Release Notes Silverback 24.0 Update 1

macOS

• Deploy a Software Kiosk to your users 
• Use new Application Deployment Options
• Configure Volume Purchase Program applications 
• Allow Standard Users to configure Privacy Settings for Remote Assistance applications
• Unlock user accounts and reset administrators passwords
• Define the Scope for Custom Profiles

iOS and iPadOS

• Allow or Disallow Mail Privacy Protection

Android Enterprise

• Share and Save Logs Locally

Deploy a Software Kiosk to your users 

With Silverback, we already offer a software kiosk or app portal for smartphones and tablets where users can install, uninstall and update applications that are managed and approved by administrators. The App Portal consists of a web clip that is installed on the devices and when opened displays a web page that presents the App Portal. With this new release, we have made this functionality available for macOS laptops to enable you to provide a software kiosk-like option for your end users. This gives end users an App Store experience to install, uninstall and update applications, even if they are not allowed to download applications from the public App Store. At the same time, it gives you more flexibility in how you deliver and deploy applications to install software that users need on demand.

Use new Application Deployment Options

In this new release, our focus was on bringing macOS application management up to date and fully utilizing all the possibilities that Apple has made available in the recent past, so that there are hardly any differences in application management on iOS, iPadOS and macOS. The result is some new options that are already familiar to administrators of iOS and iPad devices. In addition to the settings for visibility in the App Portal, some new security-specific options can now be set in relation to the removal of applications and data backup, as well as forcing the takeover of applications already installed on the device. 

Configure Volume Purchase Program applications 

Another new feature regarding application management on macOS devices is the direct configuration of Volume Purchase Program applications via the XML schema. Once again, Apple has added the ability to configure applications purchased through the Volume Purchase Program. Both the App Portal and Tags now provide the ability to provide applications with an XML configuration to customize the application to your needs. However, in our experience, configuring macOS Volume Purchase Program applications via XML is currently very limited by the application vendors, and generally configuration has been and still is available via Managed Preferences, which is still the preferred method for Microsoft Outlook in particular. In any case, this new feature makes it possible to simplify application configuration if the application vendor offers the app configuration option(s) for you.

Allow Standard Users to configure Privacy Settings for Remote Assistance applications

By default, if you need to initiate a remote session with the user for support purposes, users on macOS devices will need to set appropriate sharing permissions for the application before they can share their screen or initiate remote control. This is not a problem in cases where the user is set up as an administrator on the device. However, if the user is a standard user and wants to grant the permission, an administrative account must be specified, leaving you with the challenge of enabling a good balance between security and support activities. Starting with macOS 11, Apple offers an additional option in the Privacy Preference profile that allows you to specify for certain applications that users without administrative rights can set the required sensitive permissions for Screen Recording (Capture) and Listen Event. In particular, the new Screen Capture option will finally allow any remote assistance application to allow non-administrative users to share the screen in a remote session. Combined with the long available setting for the Accessibility permission, the Screen Recording permission now provides the last missing piece of peace of mind for a good experience on managed macOS devices. Within the Privacy Preference profile, you now have the ability to set the Screen Capture and Listen to Events permission to allow standard users to set the system service. This ensures that a standard (non-admin) user can configure the permissions for the specified application in the privacy settings for services that would otherwise require administrative permissions.

Unlock user accounts and reset administrators passwords

It can happen that users' accounts are locked due to too many failed login attempts on their device, especially after we added the option for you to configure the maximum number of failed attempts in the last release. In this case, manual intervention on the device is required to unlock the user's account with administrative credentials. To provide a better approach, in this release we have added a new action for macOS devices to unlock locked accounts. When the action is started from the Device Overview > Actions > Unlock User Account, it displays a selection of users that the device has submitted to the system after requesting the UserList command. In addition it shows reported Auto Setup Admin Accounts (see below). After selecting the target user name, the action is confirmed with OK. If a user is not found in the list, it is possible to enter the account short name manually. The action is available to system users with the Administrator, Super Helpdesk, and Helpdesk roles. 

Another newly added action is resetting the admin account password if devices were enrolled through the Device Enrollment Program and an admin account was created during the out-of-the-box experience. The device reports with the device information the created Auto Setup Admin Account, which is predefined listed under Device Overview > Actions > Reset Admin Password when the action is initiated. This action is available to system users with the Administrator role and is active if the device information reports the presence of an Auto Setup Admin account. 

You can review as usual the execution of both actions from the Pending Commands overview, by locating the request types UnlockUserAccount and SetAutoAdminPassword

Define the Scope for Custom Profiles

In macOS, Apple generally offers the option to install configuration profiles and applications in the device or user scope. Profiles installed in the device scope are valid for all users on the device, while user profiles are only active for the user or the account with which the device was logged in to the system. Custom profiles, on the other hand, provide the ability to deploy configurations that are not natively available within the management system and/or are sometimes provided by software vendors. In previous releases, the scope of profile installations was handled by the system, and profiles were installed in the user scope for all non-DEP enrolled devices. For DEP devices, the scope was set to device. However, according to the MDM protocol, some profiles can be installed in both scopes, some require the user scope, and some require the device scope. To address this situation, we have now added a drop-down field in the custom profile configuration to define the required scope for the profile. 

Please note that macOS devices that have been integrated with Silverback 24.0 and older via the Device Enrollment program do not have an active user channel and therefore no profiles can be installed in the user channel, as mentioned above in the Important Announcements. For devices that were integrated via the DEP after the update to Silverback 24.0 Update 1, both channels are active.

Allow or Disallow Mail Privacy Protection

Within this release, we added a new restriction for iOS and iPadOS. In general, restrictions are easy on/off settings that enhances the configuration options of your managed devices and increases security options. This means with this new Silverback release, you can now configure the following new security & privacy setting for supervised devices: 

Share and Save Logs Locally

Another new feature of Silverback 24.0 Update 1 can be found in the Companion application for Android Enterprise devices. Based on feedback from our partners, support agents, and of course from our own experience, we know that sending logs via the email account on the device in troubleshooting scenarios is sometimes not the easiest way. For this purpose, we have implemented two new options in the Companion that allow you to save the log files on the device and then copy them to a PC or laptop with a connected USB cable that supports data transfer. On the other hand, you can also use the sharing feature of the operating system and save the archived log file with the corresponding information about the device in another application, such as Google Drive or Microsoft OneDrive. 

If you choose to store the logs locally on the device, a logs.zip file is created in the internal storage directory for the Companion application. After saving the file, connect your device with a computer via USB cable that supports data transfer. Navigate to Internal storage\Android\data\com.silverbackmdm.epic.companion.ss\files and locate the logs.zip. Be sure to select Use USB for Transferring files / Android Auto on the device and accept any access permissions that may be requested. Also note that the folder may not be accessible from a file explorer application on the device.