Release Notes Silverback 22.0 Update 1
About This Release
Matrix42 Silverback 22.0 Update 1 provides new and improved features that have been implemented. During the development of this version, we have been focusing on valued feedback from our customers and partners to provide an ideal feature selection.
Important Announcements
New Runtime Permissions for Android 13
Google adjusted with the release of Android 13 Runtime permissions for applications in context of Notifications, Nearby Wi-Fi Devices and Media permissions and this is affecting the Companion's setup wizard and the user experience. For fetching and submitting the device name to your Silverback Management Console and since the Companion application shows a notification to successfully complete the setup, two new explicit permissions are now required. Starting with Android 13, Companion will request now the permissions to find, connect to, and determine the relative position of nearby devices and to send notifications.
If devices are already running on Android 13 or are recently updated, after updating Companion, the device name will be blanked beginning from the next synchronization until the application is opened once by the user. After opening the Companion, the initial setup wizard will launch from the beginning and users will be prompted to set the missing permissions during the process without performing any additional authentication. If the permission policy restriction is set to Auto Grant, no explicit prompt will be displayed as the missing permissions will be activated automatically. If devices are running already on Android 13 with Companion Version 22.0.0 and the application was opened once, the permission to send notification might be already granted by the user.
Additionally, please note the following:
- Device names won't be retrieved with disabled Allow Bluetooth Restriction
- Android offers two areas for the device name (About Phone & Connection preferences > Bluetooth). The device name displayed in the Management Console belongs to the Bluetooth connection preference. They are by default the same but can be adjusted manually by the user.
Profile Location Change for macOS 13
With macOS 13, Apple has massively changed the design and behaviour for the new System Settings app that looks now more like iOS and iPadOS. For user approved enrollments and for reviewing applied settings, the downloaded or installed MDM Profile is now located under Privacy & Security at the bottom. In case you are providing tutorials for user approved enrollments, be ready to update the documentation according to the changes affected by the new System Settings app coming with macOS 13. The new enrollment flow will be after downloading the profile, open System Settings, select Privacy & Security, scroll down to Others, and select Profiles. Double click on Silverback by Matrix42 enrollment and press install.
Apple Configurator for iPhones
Apple introduced in late 2021, Apple Configurator for iPhones, which allows you to manually add macOS devices to Apple Business Manager or Apple School Manager. With the new major releases iOS 16 and iPadOS 16, Apple Configurator for iPhone can now add other iPhone and iPads to Apple Business or School Manager. This leads to a significant simplification for adding iPhones and iPads to the Device Enrollment program, because from now on it is no longer mandatory to perform the process via a Mac device.
Rapid Security Response for iOS, iPadOS, macOS
A new mechanism has been introduced by Apple to ship critical security fixes to users more rapidly on iOS and iPadOS 16 and macOS 13. Security updates delivered this way do not update the firmware and users can remove the Rapid Security Response update if necessary. For supervised devices, you will have with this new Silverback release, two new options to control the Rapid Security Response which will be highlighted in the new features section.
System Preference Deprecation for macOS 13
The System Preference restrictions was used to hide individual Preference panes from the end user, but with the advent of the new System Settings app, this configuration is deprecated by Apple. We added a tooltip to the System Preference section with the information that the configuration is deprecated.
Required Internet Connection for macOS 13 DEP devices
Starting with macOS 13 and for devices with T2 Security chip and Apple Silicon that are added to the Device Enrollment Program, there will be now a network requirement to go through setup assistant which will be enforced after erase or restore. In previous version, users were able to complete the setup without adding a Network requirement that offered the ability to bypass the enrollment.
Overview
New Features
Android Enterprise
iOS, iPadOS
New Improvements
New Changes
New Features
Android Enterprise
Please find all new Android Enterprise related features in Silverback 22.0 Update 1 below.
Bird's eye view for Application Feedback
Google offers to application developers a feedback channel, so that applications configured via managed configurations can send to Google and to the MDM/EMM system feedback about applied configurations with information like if they are applied successfully or if issues appeared. In previous versions, the feedback information was displayed per device within the device overview under Actions and Application Feedback. With Silverback 22.0 Update 1, we are introducing a new message-centric bird's eye view where you can get a summarized feedback for each application that is using the feedback channel capability. Starting from the App Portal, the summarized feedback is indicated with Silverback 22.0 Update 1 with a notification icon inside the actions column. By opening the icon, a new pop-up will open with a collection of feedback's shown over all devices where a feedback has been received. The overview contains the received messages, an indication for the severity, a device drill down option and the policy name and the policy path.
Bundle Control for Managed Configurations
With the trend for Android Enterprise to configure devices and applications via the OEMConfiguration and/or with Managed Configurations, we made in this release a major improvement for the configuration controllability. As the Managed Configuration for the OEMConfiguration applications like the Knox Service Plugin and Zebra OEM Config offering a wide variety of configurations, they are already clustered into bundles for a better overview. With this release, we added now additionally the option for you to enable/disable bundles that provides you the capability to granularly enable/disable bundles within the Managed Configuration view and a more restrictive control about what will be send and applied to devices.
| Example for Knox Service Plugin Configuration | Example for Zebra OEM Config |
 |
 |
Automatic permission grant for enterprise applications
When installing enterprise applications (*.apk) on Android or Samsung Knox devices, there was in previously no mechanism to automatically grant the required permissions for the application. This can cause your application to not function properly because your users may not grant the permissions they need. Based on valued customer feedback, we implemented this now as the default behaviour for installing Enterprise (*.apk) applications, beginning with Companion version 22.0 Update 1. When users are opening the remotely installed application for the first time, all required permissions will be automatically granted.
iOS, iPadOS
Please find all new iOS and iPadOS related features in Silverback 22.0 Update 1 below.
New Restrictions for iOS and iPadOS 16
The new major iOS and iPadOS versions brings a couple of new built-in mobile device management business capabilities, which we added into this Release and happy to share with you. In general, restrictions are easy on/off settings that enhances the configuration options of your managed devices and increases security options. Silverback 22.0 Update 1 contains the following new restrictions for supervised devices:
| Availability | Options | Requirements | Description | |
|---|---|---|---|---|
| Security & Privacy | ||||
| Allow Rapid Security Response Installation |
|
|
|
Allows to disable the Rapid Security Response mechanism |
| Allow Rapid Security Response Removal |
|
|
|
Blocks the end-user from being able to remove the Rapid Security Response mechanism |
macOS
Please find all new macOS related features in Silverback 22.0 Update 1 below.
New Restrictions for macOS 13
The new major macOS version brings a couple of new built-in mobile device management business capabilities, which we added into this Release and happy to share with you. In general, restrictions are easy on/off settings that enhances the configuration options of your managed devices and increases security options. Silverback 22.0 Update 1 contains the following new restrictions:
| Options | Requirement | Description | |
|---|---|---|---|
| Security & Privacy | |||
| Allow Rapid Security Response Installation |
|
|
Allows to disable the Rapid Security Response mechanism |
| Allow Rapid Security Response Removal |
|
|
Blocks the end-user from being able to remove the Rapid Security Response mechanism |
| Network & Connection | |||
| Allow Universal Control |
|
|
If disabled, this setting will prevent to use the Mac's trackpad and keyboard to control additional Macs and/or iPadOS devices nearby |
| Allow USB Restricted Mode |
|
|
Controls the authorization for new USB accessories. If disabled, allows the device to always connect to USB accessories while locked. |
New Account Setup options for Device Enrollment Program
With this Silverback Release, you have now the option to create accounts on Mac computers by utilizing the Device Enrollment Program. During the enrollment, Silverback will pre-configure accounts and the user process through the account setup portion of the macOS Setup Assistant and the behaviour depends on the options selected. The new options are available under Admin > Device Enrollment Program and can be configured for the Default Profile under General Settings and for Additional Profiles. In general, 13 new options are available and the logic for the configuration is aligned with the requirements and options shown below:
| Configuration | Description |
|---|---|
| No option to create an account | The user doesn’t create any account using Setup Assistant. You must also create a managed administrator account. The user logs in using a network account or another account created outside of Setup Assistant. |
| Create an administrator account | The user creates an administrator account on the Mac. |
| Create a standard account | The user creates a standard account on the Mac. You must also create a managed administrator account. |
| Provide full name or username for the default account | Fills the local account’s full name or username in Setup Assistant when the initial account is being created. The user can override these values if they wish. Requires macOS 10.15 or later. |
| Lock the defaults account's full name or username | The local account is created using the full name or username provided by Silverback. The user can’t override the values. Requires macOS 10.15 or later. |
| Hide the administrator account | By enabling, you can hide that account in the Users & Groups pane of System Preferences/Settings so that users of a Mac don’t interfere with the managed administrator account. |
New Skip Setup Item for Device Enrollment Program
Within this Release, we extended the Device Enrollment Program General Settings and Additional Profiles with the Skip unlock with Apple Watch option. It will skip the Unlock Your Mac with your Apple Watch setup pane during the enrollment with the Device Enrollment Program and is supported for macOS 12 and newer.
New Improvements
Please find all new Improvements in Silverback 22.0 Update 1 below.
Management Console
- Added recent Operating System Versions to OS Version Compliance
- Okta is now a supported Authentication Provider
- Added validation for Server field in Wi-Fi Proxy Settings
- Aligned field sizes and positioning for all tabs in Web Settings
- Added accordion hover for long Tab names in Azure Active Directory section
- Added option to send Test Messages for SMTP with anonymous authentication
- Added support for nested groups for administrative logins with Active Directory accounts
- Removed duplicated iPad Hardware Compliance entries for Pro 256GB Wi-Fi + Cellular and Mini Wi-Fi 16GB
- Fixed an issue with Cloning System Tags when Single App Mode Profile was active for Android and/or Samsung Knox
- Fixed broken layout for Edit Your Details in Web Settings
- Fixed and improved several translations
- Fixed an issue for Silverback is unable to process your request
- When opening MAM with no Azure Active Directory Configuration
- When opening Dashboard with disabled iPhone Device Type on fresh installations
- When opening M42Mobile in Resultant Tag
- Fixed an issue when editing and saving System User Details when CN value contains a space (Active Directory)
Enterprise Service Bus
- Several Admin and Web Settings sections from the Management Console has been added to the Service Bus. This includes the following:
- Admin: App Portal, Backup, Azure Active Directory, Self Service Portal
- Web Settings: Cloud Connector, LDAP, Service Bus, SMTP
- Added Silverback Service Bus Adapter and Silverback Server version information to Node Heartbeat
- Updated Service Bus Message Model to version 6.16.14
- Updated Service Bus Adapter to version 6.6.0.0
iOS, iPadOS
- Added User Enrollment information to Device Overview
- Added Debug Log Method for APNS Parsing
- Updated Companion Push Notification Service certificate
Android Enterprise
- Several improvements are applied to the Application Feedback in the individual devices overview:
- The last modified data is now shown
- Key, Message, and Data responses are now structured and shown in separated lines
- The policy name is now shown in the tooltip
- The policy path inside the tooltip is now also more structured
- Several improvements are applied to Managed Configurations
- Element descriptions are now shown in tooltip
- Added option to set drop-down selections to a blank value
Companion
- Companion Setup Wizard information text has been updated to address changes with Android 12 and Android 13
- Android 13 devices will now request an additional permission for Notifications
- Managed Restrictions are now indicated with an icon if they are controlled by the Samsung Knox restriction section
- Instead of showing No Bluetooth sharing, the restriction value shows now Bluetooth disallowed for Managed Restrictions
- Restriction Allow Sharing Data Into Managed Profile will now be ignored for Device Owner devices
- Improved logging information for empty profiles and added several events to debug mode
- Added DataWedge application as enabled system app
- Fixed an issue for the disallow YouTube restriction status
- Fixed an issue with retrieving the KNOX Version (MDM Version) for Samsung Knox devices
- Knox SDK Version has been updated to version to 3.8
- Updated DPC Support Library to 2022-01-07
Changes
- Changed position for Custom LDAP Variables in Web Settings
- Changed name from OS X to macOS in Skip Setup Items for Device Enrollment Program
- Changed name from OS X to macOS in Device Overview headline
- Changed name from SamsungSafe to Samsung Knox in Tags info and in Simple Enrollment settings
- Change profile installation name from FaultVault Redirection to FileVault
Known Issues
- Skip unlock with Apple Watch option is not saving properly under General Settings and is set to enabled by default in DB.
- Under rare circumstances, it can happen that iPhone devices require more than one enrollment attempt to become successfully managed.
- In that case, Administrators might receive a Manual Profile Deletion Email with Username Pending