to announce the general support in Silverback. Please note that Google may change something during the next months, but based on the current development state, the general management of Android Q devices is ensured. 

Device Scope Installations

A Device Scope installation or in other words, a per-machine installations of an application means that the application is available for all users of a computer.  The Windows Installer allows to perform an install on a per-user or per-machine basis. This mostly affects the value of certain folder properties at install time such as the DesktopFolder, ProgramMenuFolder, StartMenuFolder, and StartupFolder.  Also shortcuts will be installed to the All User Profile. You should consider this option when multiple users access the same machine with the combination of the Allow MSI Always Install With Elevated Privileges Restriction.  This will have a positive effect of any Hybrid Management scenarios with the Autopilot functionality where devices requires a reboot, before the Classic Management (Empirum Agent) is able to perform actions on the devices. 

Bulk Enrollment via Provisioning Package

A provisioning package (*.ppkg) is a file for a collection of configuration settings. For Windows 10 Devices, Administrator can create provisioning packages that let you quickly configure a device without the need of installing images. Additionally, provisioning packages can be used to enroll devices into a Mobile Device Management like Silverback. With the power of Matrix42 Unified Endpoint Management it's now very easy to perform a migration from a traditional or classic management system, like Empirum, to new modern management scenarios with Silverback. As an outcome, devices will be hybrid managed by Empirum and Silverback with all positive effects for you and your endpoint devices. 

With the bulk provisioning method via provisioning packages it is very easy to enroll and configure multiple devices with a standard user account quickly. To use bulk provisioning, download the Windows Configuration Designer tool from the Microsoft Store. This tool creates provisioning packages used to image devices. As part of these provisioning packages, you can include Silverback configuration settings so that provisioned devices will be automatically enrolled into Silverback. Please note that admin permissions are required to run the provisioning package. At this state bulk provisioning only supports single user standard staging. The step by step guide will use for the migration or staging scenario a user called migration. 

• Create your Migration User
  • Login as an Administrator into Silverback
  • Navigate to Users
  • Click New Device User
  • Enter as Username e.g. migration@imagoverum.com
  • Add the following information
    • First Name
    • Last Name
    • Email Address
    • Password
    • Confirm Password
  • Click Save
• Enable Bulk Staging Mode
  • Navigate to Admin > Self Service > One Time Passwords
  • Enable Allow Multiple Pending Enrollments
  • Enable Activate Bulk Staging Mode
  • Set OTP Expiration Date to unlimited
  • Add your Migration User, e.g migration@imagoverum.com
• Create a new Bulk Enrollment
  • Navigate to Devices
  • Click Pending
  • Select Bulk Provision Users
  • Click Create New Bulk Provision User
  • Enable Define OTP
  • Enter a OTP, e.g. 4444
• Create a *.csv file 
  • Open any Text Editor, e.g. Notepad++
  • Enter in the first line your created username, e.g. migration@imagoverum.com
  • Copy the username and paste it as often a you want in the lines below
  • Save the file as *.csv

• Upload the *.csv file
  • Navigate back to Silverback
  • Select Choose File and upload your created *.csv file
  • Provide LDAP or Local User Credentials to authorize this action
  • Click Submit
  • Depending on the amount of lines in the *.csv, the process may take a while, so proceed with next steps
• Download Windows Configuration Designer 
  • Open on a Windows 10 device the Microsoft Store
  • Search for Windows Configuration Designer
  • Download and Install Windows Configuration Designer
  • Click Launch
• Create Provisioning Package
  • Select Advanced provisioning
  • Enter a Name and Description (optional) and click finish
  • Select All Windows desktop editions and click next
  • Click Finish
  • Expand Runtime settings in the left pane
  • Left click Workplace
  • Click Add in the middle pane
  • Enter as UPN your created user, e.g. migration@imagoverum.com
  • Click Add
  • Double Click on the newly generated Enrollment
  • Configure the Enrollment as following:
    • Change Auth Policy to OnPremise
    • Enter as DiscoveryServiceFullUrl: e.g. https://silverback.imagoverum.com/En.../Discovery.svc
    • You find your Discovery URL under Settings Admin > Windows Phone > Enrollment URL. You need to add Discovery.svc at the end 
    • Enter as Secret your defined OTP, e.g. 4444
  • Click File and Save your project
  • Click Export and select Provisioning Package
  • Provide a name, e.g. Matrix42 UEM Migration and click Next
  • Click Next (3x)
  • Click Build
  • Open your Output Location and click Finish
• Run the provisioning package
  • Copy the created *.ppkg file to your Windows 10 Device
  • Execute the *.ppkg file on the device and follow the instructions
  • Navigate to Settings > Accounts > Access work or school
  • After a successful run the device should be enrolled into Silverback

Clean PC

CleanPC device action requires minimum Windows 10 Version 1703 and allows removal of user-installed and pre-installed applications, with the option to persist user data.  Navigate to Devices > Managed and open one of your enrolled Windows 10 Devices. Select More and click Clean PC. 

Select Retain user data on this device to 

• Keep the device Azure AD joined
• Device will be re-enrolled into Silverback when when an Azure Active Directory enabled user signs into the device.
• Device user's Home folder, and remove apps and settings are kept

When not enable retain user data, the device will be restored to its out-of-box state. BYOD devices will be unenrolled from Azure AD and Silverback. Azure AD joined devices will be enrolled into Silverback again when an Azure Active Directory enabled user signs into the device.

Device Enrollment Program Support

The Device Enrollment Program helps you and your organization to to deploy and configure Apple devices easily. DEP provides a fast, streamlined way to deploy organization-owned Apple devices purchased directly from Apple or participating Apple Authorized Resellers or carriers. Silverback supports since a very long time the Device Enrollment Program for iPhones and iPads and we're happy to announce the general DEP support for macOS devices and Apple TV devices (cf. tvOS chapter) in this Release. In contrast to iPhone and iPad devices, MacOS Devices needs to be exclusively purchased directly from Apple or from any participating Apple Authorized Resellers or carrier. 

Please refer to the Apple Deployment Integration Guides if you are new to the DEP Program.

After purchasing a DEP ready macOS device, the complete enrollment process can be shortened to allover 5 steps for any end user:

Select your Region and Language	Select the Keyboard Layout	Enter credentials on the Remote Management Screen
Enter Full Name for the Computer Account	Wait until the Process is finished	Device is ready to use

Application Distribution

With Silverback 19.0 Update 1 we are happy to provide you the functionality to distribute enterprise application to macOS. 

• Navigate to App Portal
• Select macOS
• Click New Application
• Enter a Name
• Upload your *.pkg file
• Upload the corresponding manifest *.plist file 

Hybrid macOS Management

The functionality of distributing enterprise applications to macOS devices opens the door for a Matrix42 Hybrid macOS Management. You may have seen already our streamlined process for new employees on the Windows 10 platform, where devices will be shipped to employees and with the power of combined Autopilot capabilities with an Out-of-the-box enrollment to a modern management layer (Silverback) and the fulfillment of classic management scenarios (Empirum), like installations of legacy applications, the starting process for new employees is very fast and quite unique in the Unified Endpoint Management Market.  With our new Silverback release, we will bring these capabilities to the macOS Platform. So, please stay tuned for upcoming announcements, demonstrations and white papers.

On a high level process you are now able to distribute the Empirum macOS Agent to already managed macOS devices, or you combine this capability with shipping an Device Enrollment Program ready macOS device to your end user. 

Overall Supported Features

• Enrollments
• Restrictions
• Wi-Fi Configuration
• Global HTTP Proxy
• Custom Profiles
• Home Screen Layout
• Defer Operating System updates
• Remote Restart
• Remote Renaming

Enrollment with Apple Configurator

Prerequisites:

• Enabled Apple TV as Device Type under Settings Administrator
• Accomplished Apple Deployment Programs I: Create Managed Apple ID
• Created Organization in Apple Configurator. Please refer to: Apple Deployment Programs IV: Manually add devices to DEP
• Installed Apple Configurator on your macOS. Please refer to: Apple Deployment Programs IV: Manually add devices to DEP

Enrollment with Device Enrollment Program 

• Enabled Apple TV as Device Type under Settings Administrator
• Accomplished Apple Deployment Programs I: Create Managed Apple ID
• Accomplished DEP Parts on Apple Deployment Programs II: Configure Deployment Programs 
• Accomplished Reading and understanding Apple Deployment Programs III: DEP in Silverback
• Created Organization in Apple Configurator. Please refer to: Apple Deployment Programs IV: Manually add devices to DEP
• Installed Apple Configurator on your macOS. Please refer to: Apple Deployment Programs IV: Manually add devices to DEP

Restrictions