Release Notes Silverback 21.0 Update 2

Unified User Experience 

• Enrollment Invitation
• Enterprise Application Upload
• Device Actions for all platforms

Apple Device Management Updates 

• New Restrictions for iOS and iPadOS 14.5+ and macOS 12
• Classroom Configuration 
• Unique Identifiers for Payloads for iOS and iPadOS 15
• New Device Information for macOS devices
• System Variable support for Custom Profiles
• Deploy iOS family applications to iPadOS devices 

Exchange Protection

• Custom Matching Criteria for Mailboxes

Enrollment Invitation

With the introduction of the Service Bus Listener, Silverback is capable to receive actions from the Unified User Experience. One new action in this Silverback 20.0 Update 2 release is to create pending enrollments with the usage of the Service Bus. By using the new +Add Mobile Device button in the Unified User Experience, Administrators are capable to select present users and define the Ownership. After pressing Send Invitation, Silverback will check based on the E-Mail Address value and in the following priority, if the selected user(s) are present as Local Users in Silverback (with the same Email address) or are part of the LDAP Filter and will take over either the Username (Local Users) or the Account Field (defined in Silverback LDAP Web Settings) and create a pending enrollment, if the validation is successful. Administrators which has enabled the Receive Email Alerts option, will receive an E-Mail Notification based on the Admin Provisioned a Device Notification Email Template. Users will receive an E-Mail Notification based on the Admin Provisioned a Device Notification for User Email Template. One Time Password settings will be taken over from the Silverback Management Console, as configured under Admin > Self Service Portal > One Time Passwords. All actions (Add Mobile Device) with execution steps and information can be reviewed in the Administration application in the Digital Workplace Platform under Integration > Service Bus > Remote Actions. 

Please refer to the Secure Unified Endpoint Management Release Notes for additional information. 

Enterprise Application Upload

Next to the Enrollment Invitation, the Service Bus Listener is now also capable to receive actions for Enterprise Applications, which has been uploaded in the Unified User Experience for Unified Endpoint Management and Secure Unified Endpoint Management. Each uploaded application will be added into the App Portal and automatically generate a new Tag that is assignable through the Unified User Experience and via Silverback. All newly created applications will have by default the App Management options "Visible in App Portal" and "Automatically push to managed devices" enabled.  To simplify the process of adding applications in the Unified User Experience, *.apk files will be automatically added into both sections in the Silverback App Portal and in the created Tags. For *.ipa files, Administrators can decide if this bundle applies to iOS or iPadOS devices. Depending on the settings, the application will be either created in the iPhone and iPod (for iOS) section and/or in iPad (iPadOS) section. Existing applications records in Silverback will be updated only if no changes in the App Identifier / Bundle ID, Operating System, Version, Application Type are detected. 

Please refer to the Secure Unified Endpoint Management Release Notes for additional information. 

Device Actions for all platforms

One important part of device management is to handle the day-by-day support for administrators. In this release we extended the Service Bus Listener to receive and handle for modern and co-managed devices several new day-by-day actions. Each action listed below can now be performed as a single method or in bulk inside the Unified User Experience for Unified Endpoint Management and Secure Unified Endpoint Management. 

Please refer to the Secure Unified Endpoint Management Release Notes for additional information. 

New Restrictions for iOS and iPadOS 14.5+ and macOS 12

The new OS versions brings a couple of new built-in mobile device management business capabilities, which we added into this Release and happy to share with you. In general restrictions are easy on/off settings that enhances the configuration options of your managed devices and increases security options. Silverback 21.0 Update 2 contains the following new restrictions:

Classroom Configuration

Classroom is a powerful app for iPad and Mac that helps you guide learning, share work, and manage student devices. You can launch a specific app, website, or textbook page on any iPad in the class, share documents between teacher and students, or share student work on a TV, monitor, or projector using Apple TV. With this Release, we introduce the Classroom Configuration with Silverback for iPads. This is the payload for configuring users, groups, and departments within an educational scenario. Apple Classroom can be configured in two main ways: Shared iPad or 1-to-1 iPad. The current classroom profile in Silverback supports the 1-to-1 scenario and the manual configuration of the classroom profile. In this scenario you don't need accounts on Apple School Manager or Managed Apple IDs and your users will always be keeping the same device with them. Please refer to Classroom Configuration in our Knowledgebase for additional information. 

Unique Identifiers for Payloads for iOS, iPadOS 15 and macOS

With iOS15, iPadOS15 and macOS12, Apple has introduced a new requirement for configuration profiles in which every payload in a configuration profile must contain a unique payload identifier. For this, we addressed this requirement with Silverback 20.0 Update 2, so that a transition to the new operating system versions can be seamless and service interruptions can be avoided. Please note that this change only affects the installation of new profiles, for example on newly enrolled devices. All profiles already installed on devices will continue to work after the OS update. If profiles cannot be installed, then the error message “The payloads in this profile do not have unique identifiers” will be displayed in the pending commands under Install Profile.

New Device Information for macOS devices

macOS Big Sur 11.3  and Monterey 12 offer two new device information, which are now part of any macOS device in Silverback:

System Variable support for Custom Profiles

Custom Profiles are a very helpful option to configure additional payloads for your managed devices. You can utilize the Apple Configurator 2 to create custom profiles in a *.mobileconfig format. You can easily open and edit these files by adjusting the file type to *.txt (e.g., on Windows 10) or opening these files directly with the Text Editor (e.g., on macOS devices). With this new Silverback version we are supporting that System Variables can be entered either in the new Use XML option or by uploading a *.mobileconfig file that contains a System Variable. Silverback will adjust the XML or the mobileconfig on the fly and convert the System Variables to the individual values and install this payload with the desired content on your devices. 

Deploy iOS family applications to iPadOS devices 

Based on valued customer feedback, we added in the Volume Purchase Program Import settings an option to overrule the VPP application metadata. When Silverback imports Volume Purchase Program Assets (applications), the product relies on and trusts the given metadata by each application. This metadata contains a device family's part that divides the family to iPhone, iPad and iPod like in the following example: 

      "deviceFamilies": ["iphone","ipad","ipod"]

This separation is usually working great, but applications are missing sometimes one device family, even when the device is capable to install the application (e.g., Instagram or Salesforce Authenticator). In these cases, the applications containing only iPhone and iPod as family and will be imported only in this way into Silverback. To overrule this most common scenario, we added in Silverback 20.0 Update 2 the new import option "Ignore Metadata for Device Families" in the Volume Purchase Program section. By enabling this option, given Metadata for Volume Purchase Program applications will be ignored by Silverback and flagged iPhone applications will be automatically added as iPad applications in the App Portal.

Custom Matching Criteria for Mailboxes

As mentioned already in the beginning of this article, we have dealt with our Exchange Protection in this release cycle, which generally allows you to only allow devices managed in Silverback to communicate with ActiveSync. Based on valued feedback, we extended the capability of the Exchange Protection with a new Matching Criteria option, which you will find under the Exchange Protection configuration in the Admin section. In previous versions, Silverback was trying by default to search on your Exchange server the users' mailbox or the identity by the username attribute. In some scenarios the Username in Silverback, e.g., when using non personalized account names like B23115, the mailbox or the identity could not be found on the Exchange Server, with the following exception 

Exception: System.ApplicationException Message: No result return from Get-CASMailbox b23115

With Silverback 21.0 Update 2, the Matching Criteria can easily be changed from the default {UserName} to any other System Variable, e.g. {UserEmail} or to a mixed input like {firstname}.{lastname}@imagoverum.com.   

System Variables for Maria Miller	Exchange Protection Configuration Example